CISA Data Management and Privacy Controls

Question 1

Which data classification level TYPICALLY requires the most stringent access controls and encryption?

Accepted Answer

Confidential/Restricted

Answer

Public

Answer

Internal use only

Answer

Unclassified

Question 2

A data retention policy should PRIMARILY be based on:

Accepted Answer

Legal, regulatory, and business requirements for each data type

Answer

The available storage capacity of the organization

Answer

The preference of the IT department

Answer

The age of the data management system

Question 3

The principle of data minimization requires organizations to:

Accepted Answer

Collect and retain only the personal data necessary for a specific purpose

Answer

Store as much data as possible to support future analytics

Answer

Encrypt all data regardless of sensitivity

Answer

Share data freely among business units to improve efficiency

Question 4

Which of the following BEST describes data sovereignty?

Accepted Answer

The legal principle that data is subject to the laws of the country in which it is stored

Answer

The right of an individual to access their personal data

Answer

The ability to move data freely between cloud providers

Answer

An encryption method that ensures only authorized users can read data

Question 5

A database activity monitoring (DAM) tool PRIMARILY helps an IS auditor by:

Accepted Answer

Providing real-time visibility into who is accessing and modifying database data

Answer

Automatically encrypting sensitive database fields

Answer

Replacing the need for database access controls

Answer

Compressing database logs to save storage space

Question 6

When personally identifiable information (PII) must be used in a test environment, the BEST practice is to:

Accepted Answer

Use data masking or anonymization to de-identify the PII

Answer

Copy production data directly into the test environment

Answer

Limit test environment access to senior developers only

Answer

Delete test data immediately after each test cycle