mediumMultiple ChoiceObjective-mapped
CISM Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` Security Policy – Data Classification Category A: Public – No restrictions on disclosure. Category B: Internal – Limited to employees; no external sharing without approval. Category C: Confidential – Access on a need-to-know basis; encryption required for transmission. Category D: Restricted – Highest sensitivity; requires encryption at rest and in transit, dual control for access, and quarterly audits. ```
Refer to the exhibit. An organization is implementing access controls for a new data repository that will store financial reports classified as Category C. Which of the following is the MOST appropriate control to include?
⚠ Common exam trap
Watch out — candidates often confuse 'most appropriate' with 'most comprehensive' and select RBAC (Option B) because it is a common access control, but the question specifically focuses on protecting data in transit for a new repository, making encryption the direct and immediate control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require encryption of data in transit
Requiring encryption of data in transit (e.g., TLS 1.3, IPsec) is the most appropriate control because Category C financial reports are sensitive and must be protected from interception during transmission over networks. This aligns with the principle of protecting data confidentiality and integrity at the network layer, which is a fundamental security control for any data repository handling classified information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require encryption of data in transit
Why this is correct
Category C explicitly requires encryption for transmission.
- ✗
Implement role-based access control (RBAC)
Why it's wrong here
RBAC is a mechanism but not specifically mandated for Category C.
- ✗
Enforce dual control for access
Why it's wrong here
Dual control is required for Category D, not C.
- ✗
Conduct quarterly access reviews
Why it's wrong here
Quarterly audits are required for Category D, not C.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.