hardMultiple ChoiceObjective-mapped

CISA Practice Question: Based on the exhibit, what is the MOST likely…

Exhibit

Refer to the exhibit.

```
[Storage Policy: HR_Data]
Retention: 7 years
Encryption: AES-256
Access: Restricted (HR Managers only)
Backup: Daily, stored in Offsite Vault
Last Compliance Check: 2023-02-15
Status: Non-compliant (Reason: Backup media not encrypted)
```

Based on the exhibit, what is the MOST likely compliance issue requiring immediate remediation?

⚠ Common exam trap

ISACA often tests the distinction between operational issues (e.g., retention period) and security controls (e.g., encryption), and the trap here is that candidates may focus on the visible retention label rather than the missing encryption safeguard.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Backup media lacks encryption.

The exhibit shows backup tapes stored in an unsecured cabinet without any indication of encryption. Since backup media often contains sensitive data, the lack of encryption exposes the organization to data breaches if the media is lost or stolen. This is a direct violation of data protection requirements and requires immediate remediation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Access is not properly restricted.
Why it's wrong here
Access is restricted to HR Managers only.
✗
Compliance checks are not being performed.
Why it's wrong here
Last compliance check is recorded.
✓
Backup media lacks encryption.
Why this is correct
Status explicitly states backup media not encrypted.
✗
Retention period is too short.
Why it's wrong here
Retention period is 7 years, no issue indicated.

Go deeper

CISA Practice Question: Based on the exhibit, what is the MOST likely…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question