CISA Protection of Information Assets Practice Questions
Protection of Information Assets makes up 13 of every 50 questions on a Tigertest CISA practice test. Here are 10 of the 52 questions on it, each with the answer and the reason.
Updated by the Tigertest team. Based on ISACA's CISA job practice areas (effective August 2024). Original questions; 50 per test, weighted like the real exam. Not affiliated with ISACA.
1. What is the best test of whether leavers' system access is removed?
- A.Count the accounts created this year
- B.Match HR leaver lists to active accounts
- C.Ask IT whether it removes access promptly
- D.Read the access management policy
Answer: B. Comparing people who left with accounts still enabled gives direct evidence. Inquiry or reading the policy shows only what should happen.
2. Managers approve every user in each access review without a single change, year after year. What should the IS auditor suspect?
- A.The review tool runs too slowly
- B.Users hold too few permissions
- C.Access is managed without fault
- D.The reviews are rubber-stamped
Answer: D. In a changing workforce some access should be removed each cycle. Reviews with no changes suggest reviewers are not checking, so the auditor tests a sample of approvals.
3. Administrators share an emergency 'firecall' account on critical servers. Which control gives the best accountability?
- A.Vault checkout with a logged reason
- B.A rule that only seniors use it
- C.A password changed once a year
- D.A list kept of everyone who knows the password
Answer: A. A privileged access vault releases the password to one named person at a time, records why and when, and can rotate it after use, so each use is traceable.
4. New network switches are being installed. What should the IS auditor check first?
- A.The switches are the newest model
- B.Spare switches are kept in stock
- C.Default passwords have been changed
- D.The switches came from one supplier
Answer: C. Vendor default credentials are published and widely known, so leaving them in place gives anyone an easy way in.
5. What is the most important control when enrolling staff in a biometric access system?
- A.Enrolling everyone on the same day
- B.Letting staff enroll themselves
- C.Verifying identity before enrollment
- D.Using the reader with the lowest error rate
Answer: C. A biometric only proves the person matches the template. If the wrong person is enrolled under a name, every later match is wrong too.
6. Accounts lock after a few failed login attempts. Which attack does this mainly slow down?
- A.Online password guessing
- B.Theft of password hashes
- C.Session cookie hijacking
- D.Phishing for credentials
Answer: A. Lockout limits how many guesses an attacker can make against a live login. It does nothing against stolen hashes cracked offline or credentials handed over to a phishing page.
7. An IS auditor wants to find users who can both create vendors and approve payments in an ERP system. What is the best approach?
- A.Review last year's audit report
- B.Interview a few finance managers
- C.Read the job descriptions held on file
- D.Run a rule-based conflict analysis
Answer: D. Analysing all users' actual permissions against a matrix of incompatible duties finds every conflict, not just the ones people remember.
8. Badge records show who entered the data center. How should they be used as a control?
- A.Share them with all staff each month
- B.Compare entries with the authorized list
- C.Keep them unread unless there is a theft
- D.Delete them at the end of each week
Answer: B. Regular review of entries against those with approved access finds badge sharing, unauthorized entry and access that should be removed.
9. A server room's cooling failed overnight and equipment overheated before anyone noticed. Which control was missing?
- A.A sign asking staff to shut the door
- B.Temperature alarms to on-call staff
- C.A larger cooling unit in the room
- D.A weekly check of the thermostat
Answer: B. Environmental sensors that alert someone at any hour let staff act before damage occurs. A bigger unit can still fail, and weekly checks would not catch an overnight fault.
10. Where are water detectors most useful in a data center with a raised floor?
- A.In the reception area
- B.On each server's front panel
- C.On the ceiling tiles
- D.Under the raised floor
Answer: D. Leaks from cooling pipes or water ingress collect unseen under the floor, near cables and power, so sensors there give early warning.
Practice all 52 protection of information assets questions, and the rest of the 200-question bank, in the free CISA training sets. Questions you miss come back until you have mastered them.
Start practicingFree to start. No account needed.