CISM Information Security Program Practice Question
Exhibit
Refer to the exhibit. Suspicious Activity Log: Timestamp: 2025-03-21 14:32:15 UTC Event ID: 5678 Source IP: 192.168.1.50 User: jdoe Action: File download File: payroll_encrypted.xlsx Status: Failed - Encryption key not found Additional Info: Downloaded using HTTPS from external IP 203.0.113.45
An information security manager reviews the suspicious activity log shown in the exhibit. The payroll file is supposed to be encrypted and only accessible internally. What is the MOST likely cause for the failed download?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user lacked permission to decrypt the file
The status 'Encryption key not found' indicates that the user does not have the necessary decryption key, likely due to lack of permission. Option A is wrong because certificate expiry would show a different error. Option B is wrong because if the file were not encrypted, it would download successfully. Option D is wrong because if the external IP were blocked, the download would not initiate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user's encryption certificate has expired
Why it's wrong here
The user's encryption certificate has expired: This would typically result in a certificate-related error, not an 'Encryption key not found' status.
- ✗
The file was not encrypted before being uploaded
Why it's wrong here
The file was not encrypted before being uploaded: If the file were unencrypted, the download would proceed without a key error.
- ✓
The user lacked permission to decrypt the file
Why this is correct
The user lacked permission to decrypt the file: The error message 'Encryption key not found' strongly suggests the user does not have the required decryption key, often due to insufficient permissions.
- ✗
The external IP is blocked by the firewall
Why it's wrong here
The external IP is blocked by the firewall: A firewall block would prevent the download from starting, not produce a key-related error.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.