Scenario practice questions

An IS auditor is reviewing a change management process. A developer made an emergency change directly to production without following the standard change approval process. The change was later documented as a normal change. Which control weakness is MOST indicated by this scenario?

Trap 1: Absence of a rollback plan for emergency changes

Rollback plans are relevant but not the primary weakness highlighted.

Trap 2: Insufficient testing of emergency changes before deployment

Testing is important, but the main issue is unauthorized access.

Trap 3: Lack of a formal change documentation policy

Documentation was done, though improperly categorized.

A
Inadequate segregation of duties between development and production environments
Direct production access by developers violates segregation of duties.
B
Absence of a rollback plan for emergency changes
Why wrong: Rollback plans are relevant but not the primary weakness highlighted.
C
Insufficient testing of emergency changes before deployment
Why wrong: Testing is important, but the main issue is unauthorized access.
D
Lack of a formal change documentation policy
Why wrong: Documentation was done, though improperly categorized.

Question 2hardmultiple choice

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

Trap 1: A Trojan horse disguised as legitimate software.

Trojans are malware that appear legitimate but may not be signed; the distinguishing factor here is the valid signature.

Trap 2: A zero-day exploit targeting an unpatched vulnerability.

The file's behavior is malicious, but the key aspect is its legitimate digital signature; zero-day focuses on unknown vulnerabilities.

Trap 3: A fileless attack that never writes to disk.

Fileless attacks reside in memory; this scenario involves a file with a digital signature.

A
A Trojan horse disguised as legitimate software.
Why wrong: Trojans are malware that appear legitimate but may not be signed; the distinguishing factor here is the valid signature.
B
Signed malware, indicating the certificate may have been compromised.
The file has a trusted digital signature but performs malicious actions, suggesting the signing key was stolen or misused.
C
A zero-day exploit targeting an unpatched vulnerability.
Why wrong: The file's behavior is malicious, but the key aspect is its legitimate digital signature; zero-day focuses on unknown vulnerabilities.
D
A fileless attack that never writes to disk.
Why wrong: Fileless attacks reside in memory; this scenario involves a file with a digital signature.

Question 3mediummultiple choice

An organization is implementing a new identity management system. Which testing approach is MOST effective for verifying access controls?

Trap 1: Regression testing

Regression testing ensures new changes don't break existing functionality, but does not specifically target access controls.

Trap 2: Unit testing

Unit testing focuses on individual code units, not end-to-end access controls.

Trap 3: System integration testing

Integration testing verifies interfaces but may not cover all access control scenarios.

A
Regression testing
Why wrong: Regression testing ensures new changes don't break existing functionality, but does not specifically target access controls.
B
Unit testing
Why wrong: Unit testing focuses on individual code units, not end-to-end access controls.
C
User acceptance testing including role-based test cases
Role-based UAT scenarios simulate real user tasks and validate that access controls are correctly implemented.
D
System integration testing
Why wrong: Integration testing verifies interfaces but may not cover all access control scenarios.

Question 4easymultiple choice

During a security audit, it was found that users in the finance department have unnecessary access to HR payroll data. Which access control principle has been violated?

Trap 1: Mandatory access control

MAC is a model based on labels, not a principle violated by unnecessary access.

Trap 2: Separation of duties

Separation of duties prevents fraud by dividing tasks, but does not address unnecessary access.

Trap 3: Need to know

Need-to-know is a part of least privilege; the core violation is excessive privileges beyond job functions.

A
Mandatory access control
Why wrong: MAC is a model based on labels, not a principle violated by unnecessary access.
B
Least privilege
Least privilege requires that users have only the minimum access necessary to perform their job functions.
C
Separation of duties
Why wrong: Separation of duties prevents fraud by dividing tasks, but does not address unnecessary access.
D
Need to know
Why wrong: Need-to-know is a part of least privilege; the core violation is excessive privileges beyond job functions.

Question 5easymulti select

Which of the following are effective controls to protect sensitive data in use? (Choose TWO.)

Trap 1: Transport Layer Security (TLS)

TLS protects data in transit, not in use.

Trap 2: Access control lists (ACLs)

ACLs control access to stored data, not data in use.

Trap 3: Hashing

Hashing is typically used for integrity verification, not for protecting data in use.

A
Transport Layer Security (TLS)
Why wrong: TLS protects data in transit, not in use.
B
Access control lists (ACLs)
Why wrong: ACLs control access to stored data, not data in use.
C
Homomorphic encryption
Homomorphic encryption allows computations on ciphertext without decrypting.
D
Data masking
Data masking obscures data while in use in non-production environments.
E
Hashing
Why wrong: Hashing is typically used for integrity verification, not for protecting data in use.

Question 6mediummultiple choice

An organization is implementing a data classification policy and needs to assign ownership for sensitive data. Which of the following is the most appropriate role to assign as the data owner?

Trap 1: The chief information security officer (CISO)

The CISO is responsible for security strategy, not data ownership.

Trap 2: The system administrator of the database

System administrators manage systems, not data ownership.

Trap 3: The legal counsel responsible for compliance

Legal counsel advises on compliance but does not own data.

A
The chief information security officer (CISO)
Why wrong: The CISO is responsible for security strategy, not data ownership.
B
The system administrator of the database
Why wrong: System administrators manage systems, not data ownership.
C
The head of the business unit that creates and uses the data
The business unit head is accountable for the data's classification and protection.
D
The legal counsel responsible for compliance
Why wrong: Legal counsel advises on compliance but does not own data.

Question 7hardmultiple choice

An IS auditor is evaluating the effectiveness of an organization's information security awareness program. Which of the following is the BEST indicator of program effectiveness?

Trap 1: Percentage of employees who completed the training

Completion does not guarantee learning or behavioral change.

Trap 2: Number of employees who acknowledged the security policy

Acknowledgment is not indicative of understanding or compliance.

Trap 3: Average score on the post-training quiz

Knowledge test scores do not measure practical application.

A
Percentage of employees who completed the training
Why wrong: Completion does not guarantee learning or behavioral change.
B
Number of employees who acknowledged the security policy
Why wrong: Acknowledgment is not indicative of understanding or compliance.
C
Average score on the post-training quiz
Why wrong: Knowledge test scores do not measure practical application.
D
Trend in security incidents attributed to human error
A downward trend indicates improved behavior due to awareness.

Question 8mediummultiple choice

You are an information security manager for a global financial services company. The organization maintains a hybrid infrastructure with critical customer data stored on an on-premises Oracle database server (DB-SRV-01) and in an AWS S3 bucket (customer-data-prod). At 10:00 AM, the security operations center (SOC) alerts you to an anomalous outbound data transfer from DB-SRV-01 to an unknown IP address in a high-risk country. The transfer started at 9:45 AM and involves 500 MB of data, likely including personally identifiable information (PII). The SOC has already quarantined the server's network egress by blocking all outbound traffic from DB-SRV-01, but the server remains connected to the internal production network. Meanwhile, a separate analysis indicates that the S3 bucket has been accessed via an IAM key that was stolen from a compromised developer workstation three days ago. The key has not been rotated. The incident response team is preparing to act. The primary objective is to protect information assets and minimize data exposure. Given this scenario, which of the following actions should the team take FIRST?

Trap 1: Restore DB-SRV-01 from a clean backup taken before the incident and…

Restoring from backup would destroy the live system state needed for forensic investigation and does not address the active S3 bucket access; changing keys is necessary but not the first step.

Trap 2: Notify the appropriate data protection authority within the…

Notification is a legal step but is not an immediate containment action; the first priority is to stop the bleeding, not to report it.

Trap 3: Patch the Oracle database server to the latest version to close any…

Patching is important but should come after containment and forensic preservation; applying patches without understanding the attack vector may destroy evidence and not stop the active compromise.

A
Restore DB-SRV-01 from a clean backup taken before the incident and change the IAM keys for the S3 bucket.
Why wrong: Restoring from backup would destroy the live system state needed for forensic investigation and does not address the active S3 bucket access; changing keys is necessary but not the first step.
B
Notify the appropriate data protection authority within the required 72-hour timeframe.
Why wrong: Notification is a legal step but is not an immediate containment action; the first priority is to stop the bleeding, not to report it.
C
Patch the Oracle database server to the latest version to close any known vulnerabilities.
Why wrong: Patching is important but should come after containment and forensic preservation; applying patches without understanding the attack vector may destroy evidence and not stop the active compromise.
D
Isolate DB-SRV-01 from the internal network by disconnecting its network cable or disabling the virtual switch port.
Isolating the server halts any ongoing data exfiltration and prevents the attacker from moving laterally to other systems. This preserves the system state for forensic analysis while containing the breach.

Question 9easymultiple choice

A small manufacturing company uses a network-attached storage (NAS) device to store design files, financial records, and employee data. The NAS is backed up weekly to an external hard drive that is stored in the same office. The company has no encryption on the NAS or the backup drive. One weekend, the office is burglarized, and both the NAS and the backup drive are stolen. The company had no remote backup. Which of the following would have best protected the data in this scenario?

Trap 1: Implementing strong passwords and user authentication on the NAS

Passwords prevent unauthorized network access but not physical theft.

Trap 2: Storing a backup offsite in a secure location

Offsite backup aids recovery but does not protect confidentiality of stolen data.

Trap 3: Installing a security camera and alarm system

Surveillance deters theft but does not protect data once stolen.

A
Enabling full-disk encryption on the NAS
Encryption renders data unreadable without the key.
B
Implementing strong passwords and user authentication on the NAS
Why wrong: Passwords prevent unauthorized network access but not physical theft.
C
Storing a backup offsite in a secure location
Why wrong: Offsite backup aids recovery but does not protect confidentiality of stolen data.
D
Installing a security camera and alarm system
Why wrong: Surveillance deters theft but does not protect data once stolen.

Read the full NAT/PAT explanation →

Question 10mediummultiple choice

Scenario: A healthcare organization is implementing a new electronic health records (EHR) system. The project has been delayed due to scope creep and resource constraints. The project sponsor is pressuring the project manager to accelerate the timeline by skipping user acceptance testing (UAT) and going live immediately. The organization has a governance policy that requires all IT projects to complete UAT before deployment. The project manager is concerned about quality and patient safety. Which of the following is the BEST course of action?

Trap 1: Compromise by conducting a limited UAT on only critical…

Partial UAT may still miss defects and is not full compliance.

Trap 2: Resign from the project due to ethical concerns.

Extreme; the manager should escalate the issue first.

Trap 3: Accept the sponsor's request and skip UAT to meet the deadline.

Violates governance policy and risks patient safety.

A
Compromise by conducting a limited UAT on only critical functionalities.
Why wrong: Partial UAT may still miss defects and is not full compliance.
B
Resign from the project due to ethical concerns.
Why wrong: Extreme; the manager should escalate the issue first.
C
Accept the sponsor's request and skip UAT to meet the deadline.
Why wrong: Violates governance policy and risks patient safety.
D
Adhere to the governance policy and escalate the risk to the steering committee for a decision.
Follows policy and involves proper governance body.

Read the full NAT/PAT explanation →

Question 11hardmultiple choice

Scenario: A mid-sized manufacturing company has recently experienced a significant IT outage that halted production for 8 hours. The root cause was a failed firmware update on a core switch that was performed outside the change management process by a senior network engineer who claimed the update was urgent to patch a critical vulnerability. The company has a well-documented change management policy that requires all changes to be reviewed by the change advisory board (CAB) before implementation, except for emergency changes which require post-implementation review within 48 hours. The engineer did not follow the emergency change process; he implemented the update directly. The IT director wants to prevent such incidents in the future. Which of the following is the BEST action?

Trap 1: Implement automatic firmware updates to eliminate human error.

Automatic updates bypass change management and could cause outages.

Trap 2: Increase the frequency of CAB meetings to weekly to expedite change…

Does not prevent unauthorized changes; the engineer bypassed the process entirely.

Trap 3: Remove the network engineer's administrative access to all network…

Overly restrictive; the engineer needs access for legitimate tasks.

A
Implement automatic firmware updates to eliminate human error.
Why wrong: Automatic updates bypass change management and could cause outages.
B
Increase the frequency of CAB meetings to weekly to expedite change approvals.
Why wrong: Does not prevent unauthorized changes; the engineer bypassed the process entirely.
C
Enforce the change management policy by implementing stricter controls and disciplinary measures for non-compliance.
Enforcing existing policy with consequences ensures adherence.
D
Remove the network engineer's administrative access to all network devices.
Why wrong: Overly restrictive; the engineer needs access for legitimate tasks.