The answer is that unencrypted SQL traffic between web and database servers is the most critical security finding. This is because the absence of encryption exposes sensitive data in transit to man-in-the-middle attacks, allowing an attacker who compromises the web server to intercept credentials, query results, or other confidential information in plaintext, even on an internal network. On the CISA exam, this scenario tests your understanding of data-in-transit protections and the principle that internal traffic is not inherently safe; a common trap is dismissing internal network risks as low priority. To remember this, think of the “SQL Sniff” rule: if you can sniff it, you can steal it—encrypting SQL traffic with TLS or IPSec is a non-negotiable control for protecting data in motion.
CISA Practice Question: Information Systems Acquisition, Development and Implementation
This CISA practice question tests your understanding of information systems acquisition, development and implementation. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
The network architecture consists of:
- DMZ segment: web server (public IP), proxy server.
- Internal segment: application server, database server.
- Firewall rules: Allow HTTP/HTTPS from Internet to web server. Allow SQL traffic from web server to database server. Deny all else.
An IS auditor is evaluating the security of the architecture. Which of the following is the MOST critical finding?
Refer to the exhibit.
The network architecture consists of:
- DMZ segment: web server (public IP), proxy server.
- Internal segment: application server, database server.
- Firewall rules: Allow HTTP/HTTPS from Internet to web server. Allow SQL traffic from web server to database server. Deny all else.
A
The web server has a public IP address
Why wrong: Public IP is standard for web servers accessible from the Internet.
B
SQL traffic from the web server to the database server is allowed
Why wrong: This is required for the application; the risk is that it's unencrypted.
C
No encryption for SQL traffic between web and database servers
Unencrypted SQL can be intercepted, compromising data confidentiality.
D
The database server is not placed in the DMZ
Why wrong: It should not be in DMZ; internal placement is correct.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No encryption for SQL traffic between web and database servers
Option C is the most critical finding because unencrypted SQL traffic between the web and database servers exposes sensitive data to interception via man-in-the-middle attacks. Even if the traffic is confined to an internal network, an attacker who compromises the web server can sniff credentials or query results in plaintext. Encrypting SQL traffic with TLS or IPSec is a fundamental security control to protect data in transit.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The web server has a public IP address
Why it's wrong here
Public IP is standard for web servers accessible from the Internet.
✗
SQL traffic from the web server to the database server is allowed
Why it's wrong here
This is required for the application; the risk is that it's unencrypted.
✓
No encryption for SQL traffic between web and database servers
Why this is correct
Unencrypted SQL can be intercepted, compromising data confidentiality.
Related concept
Read the scenario before looking for a memorised answer.
✗
The database server is not placed in the DMZ
Why it's wrong here
It should not be in DMZ; internal placement is correct.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often focus on network placement (DMZ vs. internal) or the mere existence of SQL traffic, rather than recognizing that unencrypted data in transit is a far more critical vulnerability than architectural placement issues.
Detailed technical explanation
How to think about this question
SQL Server uses TDS (Tabular Data Stream) over TCP port 1433 by default, and MySQL uses its own protocol over port 3306; neither encrypts data by default unless TLS is explicitly configured. In a real-world scenario, an attacker who gains access to the web server (e.g., via SQL injection) can run a packet sniffer like tcpdump to capture database credentials or sensitive query results transmitted in cleartext, leading to a full data breach.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CISA exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information Systems Acquisition, Development and Implementation — This question tests Information Systems Acquisition, Development and Implementation — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: No encryption for SQL traffic between web and database servers — Option C is the most critical finding because unencrypted SQL traffic between the web and database servers exposes sensitive data to interception via man-in-the-middle attacks. Even if the traffic is confined to an internal network, an attacker who compromises the web server can sniff credentials or query results in plaintext. Encrypting SQL traffic with TLS or IPSec is a fundamental security control to protect data in transit.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. What is the primary security concern in this architecture?
hard
✓ A.Traffic between application and database servers is not encrypted
B.Web servers are directly accessible from the internet
C.Database port is exposed to application servers
D.Lack of intrusion detection
Why A: The primary security concern is that traffic between the application and database servers is not encrypted. In a typical three-tier web architecture, sensitive data such as authentication credentials, SQL queries, and result sets are transmitted in cleartext if TLS/SSL is not enforced between the application layer and the database layer. This exposes the data to eavesdropping or man-in-the-middle attacks on the internal network, which is a direct violation of the principle of defense in depth and common compliance requirements like PCI DSS or HIPAA.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.