CISA Data Management and Database Controls 2 — Questions and Answers
Question 1: Which type of database backup captures only the data that has changed since the last full backup, minimizing backup window time?
- Full backup
- Differential backup
- Incremental backup (Correct answer)
- Snapshot backup
Correct answer: Incremental backup
Incremental backups capture only data changed since the last backup of any type (full or incremental), minimizing the backup window but requiring all incrementals and the last full backup for a complete restore.
Question 2: In the context of data classification, which category MOST appropriately describes Social Security Numbers and medical records?
- Public data
- Internal use data
- Confidential/restricted data (Correct answer)
- Unclassified data
Correct answer: Confidential/restricted data
Social Security Numbers and medical records are highly sensitive personally identifiable information (PII) and protected health information (PHI) that require the highest level of data classification and protection controls.
Question 3: A CISA auditor reviewing data retention policies should verify that the retention periods are PRIMARILY based on:
- IT storage capacity limits
- Employee convenience and accessibility needs
- Legal, regulatory, and business requirements (Correct answer)
- Vendor recommendations only
Correct answer: Legal, regulatory, and business requirements
Data retention periods must be defined based on applicable legal requirements (e.g., SOX, HIPAA), regulatory mandates, contractual obligations, and legitimate business needs to ensure compliance and minimize risk.
Question 4: Which database control prevents a user from reading data at a higher sensitivity level than their clearance, enforcing confidentiality in multi-level security systems?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
Mandatory Access Control (MAC) enforces access based on sensitivity labels and user clearance levels, preventing users from accessing data classified above their clearance level regardless of other permissions.
Question 5: When performing a data quality audit, a CISA auditor should assess which characteristic to verify that data accurately represents the real-world objects or events it describes?
- Data completeness
- Data accuracy (Correct answer)
- Data timeliness
- Data uniqueness
Correct answer: Data accuracy
Data accuracy ensures that stored data values correctly represent the real-world entities or transactions they are meant to reflect, which is fundamental to reliable business decision-making.
Question 6: Which control BEST ensures that database changes made in production are authorized, tested, and documented before implementation?
- Automatic database replication
- Formal change management process with approval workflow (Correct answer)
- Unrestricted DBA access to production
- Frequent full database backups
Correct answer: Formal change management process with approval workflow
A formal change management process with required approvals, testing in non-production environments, and documentation ensures that only authorized and validated changes are applied to production databases.
CISA Data Management and Database Controls 2
Which type of database backup captures only the data that has changed since the last full backup, minimizing backup window time?