CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the firewall rule base. Which of the following findings would be of MOST concern?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A rule that allows any service from the Internet to the internal network
An allow rule from any to any (any-any) is overly permissive and poses a significant security risk. The other options are also problems but are less severe than a wide-open rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A rule that has not been reviewed for 18 months
Why it's wrong here
Lack of review is a concern but the rule itself may not be risky.
- ✗
A rule that permits traffic from a specific IP to a database server on port 1433
Why it's wrong here
This is specific and likely has a business justification.
- ✗
A rule that allows any source IP to access a critical server on port 443
Why it's wrong here
While broad, it is limited to one port and may be justified.
- ✓
A rule that allows any service from the Internet to the internal network
Why this is correct
This is a classic any-any rule that bypasses security.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.