CISA Protection of Information Assets 3 — Questions and Answers
Question 1: An IS auditor is assessing an organization's vulnerability management program. Which metric is MOST useful for evaluating the program's effectiveness?
- Total number of vulnerabilities discovered per scan
- Mean time to remediate critical vulnerabilities (Correct answer)
- Number of security scans performed per quarter
- Percentage of systems covered by the vulnerability scanner
Correct answer: Mean time to remediate critical vulnerabilities
Mean time to remediate critical vulnerabilities measures how quickly the organization closes its highest-risk exposures, reflecting the program's actual risk-reduction effectiveness.
Question 2: Which type of access control model assigns permissions based on an individual's job function and restricts access to only what is needed to perform that role?
- Discretionary access control (DAC)
- Mandatory access control (MAC)
- Role-based access control (RBAC) (Correct answer)
- Attribute-based access control (ABAC)
Correct answer: Role-based access control (RBAC)
RBAC groups users into roles based on job function and assigns permissions to roles, ensuring users can only access resources required for their position.
Question 3: A company stores customer credit card data. According to the Payment Card Industry Data Security Standard (PCI DSS), what is the MINIMUM requirement for protecting stored cardholder data?
- All cardholder data must be deleted within 30 days of a transaction
- Primary account numbers (PAN) must be rendered unreadable wherever stored (Correct answer)
- Cardholder data must be stored only on isolated air-gapped systems
- All cardholder data must be encrypted using AES-256
Correct answer: Primary account numbers (PAN) must be rendered unreadable wherever stored
PCI DSS requires that PANs be rendered unreadable in storage through methods such as truncation, hashing, tokenization, or strong cryptography.
Question 4: An IS auditor discovers that a third-party vendor with access to the organization's network has not implemented multi-factor authentication (MFA). What is the GREATEST risk this presents?
- The vendor may violate the organization's acceptable use policy
- Compromised vendor credentials could provide an attacker with network access (Correct answer)
- The vendor's employees may access unauthorized cloud services
- The organization's compliance reporting may be inaccurate
Correct answer: Compromised vendor credentials could provide an attacker with network access
Without MFA, a single compromised vendor credential can grant attackers full network access, as was demonstrated in high-profile supply chain breaches.
Question 5: Which security testing technique involves simulating an attacker's behavior to identify exploitable vulnerabilities in a live system?
- Vulnerability scanning
- Penetration testing (Correct answer)
- Code review
- Threat modeling
Correct answer: Penetration testing
Penetration testing actively exploits vulnerabilities in a controlled manner to determine what an attacker could actually achieve, going beyond automated scanning.
Question 6: An organization implements a security information and event management (SIEM) system. What is the PRIMARY purpose of this control?
- Encrypting log data to prevent unauthorized access
- Correlating security events from multiple sources to detect threats (Correct answer)
- Blocking network traffic that matches known attack signatures
- Providing single sign-on for enterprise applications
Correct answer: Correlating security events from multiple sources to detect threats
A SIEM aggregates and correlates log data from across the environment to identify security incidents that may not be visible from any single source.
Question 7: When auditing physical security controls for a data center, which finding would represent the HIGHEST risk?
- Visitor badges are a different color from employee badges
- The server room door uses a PIN code without a backup biometric reader
- Terminated employees' access badges are deactivated within 24 hours (Correct answer)
- Security camera footage is retained for only 14 days
Correct answer: Terminated employees' access badges are deactivated within 24 hours
Retaining departed employees' access for any period after termination allows them to potentially access physical areas, representing an immediate and significant risk.
CISA Protection of Information Assets 3
An IS auditor is assessing an organization's vulnerability management program.
Which metric is MOST useful for evaluating the program's effectiveness?