CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the physical security of a data center. The auditor observes that the main entrance uses a proximity card reader, but the door to the server cage area is propped open with a box because the badge reader is malfunctioning. Staff state that the reader has been broken for two weeks and that a work order has been submitted. Which of the following should the IS auditor recommend FIRST?
⚠ Common exam trap
The trap here is choosing the administrative or disciplinary follow-up, such as expediting the repair or punishing staff, instead of first containing the live physical access exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately secure the door and implement interim monitoring until the reader is repaired.
The propped door is an active physical access control failure exposing the server cage to unauthorized entry. The auditor should first ensure the exposure is contained through immediate securing of the door and interim compensating measures such as monitoring, then pursue repair and accountability. Reporting alone or focusing on discipline or repair scheduling does not protect the assets during the outage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recommend disciplinary action against the staff who propped the door open.
Why it's wrong here
Disciplinary action may be warranted later, but it does not close the open door or restore protection of the server cage now. Focusing on personnel consequences before containment leaves the physical vulnerability in place. The auditor's first duty is to ensure the risk is mitigated, with accountability addressed as a separate management matter.
- ✓
Immediately secure the door and implement interim monitoring until the reader is repaired.
Why this is correct
A propped-open door defeats the access control protecting the server cage, allowing unescorted entry to critical assets. The immediate priority is to close the exposure through interim measures such as a guard, logging, or a temporary lock, while the repair proceeds. Addressing the vulnerability first aligns with the auditor's duty to escalate significant control failures promptly.
- ✗
Escalate the outstanding work order to expedite the badge reader repair.
Why it's wrong here
Expediting the repair is sensible but does not address the exposure during the remaining downtime, which could be days. The door remains open to anyone in the facility until the reader is fixed. Prioritizing the repair over immediate containment leaves critical assets unprotected in the interim and understates the urgency of the physical access gap.
- ✗
Document the finding in the audit report and await management's remediation plan.
Why it's wrong here
Routine reporting is appropriate for many findings, but an open door to a server cage is an active, ongoing exposure that warrants immediate escalation and interim controls. Waiting for a written remediation plan leaves the asset unprotected in the meantime. The auditor should communicate urgent risks as they arise rather than deferring solely to the reporting cycle.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.