mediumMultiple ChoiceObjective-mapped

Unencrypted SQL Traffic: Critical Security Finding

Exhibit

Refer to the exhibit.

The network architecture consists of:
- DMZ segment: web server (public IP), proxy server.
- Internal segment: application server, database server.
- Firewall rules: Allow HTTP/HTTPS from Internet to web server. Allow SQL traffic from web server to database server. Deny all else.

An IS auditor is evaluating the security of the architecture. Which of the following is the MOST critical finding?

Quick Answer

The answer is that unencrypted SQL traffic between web and database servers is the most critical security finding. This is because the absence of encryption exposes sensitive data in transit to man-in-the-middle attacks, allowing an attacker who compromises the web server to intercept credentials, query results, or other confidential information in plaintext, even on an internal network. On the CISA exam, this scenario tests your understanding of data-in-transit protections and the principle that internal traffic is not inherently safe; a common trap is dismissing internal network risks as low priority. To remember this, think of the “SQL Sniff” rule: if you can sniff it, you can steal it—encrypting SQL traffic with TLS or IPSec is a non-negotiable control for protecting data in motion.

⚠ Common exam trap

The trap here is that candidates often focus on network placement (DMZ vs. internal) or the mere existence of SQL traffic, rather than recognizing that unencrypted data in transit is a far more critical vulnerability than architectural placement issues.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No encryption for SQL traffic between web and database servers

The most critical finding because unencrypted SQL traffic between the web and database servers exposes sensitive data to interception via man-in-the-middle attacks. Even if the traffic is confined to an internal network, an attacker who compromises the web server can sniff credentials or query results in plaintext. Encrypting SQL traffic with TLS or IPSec is a fundamental security control to protect data in transit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The web server has a public IP address
Why it's wrong here
Public IP is standard for web servers accessible from the Internet.
✗
SQL traffic from the web server to the database server is allowed
Why it's wrong here
This is required for the application; the risk is that it's unencrypted.
✓
No encryption for SQL traffic between web and database servers
Why this is correct
Unencrypted SQL can be intercepted, compromising data confidentiality.
✗
The database server is not placed in the DMZ
Why it's wrong here
It should not be in DMZ; internal placement is correct.

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

Go deeper

1 more way this is tested on CISA

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. What is the primary security concern in this architecture?

hard

✓ A.Traffic between application and database servers is not encrypted
B.Web servers are directly accessible from the internet
C.Database port is exposed to application servers
D.Lack of intrusion detection

Why A: The primary security concern is that traffic between the application and database servers is not encrypted. In a typical three-tier web architecture, sensitive data such as authentication credentials, SQL queries, and result sets are transmitted in cleartext if TLS/SSL is not enforced between the application layer and the database layer. This exposes the data to eavesdropping or man-in-the-middle attacks on the internal network, which is a direct violation of the principle of defense in depth and common compliance requirements like PCI DSS or HIPAA.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.