CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the organization's encryption key management program. Which of the following is the MOST critical control to ensure the confidentiality of encrypted data in the event of a key compromise?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key rotation at regular intervals
Key rotation ensures that if a key is compromised, only data encrypted with that key after a certain point is at risk; data encrypted with previous keys remains protected if those keys are properly destroyed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Key rotation at regular intervals
Why this is correct
Rotating keys limits the amount of data exposed if a key is compromised.
- ✗
Key generation using a strong random number generator
Why it's wrong here
Strong generation is important but does not mitigate a compromise after the key is in use.
- ✗
Key destruction procedures for retired keys
Why it's wrong here
Destruction is important but rotation is more critical for ongoing confidentiality.
- ✗
Key distribution via secure channels
Why it's wrong here
Secure distribution prevents interception but does not address post-compromise.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.