CISA Protection of Information Assets Practice Question
An IS auditor is examining how a financial services firm enforces data loss prevention (DLP) for outbound email. The firm uses a network DLP appliance that inspects SMTP traffic and blocks messages containing unencrypted account numbers. The auditor discovers that employees can bypass the appliance by using a personal webmail account over HTTPS. Which of the following should the auditor recommend FIRST?
⚠ Common exam trap
The trap here is focusing on improving detection accuracy inside a channel that is already monitored instead of closing the unmonitored channel that defeats the control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block access to personal webmail and other unauthorized exfiltration channels at the web gateway, then extend DLP coverage to those channels.
The DLP appliance only inspects SMTP, so employees who use personal webmail over HTTPS bypass it entirely. The most effective first step is to block unauthorized exfiltration channels at the web gateway and extend DLP coverage so the control cannot be trivially circumvented. Closing the unmonitored path addresses the root cause, whereas tuning detection patterns or relying on policy alone leaves the bypass intact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require employees to sign an acceptable use policy acknowledging that personal webmail use is prohibited.
Why it's wrong here
An acceptable use policy is an important governance element, but it is a preventive administrative control that relies on voluntary compliance and does not technically prevent exfiltration. A determined or careless employee can still use personal webmail to send account numbers. Since the auditor has already found a technical control gap, the primary recommendation should be a technical or channel-level remediation, with policy as a supporting measure rather than the first action.
- ✗
Increase the sensitivity of the DLP appliance's pattern matching so it detects account numbers in more formats.
Why it's wrong here
Tuning detection patterns improves accuracy within the SMTP channel but does nothing about the HTTPS webmail path, which the appliance cannot inspect at all. Employees would continue to exfiltrate data through the unmonitored channel regardless of how well the SMTP rules perform. This recommendation treats a symptom within a channel that is already covered rather than the actual bypass that the auditor identified.
- ✓
Block access to personal webmail and other unauthorized exfiltration channels at the web gateway, then extend DLP coverage to those channels.
Why this is correct
The first step is to close the channel that bypasses the existing control. If personal webmail is blocked at the web gateway and DLP coverage is extended to web and other egress paths, employees can no longer trivially circumvent the appliance. This addresses the root cause by eliminating the unmonitored path, after which additional inspection technologies can be layered in as needed. It also aligns with a defense-in-depth approach that does not rely on a single inspection point.
- ✗
Deploy TLS inspection at the perimeter so the DLP appliance can examine HTTPS sessions to webmail providers.
Why it's wrong here
TLS inspection would let the DLP appliance see encrypted webmail traffic, but it introduces significant privacy, performance, and certificate management complexity, and it only addresses one exfiltration channel. It also may be impractical for personal devices and can break legitimate business applications. Given that the immediate gap is a policy and control weakness rather than a purely technical inspection limitation, TLS inspection is a heavier measure than the situation first requires.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.