CISA Protection of Information Assets Practice Question
During a review of firewall rule sets, an IS auditor identifies a rule that allows 'any-any' traffic from an internal subnet to the DMZ. The rule was implemented six months ago based on a business request that has since been completed. The firewall administrator explains that the rule was kept for convenience. Which of the following is the BEST audit recommendation?
⚠ Common exam trap
The trap is choosing 'modify the rule' because it seems less disruptive, but the rule is no longer needed, so removal is the best practice; also, 'any-any' is too broad to simply modify without understanding requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the rule immediately and verify no impact
The rule is overly permissive, no longer justified by business need, and poses an unnecessary risk. The best recommendation is to remove the rule immediately and verify no impact, as it aligns with the principle of least privilege and reduces the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a penetration test to assess the risk
Why it's wrong here
A penetration test samples exploitable paths at a point in time; it does not remove the stale any-any rule, so the exposure persists regardless of findings. Testing suits validating controls after remediation, whereas the audit finding here is an undocumented, expired rule requiring removal or formal review.
- ✓
Remove the rule immediately and verify no impact
Why this is correct
The any-any rule grants broad internal-to-DMZ access with no business justification, violating least privilege and expanding the attack surface. Removing it and verifying no impact eliminates the exposure while confirming that no legitimate dependency remains.
- ✗
Document the rule with a risk acceptance signed by management
Why it's wrong here
Risk acceptance legitimises a rule that should be deleted once its business request closed; it suits residual risk that cannot be remediated economically, not convenience-driven configuration drift. The auditor's recommendation should be rule removal, with acceptance only if management formally justifies retention.
- ✗
Modify the rule to allow only specific ports and protocols
Why it's wrong here
Port narrowing retains the rule's internal-to-DMZ reachability, which the completed business request no longer justifies; least privilege means removing the rule entirely, not refining it. Port restriction fits when a documented, ongoing requirement exists but the current scope is broader than necessary.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.