CISA Protection of Information Assets Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Interview employees about their understanding of the policy.

  Why it's wrong here

  Interviews reveal employee awareness of the clean desk policy, not whether desks are actually clear, so they provide no direct compliance evidence. It is tempting because interviews are quick and inexpensive, and would be correct for assessing policy understanding rather than testing operational adherence.

• ✗

  Review security awareness training records.

  Why it's wrong here

  Training records evidence that staff were told about the policy, not whether desks are actually clear; awareness completion says nothing about day-to-day behaviour. It is tempting because training is a genuine control for building policy knowledge, and reviewing records would be the right procedure when auditing whether awareness requirements are being met.

• ✗

  Review incident reports related to lost documents.

  Why it's wrong here

  Incident reports capture only failures that were detected and reported, so they reveal nothing about the current state of desks across the organisation. It is tempting because lost-document incidents are a real consequence of poor clean desk practise, and reviewing them would suit an audit of incident trends or control effectiveness over time.

• ✓

  Conduct unannounced walkthroughs of work areas.

  Why this is correct

  Unannounced walkthroughs provide direct, contemporaneous evidence of actual workspace conditions, since staff cannot tidy desks in advance. This tests real compliance with the clean desk policy, unlike interviews or policy reviews that only confirm awareness or documentation.

Go deeper

Related to this question