CISA Protection of Information Assets Practice Question
An IS auditor is reviewing a data center's environmental controls and observes that the fire suppression system uses water sprinklers in the main server room. The auditor learns that the sprinkler system was installed when the facility was a general office space. Management states that the sprinklers have never activated. Which of the following should the IS auditor recommend as the MOST appropriate control improvement?
⚠ Common exam trap
The trap here is treating a long incident-free history as evidence that the water sprinkler system is an acceptable control, when the risk is the damage it would cause upon activation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the water sprinkler system with a clean agent or pre-action suppression system appropriate for IT equipment.
Water sprinklers are inappropriate for rooms housing energized IT equipment because discharge can destroy hardware and interrupt operations far beyond the fire itself. A clean agent or pre-action system provides suppression while minimizing collateral damage. Because management's justification rests only on the absence of prior activations, the auditor should recommend replacing the suppression method rather than merely inspecting or accepting it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Document a formal exception accepting the water sprinkler system based on its clean activation history.
Why it's wrong here
Accepting the risk because the system has never activated is a flawed rationale; the absence of past incidents does not lower the probability or impact of future water discharge. An exception without compensating controls leaves critical IT assets exposed. The auditor should not endorse acceptance when a practical, cost-justifiable control improvement exists.
- ✓
Replace the water sprinkler system with a clean agent or pre-action suppression system appropriate for IT equipment.
Why this is correct
Water-based sprinklers can cause catastrophic damage to energized IT equipment, and the historical absence of activation does not reduce that risk. A clean agent or pre-action system suppresses fire while limiting collateral damage to servers and storage. Recommending replacement addresses the actual environmental risk identified during the review and aligns with accepted data center protection practices.
- ✗
Increase the frequency of sprinkler head inspections to ensure they remain operational.
Why it's wrong here
More frequent inspections only confirm that the water sprinklers will function as designed, which is precisely the problem in a server room. The residual risk of water discharge onto live equipment remains unchanged. This recommendation treats maintenance of the wrong control as the remedy and does not mitigate the identified environmental exposure to IT assets.
- ✗
Install additional smoke detectors to provide earlier warning of a fire event.
Why it's wrong here
Earlier detection is valuable, but detection alone does not address the suppression method's destructive potential. Even with prompt alarms, the sprinkler system would still discharge water onto servers once activated. This recommendation improves one layer of defense while leaving the core deficiency in suppression technology unresolved for the data center environment.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.