CISA Protection of Information Assets 4

Question 1

An IS auditor reviews an organization's patch management policy and finds that critical security patches are applied within 72 hours on internet-facing servers but within 30 days on internal servers. What is the AUDITOR'S BEST assessment?

Accepted Answer

The 30-day window for internal servers may be excessive and should be risk-assessed

Answer

A blanket 30-day patch cycle for internal servers may be too long, especially for critical vulnerabilities, and the risk should be evaluated against the organization's threat profile.

Question 2

Which of the following BEST describes the concept of 'defense in depth' as applied to information security?

Accepted Answer

Applying multiple overlapping security controls so that failure of one does not compromise the system

Answer

Defense in depth layers multiple security controls so that if one control fails or is bypassed, additional controls still protect the asset.

Question 3

An organization is implementing a new cloud storage solution for sensitive data. Which of the following should the IS auditor verify FIRST?

Accepted Answer

Whether the organization retains control of encryption keys used to protect the data

Answer

Retaining control of encryption keys ensures that the organization can protect its data even if the cloud provider is compromised, subpoenaed, or goes out of business.

Question 4

An IS auditor evaluates an organization's identity governance program and finds that user access reviews are performed annually. What is the PRIMARY weakness of this approach?

Accepted Answer

Excessive or unauthorized access can persist for up to 12 months before detection

Answer

Annual access reviews allow inappropriate access to go undetected for up to a year, significantly increasing the risk window for insider threats and privilege abuse.

Question 5

Which of the following is the MOST effective control to prevent SQL injection attacks against a web application?

Accepted Answer

Using parameterized queries and prepared statements in application code

Answer

Parameterized queries separate SQL code from user-supplied input at the code level, eliminating the root cause of SQL injection vulnerabilities.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Protection of Information Assets 4