easyMultiple ChoiceObjective-mapped
CISA Practice Question: A small manufacturing company uses a…
A small manufacturing company uses a network-attached storage (NAS) device to store design files, financial records, and employee data. The NAS is backed up weekly to an external hard drive that is stored in the same office. The company has no encryption on the NAS or the backup drive. One weekend, the office is burglarized, and both the NAS and the backup drive are stolen. The company had no remote backup. Which of the following would have best protected the data in this scenario?
⚠ Common exam trap
Many candidates choose offsite backup (Option C) because it is a best practice for disaster recovery, but the question specifically asks for protection of the data in a theft scenario where both the primary and backup are stolen together, making encryption the only effective control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enabling full-disk encryption on the NAS
Full-disk encryption (FDE) on the NAS would render the data unreadable without the decryption key, even if the physical device is stolen. Since the backup drive was also unencrypted and stored in the same location, both were equally vulnerable. FDE protects data at rest, which is the primary risk in a theft scenario where physical access is obtained.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enabling full-disk encryption on the NAS
Why this is correct
Encryption renders data unreadable without the key.
- ✗
Implementing strong passwords and user authentication on the NAS
Why it's wrong here
Passwords prevent unauthorized network access but not physical theft.
- ✗
Storing a backup offsite in a secure location
Why it's wrong here
Offsite backup aids recovery but does not protect confidentiality of stolen data.
- ✗
Installing a security camera and alarm system
Why it's wrong here
Surveillance deters theft but does not protect data once stolen.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.