CISA Protection of Information Assets 2

Question 1

An IS auditor reviewing a company's encryption practices finds that sensitive data at rest is encrypted using a symmetric key stored in the same database as the data. What is the PRIMARY concern?

Accepted Answer

The encryption key and ciphertext are co-located, negating protection

Answer

Symmetric encryption is insufficient for data at rest

Answer

The encryption algorithm may be outdated

Answer

The database lacks proper indexing for encrypted fields

Question 2

Which of the following BEST describes the purpose of a data loss prevention (DLP) solution?

Accepted Answer

Detecting and blocking unauthorized transmission of sensitive data

Answer

Preventing unauthorized users from logging into systems

Answer

Encrypting all data stored on endpoint devices

Answer

Monitoring network bandwidth utilization

Question 3

During a network security audit, an IS auditor observes that the organization uses a screened subnet (DMZ) architecture. What is the PRIMARY security benefit of this design?

Accepted Answer

It isolates publicly accessible services from the internal network

Answer

It eliminates the need for host-based firewalls on internal servers

Answer

It provides redundancy for critical network infrastructure

Answer

It encrypts all traffic between the internet and internal systems

Question 4

An organization allows employees to use personal mobile devices for work (BYOD). Which control is MOST important for protecting corporate data on these devices?

Accepted Answer

Implementing mobile device management (MDM) with remote wipe capability

Answer

Requiring employees to sign an acceptable use policy

Answer

Providing employees with company-owned devices instead

Answer

Installing antivirus software on all personal devices

Question 5

An IS auditor is evaluating a company's key management practices. Which of the following represents the GREATEST risk to a public key infrastructure (PKI)?

Accepted Answer

Failure to maintain a current certificate revocation list (CRL)

Answer

Using certificate validity periods longer than two years

Answer

Issuing certificates from a third-party certificate authority

Answer

Using SHA-256 instead of SHA-512 for certificate signing

Question 6

Which security concept is BEST demonstrated when a financial system requires both a manager and an accountant to approve wire transfers above a threshold?

Accepted Answer

Separation of duties

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 7

An IS auditor reviews logs and finds that a privileged administrator account was used to access financial records outside of business hours with no change ticket. What should the auditor do FIRST?

Accepted Answer

Determine whether the access was authorized and investigate the business justification

Answer

Immediately disable the administrator account

Answer

Report the incident to the board of directors

Answer

Require the administrator to change their password