CISM Information Security Programme Practice Question
During a security architecture review, the security architect identifies that a new application stores sensitive customer data in plaintext in the database. The application owner argues that performance requirements prevent encryption. What is the most appropriate compensating control to reduce risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Database activity monitoring (DAM)
Database activity monitoring (DAM) can detect unauthorized access or exfiltration attempts, providing visibility and alerting without impacting performance. Encryption at rest is preferred, but DAM is a compensating control when encryption is not feasible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement strong password policies for database access
Why it's wrong here
Passwords are insufficient to protect data at rest if the database is compromised.
- ✗
Network segmentation to isolate the database server
Why it's wrong here
Segmentation reduces exposure but doesn't prevent data exfiltration if access is gained.
- ✗
Conduct more frequent vulnerability scans
Why it's wrong here
Scanning identifies vulnerabilities but does not protect data at rest.
- ✓
Database activity monitoring (DAM)
Why this is correct
DAM monitors and alerts on suspicious database queries, compensating for lack of encryption.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.