The answer is data masking and homomorphic encryption. Data masking protects data in use by replacing sensitive values with realistic but fictitious data, ensuring that unauthorized users never see the actual information during processing or display. Homomorphic encryption goes a step further by allowing computations to be performed directly on encrypted ciphertext without ever decrypting it, so the plaintext remains hidden even while being actively analyzed or transformed. On the CISA exam, this topic tests your understanding of how to safeguard data across all states—at rest, in transit, and in use—with a common trap being to confuse encryption at rest (like AES) with in-use protections. Remember that in-use controls must prevent exposure during active processing, not just storage. A helpful memory tip: “Mask the view, encrypt the compute” to recall that data masking hides the output, while homomorphic encryption hides the input during computation.
CISA Protection of Information Assets Practice Question
This CISA practice question tests your understanding of protection of information assets. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which of the following are effective controls to protect sensitive data in use? (Choose TWO.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Homomorphic encryption
Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, thereby protecting the data while it is in use. This is a critical control for scenarios where sensitive data must be processed by untrusted environments, as the plaintext is never exposed during processing.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
ACLs control access to stored data, not data in use.
✓
Homomorphic encryption
Why this is correct
Homomorphic encryption allows computations on ciphertext without decrypting.
Related concept
Read the scenario before looking for a memorised answer.
✓
Data masking
Why this is correct
Data masking obscures data while in use in non-production environments.
Related concept
Read the scenario before looking for a memorised answer.
✗
Hashing
Why it's wrong here
Hashing is typically used for integrity verification, not for protecting data in use.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse controls for data in transit (TLS) or data at rest (ACLs, hashing) with controls for data in use, failing to recognize that homomorphic encryption and dynamic data masking are specifically designed to protect data during active processing.
Detailed technical explanation
How to think about this question
Homomorphic encryption schemes, such as those based on the Learning With Errors (LWE) problem, enable operations like addition and multiplication on ciphertexts, producing encrypted results that decrypt to the correct plaintext output. This is computationally intensive; for example, fully homomorphic encryption (FHE) can be thousands of times slower than plaintext operations, making it suitable only for specific use cases like secure cloud analytics or private medical data processing. Data masking, on the other hand, replaces sensitive values with realistic but fictitious data, allowing processing in non-production environments while preserving referential integrity.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Protection of Information Assets — This question tests Protection of Information Assets — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Homomorphic encryption — Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, thereby protecting the data while it is in use. This is a critical control for scenarios where sensitive data must be processed by untrusted environments, as the plaintext is never exposed during processing.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.