hardMultiple ChoiceObjective-mapped
CISA Practice Question: During a third-party software vendor audit, the…
During a third-party software vendor audit, the IS auditor discovers that the vendor uses a common shared database for multiple clients and relies on application-level access controls. Which of the following is the GREATEST concern?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data from different clients may be commingled and accessible.
The greatest concern is that the vendor uses a common shared database for multiple clients and relies solely on application-level access controls. If there is a vulnerability or misconfiguration in the application, it could allow unauthorized access to data from other clients, leading to data commingling and exposure. This poses a significant risk to data confidentiality and could violate contractual or regulatory requirements. In contrast, the other options (encryption at rest, penetration testing frequency, and segregation of duties) are important but secondary to the immediate risk of data leakage due to shared database architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data from different clients may be commingled and accessible.
Why this is correct
Application-level access controls can be circumvented, causing data leakage between clients.
- ✗
The database does not encrypt data at rest.
Why it's wrong here
Encryption is important but not the greatest concern given shared database.
- ✗
The vendor does not perform regular penetration testing.
Why it's wrong here
Pen testing is good but absence is less critical than the shared database risk.
- ✗
The vendor lacks segregation of duties among administrators.
Why it's wrong here
Segregation is important but not as critical as the risk of data leakage between clients.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.