CISA Data Management and Database Controls 1 — Questions and Answers
Question 1: Which database concept ensures that a transaction is either fully completed or fully rolled back, preventing partial updates that could corrupt data integrity?
- Consistency
- Isolation
- Atomicity (Correct answer)
- Durability
Correct answer: Atomicity
Atomicity is the ACID property that guarantees a transaction is treated as a single indivisible unit — it either completes entirely or is completely rolled back if any part fails.
Question 2: A CISA auditor reviewing database security should verify that database administrators (DBAs) are PREVENTED from:
- Performing routine maintenance tasks
- Accessing application data they administer without authorization (Correct answer)
- Creating backup jobs
- Monitoring database performance
Correct answer: Accessing application data they administer without authorization
Separation of duties requires that DBAs responsible for infrastructure not have unrestricted access to sensitive application data, preventing insider fraud and unauthorized data access.
Question 3: Which data management control MOST effectively ensures that data has not been altered during storage or transmission?
- Data encryption
- Data masking
- Hash-based integrity checks (Correct answer)
- Data compression
Correct answer: Hash-based integrity checks
Hash-based integrity checks (e.g., SHA-256 checksums) generate a fixed-length fingerprint of data that changes if the data is altered, providing a reliable mechanism to detect unauthorized modification.
Question 4: When auditing database access controls, a CISA auditor should confirm that the principle of least privilege is applied by verifying:
- All users have DBA-level access for flexibility
- Users are granted only the minimum access required for their job function (Correct answer)
- Shared service accounts are used to simplify management
- Read access is unrestricted to improve productivity
Correct answer: Users are granted only the minimum access required for their job function
The principle of least privilege requires granting users only the minimum database permissions necessary to perform their specific job functions, reducing the risk of unauthorized data access or modification.
Question 5: Which technique protects sensitive data in non-production environments by replacing real values with realistic but fictitious data?
- Encryption
- Tokenization
- Data masking (Correct answer)
- Data archiving
Correct answer: Data masking
Data masking replaces sensitive real data with structurally similar but fictional values, allowing development and testing to occur without exposing actual sensitive information.
Question 6: A CISA auditor finds that database audit logging is disabled. The MOST significant risk this creates is:
- Decreased database performance
- Inability to detect or investigate unauthorized data access or modification (Correct answer)
- Increased storage consumption
- Slower query response times
Correct answer: Inability to detect or investigate unauthorized data access or modification
Disabled audit logging eliminates the organization's ability to detect unauthorized access, reconstruct fraudulent transactions, or investigate data breaches, representing a critical control gap.
CISA Data Management and Database Controls 1
Which database concept ensures that a transaction is either fully completed or fully rolled back, preventing partial updates that could corrupt data integrity?