CISA Protection of Information Assets 3

Question 1

An IS auditor is assessing an organization's vulnerability management program. Which metric is MOST useful for evaluating the program's effectiveness?

Accepted Answer

Mean time to remediate critical vulnerabilities

Answer

Mean time to remediate critical vulnerabilities measures how quickly the organization closes its highest-risk exposures, reflecting the program's actual risk-reduction effectiveness.

Question 2

Which type of access control model assigns permissions based on an individual's job function and restricts access to only what is needed to perform that role?

Accepted Answer

Role-based access control (RBAC)

Answer

RBAC groups users into roles based on job function and assigns permissions to roles, ensuring users can only access resources required for their position.

Question 3

A company stores customer credit card data. According to the Payment Card Industry Data Security Standard (PCI DSS), what is the MINIMUM requirement for protecting stored cardholder data?

Accepted Answer

Primary account numbers (PAN) must be rendered unreadable wherever stored

Answer

PCI DSS requires that PANs be rendered unreadable in storage through methods such as truncation, hashing, tokenization, or strong cryptography.

Question 4

An IS auditor discovers that a third-party vendor with access to the organization's network has not implemented multi-factor authentication (MFA). What is the GREATEST risk this presents?

Accepted Answer

Compromised vendor credentials could provide an attacker with network access

Answer

Without MFA, a single compromised vendor credential can grant attackers full network access, as was demonstrated in high-profile supply chain breaches.

Question 5

Which security testing technique involves simulating an attacker's behavior to identify exploitable vulnerabilities in a live system?

Accepted Answer

Penetration testing

Answer

Penetration testing actively exploits vulnerabilities in a controlled manner to determine what an attacker could actually achieve, going beyond automated scanning.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Protection of Information Assets 3