CISA Data Management and Database Controls 2

Question 1

Which type of database backup captures only the data that has changed since the last full backup, minimizing backup window time?

Accepted Answer

Incremental backup

Answer

Incremental backups capture only data changed since the last backup of any type (full or incremental), minimizing the backup window but requiring all incrementals and the last full backup for a complete restore.

Question 2

In the context of data classification, which category MOST appropriately describes Social Security Numbers and medical records?

Accepted Answer

Confidential/restricted data

Answer

Social Security Numbers and medical records are highly sensitive personally identifiable information (PII) and protected health information (PHI) that require the highest level of data classification and protection controls.

Question 3

A CISA auditor reviewing data retention policies should verify that the retention periods are PRIMARILY based on:

Accepted Answer

Legal, regulatory, and business requirements

Answer

Data retention periods must be defined based on applicable legal requirements (e.g., SOX, HIPAA), regulatory mandates, contractual obligations, and legitimate business needs to ensure compliance and minimize risk.

Question 4

Which database control prevents a user from reading data at a higher sensitivity level than their clearance, enforcing confidentiality in multi-level security systems?

Accepted Answer

Mandatory Access Control (MAC)

Answer

Mandatory Access Control (MAC) enforces access based on sensitivity labels and user clearance levels, preventing users from accessing data classified above their clearance level regardless of other permissions.

Question 5

When performing a data quality audit, a CISA auditor should assess which characteristic to verify that data accurately represents the real-world objects or events it describes?

Accepted Answer

Data accuracy

Answer

Data accuracy ensures that stored data values correctly represent the real-world entities or transactions they are meant to reflect, which is fundamental to reliable business decision-making.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Data Management and Database Controls 2