CISA Protection of Information Assets Practice Question
An IS auditor is reviewing how an organization manages its backup media. The auditor learns that full backups are written to tape each night, the tapes are stored in a cabinet in the data center, and the same cabinet is used to store cleaning supplies and spare hardware. Which of the following is the MOST significant risk the auditor should highlight?
⚠ Common exam trap
The trap here is jumping to the on-site storage issue while overlooking that the media are physically exposed to contaminants in the same cabinet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Backup media are stored without environmental protection and alongside materials that could damage or contaminate the tapes.
Backup tapes stored in a cabinet shared with cleaning supplies and spare hardware are exposed to chemical vapors, dust, impact, and spills that can render the media unreadable. Because these tapes are the organization's recovery capability, their physical protection is critical. The auditor should report the lack of environmental controls and the co-location with potentially damaging materials as the most significant risk in this finding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Backup media are stored without environmental protection and alongside materials that could damage or contaminate the tapes.
Why this is correct
Cleaning supplies and spare hardware in the same cabinet introduce chemical vapors, dust, physical impact, and possible liquid spills that can corrupt magnetic tape media. This is a direct threat to the recoverability of the organization's backup data. The auditor should report that media lack proper environmental controls and are exposed to contaminants and physical hazards, which jeopardizes restoration when it is needed most.
- ✗
Nightly full backups consume excessive storage capacity and should be replaced with incremental backups.
Why it's wrong here
Backup strategy optimization is a valid operational consideration, but the scenario describes a physical protection failure, not a capacity problem. Replacing full backups with incrementals would not address the risk that the existing tapes could be damaged by their storage environment. The auditor should focus on safeguarding the media rather than redesigning the backup schedule, which is a separate and less urgent matter here.
- ✗
The backup process may not be documented, creating a risk of inconsistent restores.
Why it's wrong here
Documentation is important for reliable restoration, but the scenario provides no evidence that procedures are undocumented. The auditor has observed a specific, concrete condition: backup media stored with cleaning supplies and spare hardware. Raising a speculative documentation concern would distract from the confirmed physical risk to the media, which is the finding that warrants immediate management attention.
- ✗
Backup tapes stored on-site cannot be used to restore data after a disaster that destroys the data center.
Why it's wrong here
On-site storage does create a single point of failure for disaster recovery, and off-site rotation is a recognized control. However, the scenario also reveals an immediate physical threat to the media from co-located supplies and hardware. The most significant risk combines the lack of environmental protection with the absence of off-site copies, but the co-location with cleaning supplies is the more concrete and immediate deficiency in this finding.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.