CISA Protection of Information Assets Practice Question
During a review of firewall rule sets, an IS auditor finds a rule that allows any source IP to access any destination IP on TCP port 443. Which of the following should the auditor do FIRST?
⚠ Common exam trap
The trap is jumping to remediation or escalation — CISA questions frequently test whether candidates understand that auditors must first gather evidence and assess justification before recommending action, reflecting the 'audit, don't fix' principle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Determine if the rule has a documented business justification.
When an IS auditor identifies a potentially risky firewall rule, the first step is to determine whether the rule has a documented business justification before taking any action. Auditors must gather evidence and understand the context — a rule allowing TCP 443 from any source may be legitimate for a public-facing web server. Only after establishing whether the rule is justified can the auditor decide on escalation or remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Test whether the rule is actually being used.
Why it's wrong here
Usage testing may follow, but the initial step is to check authorization.
- ✗
Escalate the finding to senior management.
Why it's wrong here
Escalation precedes validating the rule's business purpose, so management receives an unconfirmed finding. Escalation is warranted once impact is established, but the auditor must first determine whether the any-any rule is genuinely required or a misconfiguration.
- ✓
Determine if the rule has a documented business justification.
Why this is correct
Before judging the any-any port 443 rule as a finding, the auditor must establish whether a documented business justification exists. Determining intent and approval first distinguishes an authorised exception from an undocumented, unjustified exposure, directing subsequent audit action appropriately.
- ✗
Recommend immediate removal of the rule.
Why it's wrong here
Recommending immediate removal bypasses the audit process: the auditor's first duty is to report the finding and assess whether the rule is authorised, since it may support legitimate public web services. Removal is remediation, owned by management, and would be the correct action only after confirming the rule is unauthorised and exploitable.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.