CISA Protection of Information Assets 2

Question 1

An IS auditor reviewing a company's encryption practices finds that sensitive data at rest is encrypted using a symmetric key stored in the same database as the data. What is the PRIMARY concern?

Accepted Answer

The encryption key and ciphertext are co-located, negating protection

Answer

Storing the encryption key alongside the encrypted data defeats the purpose of encryption, since an attacker who gains access to the database obtains both.

Question 2

Which of the following BEST describes the purpose of a data loss prevention (DLP) solution?

Accepted Answer

Detecting and blocking unauthorized transmission of sensitive data

Answer

DLP solutions detect, monitor, and block the unauthorized exfiltration or transmission of sensitive data across endpoints, networks, and cloud services.

Question 3

During a network security audit, an IS auditor observes that the organization uses a screened subnet (DMZ) architecture. What is the PRIMARY security benefit of this design?

Accepted Answer

It isolates publicly accessible services from the internal network

Answer

A DMZ places publicly accessible servers in an isolated zone, preventing direct access from the internet to the internal network if a DMZ host is compromised.

Question 4

An organization allows employees to use personal mobile devices for work (BYOD). Which control is MOST important for protecting corporate data on these devices?

Accepted Answer

Implementing mobile device management (MDM) with remote wipe capability

Answer

MDM with remote wipe capability ensures that corporate data can be erased from personal devices if they are lost, stolen, or the employee leaves the organization.

Question 5

An IS auditor is evaluating a company's key management practices. Which of the following represents the GREATEST risk to a public key infrastructure (PKI)?

Accepted Answer

Failure to maintain a current certificate revocation list (CRL)

Answer

An outdated CRL means that compromised or revoked certificates may still be trusted, allowing attackers to impersonate legitimate entities.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Protection of Information Assets 2