CISA Protection of Information Assets Practice Question
During an audit of physical security, the IS auditor observes that employees frequently leave confidential documents on their desks overnight. Which TWO controls should the auditor recommend?
⚠ Common exam trap
The trap is choosing physical detection controls (CCTV, motion detectors) because they sound security-related, when the question asks for controls that directly address the observed behavior of leaving documents on desks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct security awareness training
Option B (Conduct security awareness training) is correct because the root cause of documents being left out overnight is employee behavior, and awareness training directly educates staff on their security responsibilities, the risks of leaving confidential information exposed, and proper handling and storage procedures. Option C (Implement a clean desk policy) is correct because it establishes a formal, enforceable requirement that all sensitive documents be secured or locked away at the end of the workday, directly addressing the observed weakness and providing a basis for audits and disciplinary action. Option A (Deploy additional CCTV cameras) is not appropriate because cameras only provide detective/monitoring capability and do not prevent employees from leaving documents on desks. Option D (Implement a visitor management system) does not belong because the issue involves employees, not visitors, and visitor control does not address internal document handling. Option E (Install motion detectors) is not relevant because motion detection is an intrusion-detection control for after-hours physical access, not a control over how employees handle confidential documents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy additional CCTV cameras
Why it's wrong here
CCTV records activity but neither prevents documents being left out nor enforces a clean-desk rule; it provides after-the-fact evidence only. It is the correct choice for monitoring and deterring intrusion in restricted areas, not for changing employee document-handling behaviour.
- ✓
Conduct security awareness training
Why this is correct
Security awareness training addresses the human behaviour behind documents left on desks, teaching staff classification handling and the clean desk requirement. It complements procedural controls by changing the culture that causes the exposure the auditor observed.
- ✓
Implement a clean desk policy
Why this is correct
A clean desk policy mandates that confidential documents be secured or locked away at end of day, removing the physical exposure the auditor observed. It sets an enforceable standard against which compliance can be audited, unlike training alone.
- ✗
Implement a visitor management system
Why it's wrong here
A visitor management system logs and escorts external visitors; it does nothing about employees leaving documents on desks. It is the right control for controlling unauthorised physical access by non-employees, not for enforcing clean-desk handling of confidential material.
- ✗
Install motion detectors
Why it's wrong here
Motion detectors detect movement in a space, not documents left on desks overnight, so they cannot prevent or identify the observed exposure. They suit intrusion detection in unoccupied secure areas, which is a different risk from unattended confidential material.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.