CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the physical security controls at a data center. The auditor observes that the data center has a single entrance with a biometric scanner, but the door is propped open by a cleaning cart while the cleaning staff works inside. Which of the following is the MOST appropriate action for the auditor to take?
⚠ Common exam trap
The trap here is assuming that because the individuals present are authorized, the propped door is acceptable, when in fact the open door allows anyone to enter without authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the observation as a finding because the propped door defeats the access control and allows unauthorized entry.
A propped door completely bypasses the biometric access control, creating a path for unauthorized entry. The auditor should document this as a finding because it represents a failure of the physical access control objective. The appropriate recommendation would be to implement compensating controls such as door alarms, mantrap entrances, or strict policy enforcement to prevent doors from being held open.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the observation because the cleaning staff are authorized personnel who have undergone background checks.
Why it's wrong here
Even if cleaning staff are authorized, propping the door allows anyone else to enter unnoticed. The control is defeated regardless of who propped it. Background checks do not mitigate the risk of unauthorized individuals entering through the open door. Ignoring the observation would fail to address a significant physical security gap and would not meet the auditor's responsibility to report control weaknesses.
- ✗
Recommend replacing the biometric scanner with a more robust access control system.
Why it's wrong here
The biometric scanner is not the problem; the issue is that the door is being held open, bypassing the existing control. Replacing the scanner would not prevent someone from propping the door open. The appropriate recommendation is to enforce door-closing policies, add door alarms, or use mantrap entries, not to replace a functioning access control device. This option misdiagnoses the root cause.
- ✗
Report the issue to the cleaning supervisor and consider the matter resolved.
Why it's wrong here
Informally reporting to a supervisor does not fulfill the auditor's obligation to document and formally communicate the finding. The issue may recur, and there is no evidence of corrective action. The auditor should document the finding in the audit report and recommend a formal control improvement, such as door alarms or policy enforcement, rather than treating a verbal notification as resolution.
- ✓
Document the observation as a finding because the propped door defeats the access control and allows unauthorized entry.
Why this is correct
A propped door bypasses the biometric access control, allowing anyone to enter without authentication. This is a clear physical security weakness that undermines the entire access control objective. The auditor should document it as a finding because it represents a real risk of unauthorized access. Observing and reporting the issue is the appropriate audit action, not ignoring or downplaying it.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.