CISA Protection of Information Assets practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

CISA Protection of Information Assets: 754 practice questions

CISA 754 questions 12 shown free

12 of the 754 Protection of Information Assets questions in the Certsqill CISA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISA? Take the free 5-min readiness check →

1. A risk-based mapping linking business requirements: Which evidence provides the strongest assurance of framewo

Hard
A regional bank claims alignment with a security framework. Auditors find a completed compliance checklist, a risk register, mapped controls, and business-impact ratings. Interviews show several checklist controls lack documented risk rationale. Which evidence provides the strongest assurance of framework application?
  1. The framework certificate displayed by management.
    A certificate alone does not establish applicable controls or local implementation.
  2. A risk-based mapping linking business requirements, risks, and implemented controls. ✓
    This evidence demonstrates framework use connected to organizational requirements and risk.
  3. A consultant’s presentation describing common framework practices used by comparable banks.
    General practices do not prove this bank’s control selection or implementation.
  4. The completed checklist.
    A checklist may confirm review activity without demonstrating risk-based control alignment.
The trap
Relies on symbolic certification. Substitutes industry commentary for bank evidence. Treats compliance enumeration as assurance.

Risk-based mapping demonstrates framework application better than checklists or general assurances.

2. Backup cooling lacks tested outage capability: Which gap is most consequential?

Easy
A healthcare network reviews physical and environmental safeguards for its communications room. Access logs are reviewed, cameras function, and temperature alarms are installed. However, the backup cooling system has never been tested under load, and an outage could disrupt patient connectivity. Which gap is most consequential?
  1. Camera footage retention is shorter than management prefers.
    Retention concerns are less consequential than untested environmental continuity capability.
  2. Temperature alarms use manual rather than automated escalation.
    Escalation matters, but cooling failure remains the greater availability risk.
  3. The room lacks a visitor sign-in sheet.
    Visitor records matter, but untested cooling threatens sustained equipment availability.
  4. Backup cooling lacks tested outage capability. ✓
    Untested cooling leaves critical connectivity exposed despite installed environmental alarms.
The trap
Prioritizes documentation over resilience. Focuses on notification method alone. Overstates surveillance retention impact.

Untested backup cooling creates the greatest demonstrated availability risk for connectivity.

3. Test terminated-user access removal: What should the auditor do next?

Medium
For a public agency, the auditor has completed an access-policy review and sampled manager approvals for new accounts. The sample showed approvals existed, but the audit has not tested whether access was removed after employee departures. What should the auditor do next?
  1. Test terminated-user access removal. ✓
    Departure testing addresses a material identity-control risk not covered by approvals.
  2. Recommend multifactor authentication immediately.
    MFA may reduce compromise but does not test excessive lingering access.
  3. Ask management to accept the untested termination risk.
    The auditor should obtain relevant evidence before recommending risk acceptance.
  4. Conclude access controls are effective based on sampled approvals.
    New-account approvals cannot establish timely removal after termination.
The trap
Jumps to a different control. Prematurely transfers unresolved audit work. Generalizes incomplete evidence.

Testing termination removal addresses the unexamined access risk after approvals were sampled.

4. Recommend risk-based remediation of segmentation: What is the auditor’s best response?

Hard
An energy supplier’s network review found flat administrative segments, several unmanaged endpoints, and firewall rules reviewed annually. Management proposes documenting the risks and reviewing firewall rules every quarter, without segmentation or endpoint remediation. What is the auditor’s best response?
  1. Accept management’s proposal because quarterly reviews improve firewall oversight.
    More frequent review does not remove flat-network paths or unmanaged endpoints.
  2. Require management to deploy an intrusion-prevention system before further evaluation.
    Detection or blocking technology does not substitute for prioritized foundational remediation.
  3. Report the issue as resolved after management documents the accepted residual risk.
    Documentation does not resolve control weaknesses or transfer auditor evaluation responsibilities.
  4. Recommend risk-based remediation of segmentation and endpoint coverage. ✓
    The response should address attack paths and unmanaged endpoint exposure, not documentation alone.
The trap
Prescribes one tool without risk analysis. Mistakes risk documentation for remediation. Confuses review frequency with risk reduction.

Management’s proposal leaves major attack paths and unmanaged endpoints inadequately addressed.

5. Report ineffective coverage because exceptions: What should the auditor conclude first?

Hard
During a telecommunications DLP audit, management says the control is effective. Testing found policy coverage for email and endpoints, three unreviewed exceptions, and encrypted transfers that prevented content inspection. What should the auditor conclude first?
  1. Accept effectiveness because email and endpoint policies are deployed.
    Deployment evidence does not demonstrate complete coverage or exception governance.
  2. Conclude the provider failed because DLP cannot inspect encrypted content.
    The evidence supports a control limitation, not necessarily provider failure.
  3. Recommend replacing encryption so every transfer becomes inspectable.
    Encryption may protect information; replacement is not justified by these results.
  4. Report ineffective coverage because exceptions and encrypted transfers remain unvalidated. ✓
    Testing directly identified unvalidated exceptions and inspection gaps affecting DLP coverage.
The trap
Assigns unsupported responsibility from limited evidence. Treats confidentiality protection as inherently defective. Confuses implementation with operating effectiveness.

Unvalidated exceptions and encrypted transfers prevent concluding DLP operates effectively.

6. The design is adequate: What is the best conclusion?

Medium
A research organization’s encryption design requires protected data at rest and in transit, with centralized key management. The auditor found approved algorithms and documented key ownership, but sampled backups used expired keys and lacked rotation evidence. What is the best conclusion?
  1. The design is adequate, but operating effectiveness is not demonstrated. ✓
    Documented design exists, while expired keys and missing evidence indicate operation gaps.
  2. The organization should accept the risk because algorithms remain approved.
    Approved algorithms do not compensate for expired keys or absent rotation evidence.
  3. Encryption is ineffective because centralized key management is prohibited.
    Centralized management can support encryption when appropriately controlled.
  4. The auditor should redesign the organization’s encryption architecture.
    Auditors recommend remediation; management owns architecture decisions.
The trap
Crosses from evaluation into implementation. Rejects a valid design without evidence. Confuses technical design with ongoing operation.

Design evidence exists, but backup key failures undermine operating effectiveness.

7. Require management to protect keys and enable revocation: What recommendation is most appropriate?

Hard
A distribution center uses certificates for warehouse handhelds. Audit testing found certificates issued by an approved authority, but private keys were exportable, revocation checks were disabled, and management had not assigned remediation ownership. What recommendation is most appropriate?
  1. Require management to protect keys and enable revocation validation. ✓
    These actions address key protection and certificate validity weaknesses directly.
  2. Have the auditor operate revocation services until controls mature.
    Auditors recommend improvements and do not operate management controls.
  3. Accept certificates because an approved authority issued them.
    Certificate issuance alone does not establish secure private-key handling.
  4. Replace every certificate with a longer validity period.
    Longer validity increases exposure and does not fix key compromise risks.
The trap
Overvalues trusted issuance evidence. Assigns implementation responsibility to the auditor. Treats validity duration as the main weakness.

PKI assurance requires protected private keys and working revocation validation.

8. Evaluate the operator’s assigned tenant controls: What should the auditor do?

Easy
A transport operator hosts scheduling systems in a public cloud. The provider’s assurance report covers physical facilities and hypervisor controls, while the contract assigns identity configuration, tenant logging, and workload patching to the operator. What should the auditor do?
  1. Rely entirely on the provider assurance report.
    The report excludes tenant identity, logging, and patching responsibilities.
  2. Require the provider to assume all tenant configuration responsibilities.
    Contractual responsibility currently assigns those controls to the operator.
  3. Conclude cloud hosting is inherently unsuitable for scheduling.
    The evidence identifies responsibility boundaries, not inherent unsuitability.
  4. Evaluate the operator’s assigned tenant controls separately. ✓
    Provider assurance does not cover responsibilities assigned to the tenant.
The trap
Confuses provider assurance with complete coverage. Ignores the documented shared-responsibility model. Draws an unsupported technology conclusion.

The operator must test controls remaining within its documented cloud responsibility.

9. Client management: Who decides remediation priority?

Hard
An outsourced provider manages mobile scanners and connected sensors for a distribution client. Contracts assign service operation to the provider, while the client retains risk acceptance, security requirements, and approval of exceptions. A sensor fleet lacks segmentation and recent updates. Who decides remediation priority?
  1. The auditor, because testing identified the sensor exposure.
    The auditor evaluates evidence and recommends action; management prioritizes risk.
  2. The provider and auditor jointly, without client approval or risk acceptance.
    Neither provider nor auditor can replace client authority over retained risk.
  3. Client management, informed by provider evidence and business impact. ✓
    The client retains risk decisions while provider evidence informs prioritization.
  4. The provider, because it operates the platforms.
    Operational responsibility does not transfer the client’s retained risk authority.
The trap
Confuses operation with risk ownership. Transfers management accountability to audit. Excludes the client’s retained decision rights.

Client management prioritizes remediation using provider evidence and business risk.

10. Prioritize role-specific simulations and reporting: Which priority best fits the evidence and constraints?

Hard
After a merger, a company has two awareness programs. One tracks attendance; the other uses role-specific simulations and measures reporting behavior. Incident data shows acquired staff rarely report suspicious messages, while existing staff report them consistently. Which priority best fits the evidence and constraints?
  1. Merge attendance records into one enterprise dashboard.
    A consolidated dashboard does not address the demonstrated reporting behavior gap.
  2. Prioritize role-specific simulations and reporting practice for acquired staff. ✓
    This directly targets the measured behavior weakness in the higher-risk group.
  3. Stop awareness activities until the merged company completes one unified policy.
    Delaying training leaves an evidenced reporting weakness unaddressed.
  4. Repeat annual training for all employees using identical content.
    Uniform repetition ignores role-specific evidence and the affected population.
The trap
Postpones mitigation despite current risk. Uses broad activity instead of targeted improvement. Improves administration rather than risk reduction.

Behavioral evidence supports targeted simulations for acquired staff reporting weakness.

11. Document a controlled exception with ownership: What is the best audit recommendation?

Medium
A regional bank allows a legacy payment server to retain an unsupported service because replacement would disrupt settlement. It is isolated from user networks, monitored continuously, and access is restricted to two administrators. What is the best audit recommendation?
  1. Recommend replacement before further settlement processing.
    Replacement may be appropriate, but timing lacks feasibility evidence.
  2. Require immediate removal despite settlement disruption.
    Immediate removal ignores stated business impact and available safeguards.
  3. Document a controlled exception with ownership and replacement. ✓
    A governed exception balances exposure, safeguards, accountability, and planned remediation.
  4. Accept continued operation because isolation prevents compromise.
    Isolation reduces exposure but does not eliminate unsupported-service risk.
The trap
Uses inflexible action without risk comparison. Overstates urgency beyond supplied facts. Treats one safeguard as complete risk treatment.

A controlled exception needs ownership, safeguards, and planned remediation.

12. No, because excluded segmentation and privileged access: Is that conclusion supported?

Medium
A healthcare network’s assessor performed an authorized penetration test against internet-facing systems and found no exploitable findings. Internal segmentation and privileged access were excluded by the rules of engagement. Management concludes the network has no security weaknesses. Is that conclusion supported?
  1. No, because penetration tests can never support security conclusions.
    Authorized tests support bounded conclusions when scope is understood.
  2. Yes, provided the assessor used current vulnerability signatures.
    Tool currency cannot overcome explicit testing scope limitations.
  3. Yes, because penetration testing validates security under authorized conditions.
    The test validates selected exploitation, not excluded internal control areas.
  4. No, because excluded segmentation and privileged access remain unassessed. ✓
    Scope exclusions prevent extending the conclusion to those internal weaknesses.
The trap
Rejects useful evidence entirely. Treats tooling as broader assurance. Overgeneralizes a limited test result.

Excluded internal areas prevent a network-wide conclusion from the test.

742 more Protection of Information Assets questions

The remaining 742 questions in this domain are part of the full CISA bank — 2900 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your CISA readiness — free

Other CISA domains

Part of the Certsqill CISA question bank · Protection of Information Assets · Every answer, right and wrong, comes with its own explanation.