CISA Protection of Information Assets 5

Question 1

An IS auditor is reviewing controls over a company's security awareness training program. Which finding would be of GREATEST concern?

Accepted Answer

Training content has not been updated to reflect new phishing techniques in the past 18 months

Answer

Outdated training that does not address current attack methods fails to prepare employees for actual threats, undermining the program's effectiveness regardless of completion rates.

Question 2

When reviewing an organization's incident response plan, an IS auditor should verify that the plan includes which of the following as a CRITICAL element?

Accepted Answer

Defined roles, responsibilities, and escalation procedures

Answer

Clearly defined roles, responsibilities, and escalation procedures ensure coordinated and timely response when an incident occurs, which is the most critical operational element.

Question 3

An organization uses tokenization to protect customer payment data. What is the PRIMARY advantage of tokenization over encryption for this use case?

Accepted Answer

Tokens are meaningless outside the tokenization system, reducing the value of a data breach

Answer

Tokens are random substitutes with no mathematical relationship to the original data, so stolen tokens have no value to an attacker without access to the token vault.

Question 4

Which of the following activities BEST demonstrates that an organization's security controls are operating effectively, rather than merely existing?

Accepted Answer

Conducting regular control testing and reviewing exception reports

Answer

Regular testing validates that controls function as intended in practice, while exception reports reveal gaps between expected and actual control performance.

Question 5

An IS auditor discovers that an organization has not implemented log monitoring for its cloud infrastructure because management believes the cloud provider handles security. What risk does this represent?

Accepted Answer

The organization loses visibility into security events within its own cloud environment

Answer

Under the shared responsibility model, organizations are responsible for monitoring activity within their cloud environments even if the cloud provider secures the underlying infrastructure.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Protection of Information Assets 5