mediumMultiple SelectObjective-mapped
CISA Practice Question: Which TWO controls are most effective for…
Which TWO controls are most effective for protecting data at rest on a database server? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse network controls (firewall, SSL/TLS) with data-at-rest protection, mistakenly thinking perimeter security or transport encryption secures stored data, when in fact they only protect data in motion or the network layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforcing role-based access control (RBAC)
Role-based access control (RBAC) restricts data access to authorized users based on their roles, directly preventing unauthorized viewing or modification of data at rest. Transparent data encryption (TDE) encrypts the database files at the storage level, ensuring that even if the physical media is stolen, the data remains unreadable without the encryption keys. Both controls address the core requirement of protecting data while it is stored on the database server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Placing the database server behind a firewall
Why it's wrong here
Network segmentation is a perimeter control, not data at rest protection.
- ✓
Enforcing role-based access control (RBAC)
Why this is correct
RBAC ensures only authorized users can access data.
- ✓
Implementing transparent data encryption (TDE)
Why this is correct
TDE encrypts the entire database at rest.
- ✗
Enabling SSL/TLS for client connections
Why it's wrong here
SSL/TLS protects data in transit, not at rest.
- ✗
Using file-level encryption on the database files
Why it's wrong here
File-level encryption is possible but less integrated than TDE for databases.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.