CISA Protection of Information Assets 2 — Questions and Answers
Question 1: An IS auditor reviewing a company's encryption practices finds that sensitive data at rest is encrypted using a symmetric key stored in the same database as the data. What is the PRIMARY concern?
- Symmetric encryption is insufficient for data at rest
- The encryption key and ciphertext are co-located, negating protection (Correct answer)
- The encryption algorithm may be outdated
- The database lacks proper indexing for encrypted fields
Correct answer: The encryption key and ciphertext are co-located, negating protection
Storing the encryption key alongside the encrypted data defeats the purpose of encryption, since an attacker who gains access to the database obtains both.
Question 2: Which of the following BEST describes the purpose of a data loss prevention (DLP) solution?
- Preventing unauthorized users from logging into systems
- Detecting and blocking unauthorized transmission of sensitive data (Correct answer)
- Encrypting all data stored on endpoint devices
- Monitoring network bandwidth utilization
Correct answer: Detecting and blocking unauthorized transmission of sensitive data
DLP solutions detect, monitor, and block the unauthorized exfiltration or transmission of sensitive data across endpoints, networks, and cloud services.
Question 3: During a network security audit, an IS auditor observes that the organization uses a screened subnet (DMZ) architecture. What is the PRIMARY security benefit of this design?
- It eliminates the need for host-based firewalls on internal servers
- It isolates publicly accessible services from the internal network (Correct answer)
- It provides redundancy for critical network infrastructure
- It encrypts all traffic between the internet and internal systems
Correct answer: It isolates publicly accessible services from the internal network
A DMZ places publicly accessible servers in an isolated zone, preventing direct access from the internet to the internal network if a DMZ host is compromised.
Question 4: An organization allows employees to use personal mobile devices for work (BYOD). Which control is MOST important for protecting corporate data on these devices?
- Requiring employees to sign an acceptable use policy
- Implementing mobile device management (MDM) with remote wipe capability (Correct answer)
- Providing employees with company-owned devices instead
- Installing antivirus software on all personal devices
Correct answer: Implementing mobile device management (MDM) with remote wipe capability
MDM with remote wipe capability ensures that corporate data can be erased from personal devices if they are lost, stolen, or the employee leaves the organization.
Question 5: An IS auditor is evaluating a company's key management practices. Which of the following represents the GREATEST risk to a public key infrastructure (PKI)?
- Using certificate validity periods longer than two years
- Failure to maintain a current certificate revocation list (CRL) (Correct answer)
- Issuing certificates from a third-party certificate authority
- Using SHA-256 instead of SHA-512 for certificate signing
Correct answer: Failure to maintain a current certificate revocation list (CRL)
An outdated CRL means that compromised or revoked certificates may still be trusted, allowing attackers to impersonate legitimate entities.
Question 6: Which security concept is BEST demonstrated when a financial system requires both a manager and an accountant to approve wire transfers above a threshold?
- Least privilege
- Separation of duties (Correct answer)
- Defense in depth
- Need to know
Correct answer: Separation of duties
Requiring two individuals from different roles to authorize a transaction enforces separation of duties, preventing any single person from completing a sensitive transaction alone.
Question 7: An IS auditor reviews logs and finds that a privileged administrator account was used to access financial records outside of business hours with no change ticket. What should the auditor do FIRST?
- Immediately disable the administrator account
- Report the incident to the board of directors
- Determine whether the access was authorized and investigate the business justification (Correct answer)
- Require the administrator to change their password
Correct answer: Determine whether the access was authorized and investigate the business justification
The auditor should first gather facts by determining whether the after-hours access was authorized before drawing conclusions or escalating the finding.
CISA Protection of Information Assets 2
An IS auditor reviewing a company's encryption practices finds that sensitive data at rest is encrypted using a symmetric key stored in the same database as the data.
What is the PRIMARY concern?