CISA Data Management and Database Controls

Question 1

Which database concept ensures that a transaction is either fully completed or fully rolled back, preventing partial updates that could corrupt data integrity?

Accepted Answer

Atomicity

Answer

Atomicity is the ACID property that guarantees a transaction is treated as a single indivisible unit — it either completes entirely or is completely rolled back if any part fails.

Question 2

A CISA auditor reviewing database security should verify that database administrators (DBAs) are PREVENTED from:

Accepted Answer

Accessing application data they administer without authorization

Answer

Separation of duties requires that DBAs responsible for infrastructure not have unrestricted access to sensitive application data, preventing insider fraud and unauthorized data access.

Question 3

Which data management control MOST effectively ensures that data has not been altered during storage or transmission?

Accepted Answer

Hash-based integrity checks

Answer

Hash-based integrity checks (e.g., SHA-256 checksums) generate a fixed-length fingerprint of data that changes if the data is altered, providing a reliable mechanism to detect unauthorized modification.

Question 4

When auditing database access controls, a CISA auditor should confirm that the principle of least privilege is applied by verifying:

Accepted Answer

Users are granted only the minimum access required for their job function

Answer

The principle of least privilege requires granting users only the minimum database permissions necessary to perform their specific job functions, reducing the risk of unauthorized data access or modification.

Question 5

Which technique protects sensitive data in non-production environments by replacing real values with realistic but fictitious data?

Accepted Answer

Data masking

Answer

Data masking replaces sensitive real data with structurally similar but fictional values, allowing development and testing to occur without exposing actual sensitive information.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Data Management and Database Controls