hardMultiple Choice
CISA Practice Question: During a third-party software vendor audit, the…
During a third-party software vendor audit, the IS auditor discovers that the vendor uses a common shared database for multiple clients and relies on application-level access controls. Which of the following is the GREATEST concern?
⚠ Common exam trap
CISA often tests the severity of risks in multi-tenant environments; candidates may focus on encryption or penetration testing as the greatest concern, but the exam expects recognition that commingling of client data with only application-level controls poses the most direct and severe confidentiality risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data from different clients may be commingled and accessible.
The greatest concern is that data from different clients may be commingled and accessible because the vendor uses a common shared database with only application-level access controls. If application controls fail or are bypassed, clients could access each other's data, leading to a confidentiality breach and compliance violations. This represents a multi-tenancy risk that is more severe than the other issues listed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data from different clients may be commingled and accessible.
Why this is correct
Application-level controls alone cannot prevent cross-client exposure if the shared database or application is compromised or misconfigured. Commingled client data in one repository removes the isolation boundary, so a single flaw could expose every tenant's records, making this the greatest concern.
- ✗
The database does not encrypt data at rest.
Why it's wrong here
Encryption at rest protects stored data from media theft, but the shared database with application-level controls means one tenant's flaw exposes every client's records — cross-tenant isolation is the concern. Encryption is tempting because it addresses data confidentiality, and would be correct if the database were dedicated to a single client.
- ✗
The vendor does not perform regular penetration testing.
Why it's wrong here
Irregular penetration testing is a genuine weakness, but it is a detection gap rather than the exposure itself. It tempts because testing is a standard audit checkpoint, yet the shared database with only application-level controls permits cross-client access if those controls are bypassed, which is the greater concern.
- ✗
The vendor lacks segregation of duties among administrators.
Why it's wrong here
Weak segregation of duties among administrators is a real control deficiency, but it concerns internal fraud risk rather than tenant isolation. It tempts because auditors routinely flag it, yet the shared database with only application-level access controls means a single flaw can expose every client's data.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.