hardMultiple ChoiceObjective-mapped
CISA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. Exhibit: The following architecture description is for a financial transaction processing system: - Web servers in DMZ handle user requests. - Application servers process business logic. - Database servers store transaction records. - All traffic between tiers is encrypted usng TLS. - Logs are collected centrally in a SIEM. - A firewall separates the DMZ from internal network. - Application servers can initiate outbound connections to the internet for updates.
Refer to the exhibit. An IS auditor is reviewing the architecture. Which of the following is the MOST critical security weakness?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application servers can initiate outbound internet connections.
Allowing application servers to initiate outbound connections to the internet is a common attack vector (e.g., for command and control, data exfiltration). In a secure architecture, application servers should only communicate with necessary internal services, and outbound internet access should be restricted. Option B (TLS between tiers) is a security best practice, not a weakness. Option C (centralized logging) enhances monitoring and is not a weakness. Option D (lack of encryption on database) is not necessarily the most critical compared to the risk of outbound internet access from application servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application servers can initiate outbound internet connections.
Why this is correct
This bypasses security controls and can be exploited.
- ✗
The use of TLS between tiers.
Why it's wrong here
TLS is a security control, not a weakness.
- ✗
Centralized logging to a SIEM.
Why it's wrong here
SIEM enhances monitoring.
- ✗
Lack of encryption on the database server.
Why it's wrong here
TLS encrypts traffic; database-level encryption is not mentioned but not a critical weakness in this context.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.