CISA Protection of Information Assets: 129 practice questions

12 of the 129 Protection of Information Assets questions in the Certsqill CISA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISA? Take the free 5-min readiness check →

1. ISO/IEC 27001: Which standard is the correct answer?

1. ISO/IEC 27001 ✓

   Correct. ISO/IEC 27001 specifies the mandatory, auditable requirements for establishing, operating, and continually improving an ISMS, and it is the standard against which organizations are certified.
2. ISO/IEC 27002

   Incorrect. ISO/IEC 27002 is a code of practice that provides implementation guidance for the controls; it is advisory and organizations are not certified against it. Candidates confuse the guidance document with the certifiable requirements document.
3. ISO/IEC 27005

   Incorrect. ISO/IEC 27005 provides guidance on information security risk management; it supports the ISMS but is not the certification basis. It is confused with 27001 because risk assessment feeds control selection.
4. NIST SP 800-53

   Incorrect. NIST SP 800-53 is a U.S. federal control catalog, not an ISO certification standard. It is a control reference, not the requirements framework an ISO/IEC 27001 certificate is issued against.

ISO/IEC 27001 contains the certifiable ISMS requirements; 27002 is only implementation guidance.

2. Detective control: In control-terminology, how is this after-the-fact activity log BEST classified?

1. Detective control ✓

   Correct. A log that captures activity for later review identifies events after they have occurred, which is the defining purpose of a detective control.
2. Preventive control

   Incorrect. A preventive control stops an unwanted event before it happens (for example, blocking the administrator action). The log does not block anything; it only records, so it cannot prevent the change.
3. Corrective control

   Incorrect. A corrective control restores a system or reverses damage after an incident (for example, rolling back an unauthorized change). Logging records the event but does not remediate it.
4. Compensating control

   Incorrect. A compensating control substitutes for a missing primary control. A routine activity log is a standard detective mechanism, not a substitute chosen because a preferred control is infeasible.

A log reviewed after the fact detects events; it neither blocks (preventive) nor fixes (corrective) them.

3. Defense-in-depth: Which security design principle does this layered approach BEST illustrate?

1. Defense-in-depth ✓

   Correct. Deploying multiple independent, overlapping controls so that no single point of failure compromises the asset is the essence of defense-in-depth.
2. Least privilege

   Incorrect. Least privilege limits each identity to the minimum access needed; it is one possible layer, not the layering principle itself. The scenario describes stacking many control types, not restricting entitlements.
3. Separation of duties

   Incorrect. Separation of duties splits a sensitive process among people to prevent one person from completing it alone. It addresses process integrity, not stacking technical control layers.
4. Fail-safe defaults

   Incorrect. Fail-safe defaults mean access is denied unless explicitly granted. That is a default-deny posture, not the practice of layering multiple independent controls.

Layering independent controls so no single failure exposes the asset is defense-in-depth.

4. Detect: Mapping this capability to the NIST Cybersecurity Framework, which core function does it PRIMARILY sup

1. Detect ✓

   Correct. Continuous monitoring, anomaly analysis, and alerting on potential events are exactly the outcomes the Detect function is designed to deliver.
2. Protect

   Incorrect. Protect covers safeguards that limit or contain an event's impact, such as access control and hardening. Monitoring does not safeguard; it observes, so its primary alignment is Detect. Candidates confuse deploying security technology with protection generally.
3. Respond

   Incorrect. Respond covers the actions taken after detection, such as containment and communication. Raising an alert triggers Respond activities but is itself the detection step.
4. Identify

   Incorrect. Identify develops organizational understanding of assets, risk, and governance. It precedes and informs control deployment but does not describe real-time anomaly monitoring.

Continuous monitoring and alerting map to the Detect function, not Protect or Respond.

5. Compensating controls: How are these substitute measures BEST described?

1. Compensating controls ✓

   Correct. When a preferred primary control (MFA) cannot be implemented, alternative measures that reduce the same risk to an acceptable level are compensating controls.
2. Primary preventive controls

   Incorrect. A primary preventive control would be the intended control itself (MFA). These measures exist precisely because the primary control is infeasible, which makes them compensating rather than primary.
3. Corrective controls

   Incorrect. Corrective controls restore state after an incident. Segmentation, a jump host, and logging aim to reduce likelihood and improve visibility beforehand, not to remediate after an event.
4. Redundant controls

   Incorrect. Redundant controls duplicate an existing working control for resilience. Here there is no working MFA to duplicate; the measures substitute for a missing control, which is the definition of compensating.

Alternative measures adopted because the intended control is infeasible are compensating controls.

6. Corrective control: Considering the RE-IMAGING step specifically, which control type does it represent?

1. Corrective control ✓

   Correct. Re-imaging from a known-good baseline restores the system to a trusted state after an incident, which is the defining action of a corrective control.
2. Detective control

   Incorrect. The detective control is the behavioral flagging that discovers the malware. Re-imaging occurs after detection and repairs the system, so it is corrective, not detective.
3. Preventive control

   Incorrect. A preventive control would stop the infection from occurring (for example, application allow-listing). Re-imaging happens only after the machine is already compromised.
4. Deterrent control

   Incorrect. A deterrent discourages an actor from attempting an attack (for example, warning banners). Re-imaging neither discourages nor prevents; it restores a compromised system.

Restoring a compromised system from a clean baseline is a corrective control; the flagging step is the detective one.

7. The exclusions lack documented risk-based justification: What should be the auditor's PRIMARY concern?

1. The exclusions lack documented risk-based justification traceable to the risk assessment ✓

   Correct. Every inclusion or exclusion in a Statement of Applicability must be justified against the risk assessment; without that traceability, the auditor cannot conclude the exclusions are appropriate rather than gaps.
2. The Statement of Applicability should list every one of the Annex A controls as applicable and forbid marking any single control as out of scope for a certified ISMS

   Incorrect. Controls may legitimately be excluded when justified; a blanket rule that all must apply misstates how risk-based control selection works. The real issue is missing justification, not the existence of exclusions.
3. The company did not adopt a different framework such as NIST SP 800-53

   Incorrect. The choice of framework is a management decision; auditing an ISMS built on ISO/IEC 27001 does not require a different catalog. This distracts from the actual documentation gap.
4. The Statement of Applicability was not signed by the external certification body

   Incorrect. The Statement of Applicability is owned and approved by the organization's management, not signed off by the certification body. This confuses internal ownership with external certification.

Excluding controls is acceptable only with documented, risk-based justification; the missing rationale is the primary concern.

8. Place the historian in an isolated network zone: Which control approach BEST satisfies ALL three constraints?

1. Place the historian in an isolated network zone with agentless, network-based monitoring and out-of-band access logging at the segment boundary ✓

   Correct. Agentless network monitoring respects the no-agent constraint, isolation and boundary logging provide demonstrable monitoring of all access without touching the host, and none of it requires frequent patching downtime, satisfying all three constraints at once.
2. Deploy a host-based endpoint detection agent configured for continuous monitoring and weekly automatic patching

   Incorrect. This violates constraint 2 (no third-party agents) and constraint 1 (patching only quarterly). It satisfies the monitoring requirement but breaks two of the three constraints, so it cannot be the best answer.
3. Rely on the historian's built-in local logs, reviewed quarterly, with no network changes

   Incorrect. Local-only logs reviewed quarterly do not provide demonstrable monitoring of all access and offer no independent boundary evidence, failing constraint 3. Self-reported host logs are also weaker evidence than independent monitoring.
4. Require monthly maintenance windows to patch the historian and add a management-approved risk acceptance for the missing agent

   Incorrect. Monthly patching conflicts with the quarterly availability constraint, and a risk acceptance does not deliver the required monitoring capability. Accepting risk is not a substitute for a control the regulator mandates.

Isolation plus agentless network monitoring and boundary logging meets no-agent, limited-patching, and full-monitoring constraints together.

9. To ensure only one authenticated person enters at a time: What is the PRIMARY purpose of this arrangement?

1. To ensure only one authenticated person enters at a time and prevent an unauthorized person from following behind ✓

   Correct. A mantrap (access control vestibule) is designed to admit a single authenticated individual per cycle, which directly counters tailgating and piggybacking.
2. To contain a fire that starts inside the vestibule and stop smoke and flames from spreading through the interlocking doors onto the main data floor where the servers operate

   Incorrect. Fire containment is achieved with fire-rated barriers and suppression, not an interlocking access vestibule. This confuses a physical access control with a life-safety control.
3. To regulate temperature and humidity as air passes between the two doors

   Incorrect. Environmental regulation is handled by HVAC and monitoring systems. The interlocking doors control people, not air conditions.
4. To protect equipment from electrical surges entering the facility

   Incorrect. Surge protection is provided by electrical protective devices and UPS systems, which have nothing to do with a personnel access vestibule.

A mantrap admits one authenticated person per cycle, defeating tailgating and piggybacking.

10. To detect environmental conditions that could damage: What is the PRIMARY purpose of these sensors?

1. To detect environmental conditions that could damage equipment so staff can respond before harm occurs ✓

   Correct. Environmental monitoring detects out-of-range temperature and humidity that threaten hardware reliability, enabling a timely response before damage or outages.
2. To authenticate personnel entering the server halls

   Incorrect. Authentication is performed by access control systems such as badges and biometrics. Temperature and humidity sensors measure conditions, not identities.
3. To encrypt data stored on the servers in the halls

   Incorrect. Encryption is a logical control implemented in software or storage hardware. Environmental sensors have no role in protecting data confidentiality.
4. To suppress fires automatically by discharging a gaseous clean agent throughout the server hall the moment rising temperature and airborne smoke are simultaneously detected

   Incorrect. Fire suppression is triggered by dedicated smoke and heat detection and suppression systems. General temperature and humidity monitoring is about equipment operating conditions, not fire response.

Environmental sensors detect damaging temperature and humidity so staff can act before equipment is harmed.

11. Tailgating: Which term BEST describes this behavior?

1. Tailgating ✓

   Correct. Following an authorized person through a controlled door without presenting one's own credentials is tailgating (also called piggybacking).
2. Shoulder surfing

   Incorrect. Shoulder surfing is observing someone's screen or keypad to steal information such as a PIN. It involves visual eavesdropping, not physically following through a door.
3. Phishing

   Incorrect. Phishing is a social-engineering attack conducted through deceptive messages to obtain credentials or data. It is a logical, not physical, entry technique.
4. Spoofing

   Incorrect. Spoofing is falsifying an identity or address, typically in network or communications contexts. It does not describe physically trailing a person through a door.

Following an authorized person through a controlled door without badging is tailgating.

12. Reconfigure the sensors into defined detection zones: Which action should the IS auditor MOST strongly recomme

1. Reconfigure the sensors into defined detection zones with tuned sensitivity and schedules that account for authorized activity, so genuine intrusions still alarm ✓

   Correct. Zoning and sensitivity tuning that distinguishes authorized activity from real intrusions eliminates nuisance alarms while preserving detection, directly curing the alarm fatigue without creating a coverage gap.
2. Disable the motion sensors during HVAC operation and cleaning hours

   Incorrect. Disabling sensors removes detection during the very windows when an intruder could exploit the gap. It trades a nuisance problem for a real coverage hole, which is worse.
3. Add more security guards to keep up with the volume of alarms

   Incorrect. Adding staff to process a flood of false positives treats the symptom, not the cause. The root problem is untuned detection, and fatigue will persist even with more guards.
4. Replace the motion sensors entirely with additional CCTV cameras and have guards periodically review the recorded footage to spot any intruders after they have already entered

   Incorrect. Cameras alone are passive detective evidence that still require someone to watch or review them; they do not actively alarm on intrusion and do not solve the underlying tuning problem.

Zone and tune the sensors to ignore authorized activity while still alarming on real intrusions, curing alarm fatigue without a coverage gap.

Other CISA domains

• Information Systems Operations and Business Resilience — 129 questions →
• Information Systems Auditing Process — 89 questions →
• Governance and Management of IT — 89 questions →
• Information Systems Acquisition, Development and Implementation — 60 questions →
• All 496 CISA questions →