CISA - Certified Information Systems Auditor Protection of Information Assets Questions and Answers — Questions and Answers
Question 1: An IS auditor discovers that an organization has a data classification policy but has not assigned an owner to each information asset. Which of the following represents the GREATEST risk associated with this finding?
- Inconsistent application of security controls across different systems.
- Lack of accountability for ensuring information assets are appropriately protected. (Correct answer)
- Increased costs for data storage due to improper data handling.
- Inability to classify new information assets as they are created.
Correct answer: Lack of accountability for ensuring information assets are appropriately protected.
The primary role of an information asset owner is to be accountable for the protection of that asset. This includes responsibilities like determining the data's classification level and ensuring that adequate security controls are implemented and maintained. Without a designated owner, there is no clear line of accountability, which often leads to assets being unprotected or under-protected.
Question 2: An organization needs to encrypt a large database for data-at-rest protection. Performance is a key requirement, and the system processing the data is in a secure, controlled environment. Which of the following encryption methods is MOST appropriate for this scenario?
- Asymmetric encryption
- Hashing
- Symmetric encryption (Correct answer)
- Digital signature
Correct answer: Symmetric encryption
Symmetric encryption uses a single key for both encryption and decryption, which is significantly faster and more computationally efficient than asymmetric encryption. This makes it the ideal choice for encrypting large volumes of data, such as entire databases or files at rest.
Question 3: Which of the following is the PRIMARY objective of implementing the principle of least privilege within an identity and access management program?
- To streamline the user access review and certification process.
- To simplify the access control list (ACL) for network administrators.
- To ensure users can perform all tasks associated with their job role without interruption.
- To limit the potential damage from a compromised account or insider threat. (Correct answer)
Correct answer: To limit the potential damage from a compromised account or insider threat.
The principle of least privilege dictates that a user should only be granted the minimum permissions necessary to perform their job functions. Its primary security goal is to reduce the 'attack surface' and limit the 'blast radius' of a security breach. If an account is compromised, the attacker's capabilities are restricted to only that account's minimal permissions, thus containing the potential damage.
Question 4: An IS auditor is reviewing the disposal process for retired server hard drives that contained highly sensitive proprietary research data. The current process involves reformatting the drives before sending them to an electronics recycler. The auditor's BEST recommendation would be to:
- implement a process for physical destruction or degaussing prior to disposal. (Correct answer)
- overwrite the drives multiple times with random data patterns.
- encrypt the drives using a strong algorithm before reformatting.
- obtain a certificate of destruction from the third-party recycler.
Correct answer: implement a process for physical destruction or degaussing prior to disposal.
Standard formatting does not remove data; it only removes file system pointers, leaving the data easily recoverable. For highly sensitive data, a more robust sanitization method is required to render the data infeasible to recover. According to NIST SP 800-88, physical destruction (e.g., shredding, disintegrating) or degaussing (for magnetic media) provides the highest level of assurance that data cannot be reconstructed.
Question 5: Within a Public Key Infrastructure (PKI), what is the primary role of a Certificate Authority (CA)?
- To securely generate and store the private keys for all entities in the infrastructure.
- To encrypt and decrypt messages exchanged between two communicating parties.
- To act as a trusted third party that binds a public key to a verified entity's identity. (Correct answer)
- To define the security policies for certificate usage and key management.
Correct answer: To act as a trusted third party that binds a public key to a verified entity's identity.
The fundamental purpose of a Certificate Authority (CA) is to act as a trusted entity that vouches for the identity of a certificate holder. The CA verifies the identity of an individual, server, or organization and then issues a digital certificate that cryptographically binds that identity to a public key, establishing a chain of trust.
Question 6: A company is concerned that its employees may be accidentally or maliciously sending sensitive customer lists via corporate email to external parties. Which of the following would be the MOST effective control to detect and prevent this specific type of data exfiltration?
- Implementing end-to-end email encryption.
- Conducting regular security awareness training on data handling.
- Deploying a host-based intrusion prevention system (HIPS) on all workstations.
- Implementing a network-based Data Loss Prevention (DLP) solution. (Correct answer)
Correct answer: Implementing a network-based Data Loss Prevention (DLP) solution.
A Data Loss Prevention (DLP) solution is specifically designed to address this risk. Network-based DLP tools can inspect outbound email traffic in real-time, identify content that matches predefined patterns or classifications for sensitive data (like customer lists), and then block, quarantine, or alert on the transmission, thereby preventing the data leak.
CISA - Certified Information Systems Auditor Protection of Information Assets Questions and Answers
An IS auditor discovers that an organization has a data classification policy but has not assigned an owner to each information asset.
Which of the following represents the GREATEST risk associated with this finding?