mediumMultiple ChoiceObjective-mapped
CISA Practice Question: A software development company uses a cloud-based…
A software development company uses a cloud-based source code repository (e.g., GitHub) to store proprietary code. The company has two-factor authentication (2FA) enabled for all accounts. A developer's personal computer was infected with malware that stole the developer's session cookies and local credentials. The attacker used the stolen session to access the code repository and exfiltrated the entire codebase. The company's security team reviews the incident and notes that the repository has audit logging, but the logs were not monitored in real time. The team wants to implement additional controls to prevent a similar incident. Which control would have been most effective in preventing the exfiltration?
⚠ Common exam trap
Candidates often choose a detective or session-management control (like SIEM or shorter timeout) because they focus on the stolen session cookies, but the most effective preventive control is one that restricts the network origin of access, which the attacker cannot bypass without a corporate IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require access to the code repository only from company-managed IP addresses
Restricting access to the code repository to only company-managed IP addresses (e.g., via a VPN or a corporate NAT gateway) would have prevented the attacker from using the stolen session cookies from an external, non-corporate IP. Even though the attacker had valid session tokens, the repository's access control list (ACL) would have blocked the connection at the network layer, stopping the exfiltration before it could begin. This control addresses the root cause—unauthorized network origin—rather than relying on detection or session management alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a SIEM to alert on unusual access patterns in real time
Why it's wrong here
SIEM is detective, not preventive.
- ✗
Enforce code signing for all commits
Why it's wrong here
Code signing ensures authenticity of code, does not prevent exfiltration.
- ✓
Require access to the code repository only from company-managed IP addresses
Why this is correct
IP whitelisting prevents access from unauthorized locations.
- ✗
Implement a shorter session timeout for the code repository
Why it's wrong here
Shorter timeout reduces window but session could be reused immediately.
Visual reference
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.