CISA Domain 5A-5 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-5 (Data Loss Prevention) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-5 Data Loss Prevention Practice Test 001

10 questions • Single best answer

Question 1

A financial services firm deploys a data loss prevention (DLP) solution to keep customer account data inside the network. Weeks later, the IS auditor learns sensitive files are still leaving through personal cloud storage services the tool does not inspect. Which recommendation is MOST appropriate?

A. Block all outbound internet access at the perimeter firewall until the review is complete. B. Require every employee to re-sign the corporate acceptable use policy this quarter. C. Raise the sensitivity threshold on the existing email content-matching rules already in place. D. Extend DLP coverage to inspect web and cloud upload channels according to data classification.

Question 2

An IS auditor is assessing whether a recently implemented DLP program is operating effectively at an insurance company. Management points to the absence of any reported data breaches since deployment as proof that the program works. Which of the following would provide the BEST evidence that the DLP controls are effective?

A. Obtaining management's written assertion that the DLP tool is configured correctly. B. Confirming the number of months that have now elapsed since deployment without any publicly reported data breach. C. Reading the vendor's documentation describing the product's data detection capabilities. D. Reviewing DLP incident logs to confirm violations were detected and blocked or remediated.

Question 3

During a review of a healthcare provider's DLP deployment, the IS auditor examines how the solution was rolled out across the environment and tests several conditions. The provider stores large volumes of patient records. Which of the following findings is MOST significant from a data protection standpoint?

A. The DLP policy documentation has not yet been reformatted to the newest template. B. The DLP agent is not installed on laptops that store patient records locally offline. C. Some low-risk marketing files are occasionally flagged by the tool as false positives. D. The DLP console produces a weekly summary report instead of a daily activity report.

Question 4

A retailer is preparing to implement an enterprise DLP solution to protect cardholder data across email, endpoints, and web traffic. The project team wants to switch on blocking rules across all channels immediately at go-live. What should the IS auditor recommend the organization do FIRST?

A. Enable blocking mode on every channel at once to stop any leakage right away. B. Purchase additional endpoint agent licenses to cover every workstation in scope. C. Identify and classify sensitive data and determine where it resides and how it flows. D. Draft disciplinary procedures for employees who repeatedly trigger DLP alerts.

Question 5

An IS auditor finds that a bank's DLP system has operated in monitor-only mode for eighteen months, generating alerts but never blocking transfers of sensitive data. Management states that analysts review the alerts every day. Which conclusion is MOST appropriate for the auditor to reach?

A. Monitor-only mode removes the risk of business disruption and is therefore the preferred setting. B. Sensitive data can still leave the environment because detection alone does not prevent exfiltration. C. The configuration is appropriate because daily alert review fully compensates for the lack of blocking. D. No residual risk remains as long as analysts document each alert that they have reviewed.

Question 6

A professional services firm has a large remote workforce that handles confidential client documents on company laptops, frequently offline or on home networks. Management relies solely on network-based DLP inspection at the corporate gateway. Which control would provide the BEST assurance against data loss in this environment?

A. Endpoint-based DLP agents that enforce policy regardless of the network the device uses. B. Additional detection signature updates applied on a regular schedule to the corporate gateway DLP appliance. C. A monthly reminder email to remote staff about the client confidentiality policy. D. Restricting corporate VPN access to standard business hours on weekdays only.

Question 7

During an audit of an engineering company, the IS auditor observes that users can send password-protected encrypted archive files as email attachments, and the DLP engine simply cannot inspect their contents. Sensitive design files have previously left the company through this exact channel. Which recommendation is MOST appropriate?

A. Configure policy to block or quarantine encrypted attachments the DLP tool cannot inspect. B. Ask users to voluntarily avoid encrypting the attachments that they send externally. C. Disable all forms of email attachment encryption for every user across the entire organization immediately. D. Accept the risk because the encryption already protects the data while in transit.

Question 8

A newly deployed DLP solution at a telecom operator is generating thousands of daily alerts, the large majority of them false positives, and overwhelmed analysts have begun ignoring the queue entirely. The organization worries real incidents are being missed. What is the auditor's BEST course of action to recommend?

A. Automatically close any alert that has remained open for longer than twenty-four hours. B. Tune detection rules and thresholds using data classification to reduce false positives. C. Route every single generated DLP alert directly to executive management for their immediate personal review. D. Switch off the DLP system until analyst headcount can be meaningfully increased.

Question 9

An IS auditor reviewing a government agency's DLP program finds strong controls over email and web egress, but employees can still freely copy classified files onto personal USB drives without any restriction. The agency handles large volumes of restricted data. Which of the following represents the MOST significant control gap?

A. The DLP dashboard does not yet display USB file-transfer statistics to the analysts in near real time. B. USB drives used by staff were not included in this year's annual hardware inventory count. C. Employees were not formally surveyed about their preference for using removable media. D. Removable media is an uncontrolled exfiltration channel that sits outside the DLP program's scope.

Question 10

An IS auditor evaluates a manufacturer's DLP program and finds that detection rules were built without any formal data classification scheme, so the tool cannot reliably distinguish sensitive information from public information. Leakage of proprietary data has occurred. Which underlying weakness should the auditor report as MOST significant?

A. The DLP vendor was selected without running a formal competitive procurement process. B. The DLP detection rules were documented in a shared team spreadsheet rather than in the enterprise GRC tool. C. The absence of a data classification program undermines the accuracy of every DLP policy. D. The DLP administrator also performs a network administration role within the same team.

Related Posts

Leave a Comment Cancel Reply