CISA Protection of Information Assets Practice Question
An organization's security team proposes deploying a network-based intrusion prevention system (IPS) inline at the internet perimeter. Management asks the IS auditor to comment on the operational implications before approving the purchase. Which of the following should the auditor identify as the MOST significant operational risk of the inline placement?
⚠ Common exam trap
The trap here is evaluating the IPS primarily as a detection tool and overlooking that inline enforcement makes the device a single point of failure for business traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A false positive or device failure could block legitimate business traffic and cause an outage.
Inline prevention changes the device from a passive observer into a component whose failure or misconfiguration directly affects service delivery. Every packet traverses it, so latency, throughput limits, and false positives translate into user-visible outages. The auditor should therefore focus on fail-open behavior, bypass paths, change control for signature updates, and a tuning period in detection mode before blocking is enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IPS will be unable to inspect encrypted traffic without additional decryption capability.
Why it's wrong here
Visibility into TLS sessions is a genuine limitation, but it applies to any inspection point and is usually addressed by feeding decrypted traffic from a TLS termination or broker. It reduces detection quality rather than threatening service continuity. Compared with the potential for the device itself to interrupt production traffic, an inspection gap is a lesser operational risk at the perimeter.
- ✓
A false positive or device failure could block legitimate business traffic and cause an outage.
Why this is correct
Because inline prevention sits directly in the traffic path, a misclassified signature, a capacity limit, or a hardware fault can drop legitimate sessions for every user behind it. Availability of business services becomes dependent on the IPS tuning and resilience. This is the most significant operational risk and explains why fail-open design, bypass, and staged tuning are essential before enforcement mode is enabled.
- ✗
The IPS will not be able to correlate events with host-based logs from servers.
Why it's wrong here
Correlation is a function of the SIEM or log management platform that receives feeds from both sources, not of where the IPS sits in the network. Placement affects what the sensor can see and block, not whether its alerts can be joined with host telemetry. This distractor confuses a monitoring architecture decision with the inline enforcement decision under review.
- ✗
Signature updates will consume WAN bandwidth and degrade branch office performance.
Why it's wrong here
Update traffic is small, scheduled, and easily shaped or served from a local management console. Even in large deployments it is negligible relative to production flows. Raising it as the primary operational risk overstates a manageable administrative detail and misses the fact that inline prevention can interrupt live sessions, which is a far more consequential availability concern.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.