CISA Domain 5A-5 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-5 (Data Loss Prevention) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-5 Data Loss Prevention Practice Test 002

10 questions • Single best answer

Question 1

An internal audit team at a pharmaceutical company is planning an audit of a newly implemented data loss prevention (DLP) program intended to protect clinical trial data. Management reports that DLP policies already cover email, endpoints, and cloud storage. What should the IS auditor do FIRST when defining the audit scope?

A. Test a sample of DLP alerts to confirm they were triaged within the defined timeframes B. Review DLP rule configurations to verify they detect clinical trial data patterns C. Obtain the data classification inventory and map where sensitive data resides D. Interview the security operations team to understand how DLP incidents are escalated

Question 2

An IS auditor at a regional bank is evaluating whether endpoint DLP controls effectively block transfers of customer account files to removable media. The security team provides the vendor's product certification and the configured policy settings. Which of the following provides the BEST evidence of control effectiveness?

A. Results of auditor-performed tests attempting to copy seeded test files to USB devices B. The vendor's independent certification attesting to the product's detection accuracy C. Screenshots of the configured endpoint policy showing that removable media blocking is enabled D. A signed management representation that the policy is enforced on all endpoints

Question 3

During a DLP audit at a university medical center, the IS auditor finds that the endpoint agent is installed on 82 percent of devices. Deployment records show that the uncovered devices are mainly research workstations used to analyze identifiable patient data. Which conclusion is MOST appropriate?

A. Coverage is acceptable because network DLP inspects outbound traffic from all endpoints B. The finding is minor because the coverage rate exceeds common industry benchmarks C. The deployment schedule should be reviewed before forming any conclusion on coverage D. The control has a significant gap because uncovered devices process high-risk data

Question 4

A logistics company's DLP solution inspects outbound email and web traffic. The IS auditor notes that TLS-encrypted traffic to personal cloud storage sites is not decrypted for inspection, and access to these sites is not restricted by the web proxy. Which recommendation is MOST appropriate for the IS auditor to make?

A. Expand DLP content signatures to include additional sensitive data identifiers B. Enable TLS inspection or block unsanctioned cloud storage at the web gateway C. Require users to acknowledge the acceptable use policy during annual training D. Increase the frequency of DLP alert reviews performed by security analysts

Question 5

An IS auditor reviewing a retail company's DLP program finds that security analysts routinely grant exceptions allowing business users to send unencrypted customer files to vendors. No business approval is documented for any of these exceptions, and none have been reviewed since they were granted. Which recommendation BEST addresses this finding?

A. Require data owners to approve and periodically review DLP policy exceptions B. Require the CISO to approve each exception before analysts implement it C. Require analysts to document a business justification for every exception D. Require internal audit to review all exceptions granted during each calendar quarter

Question 6

An IS auditor samples 40 high-severity DLP alerts at an investment firm and finds that 15 were closed as false positives without documented analysis. Analysts explain that they recognized the senders as trusted employees and saw no need for further review. What is the auditor's BEST course of action?

A. Recommend tuning DLP rules to suppress alerts generated by trusted senior employees B. Conclude that the control is effective because no data breach was reported C. Expand the sample to determine whether alert closure issues are widespread D. Report that alert disposition lacks evidence and may conceal actual data leakage

Question 7

A government agency plans to move its DLP solution from monitor-only mode to blocking mode next month. The IS auditor has been asked to provide advice on readiness before the change. Which of the following is MOST important for the auditor to recommend before blocking is enabled?

A. Purchase additional DLP licenses to cover contractor endpoints before go-live B. Validate rules against baseline alert data to exclude legitimate business flows C. Obtain written vendor confirmation that blocking mode is supported on all platforms D. Notify all employees that outbound transfers will be monitored and blocked

Question 8

An IS auditor at a manufacturing company finds that DLP content discovery scans have never been run against internal file shares, although egress monitoring of email and web traffic is active. Engineering drawings classified as confidential are stored on shares accessible to all employees, including temporary contractors. Which risk is MOST significant?

A. Egress DLP rules may generate excessive alerts whenever engineering staff email large files B. Discovery scans could degrade file server performance during business hours C. Confidential data is overexposed internally and its storage locations are unknown D. Employees may be unaware of the classification labels applied to the drawings

Question 9

Six months after reporting that a credit union's DLP policies did not cover its new cloud collaboration platform, the IS auditor performs a follow-up review. Management states that a cloud access security broker (CASB) with DLP rules has been deployed. Which action provides the BEST assurance that the risk has been addressed?

A. Testing that the CASB detects and blocks seeded sensitive files shared externally B. Reviewing the CASB purchase order and the vendor's implementation project plan C. Obtaining written confirmation from the CISO that the finding has been remediated D. Reviewing the updated DLP policy document that now explicitly references the platform

Question 10

A health insurer's security committee receives a monthly DLP report showing only total alerts generated and the number of policies deployed across channels. The IS auditor is evaluating whether this reporting supports effective oversight of data leakage risk. Which additional metric would be MOST useful to add?

A. The number of DLP rule changes implemented by the security engineering team each month B. The percentage of DLP agents running the most current software version C. The total volume of outbound email messages inspected by the DLP gateway D. The number of confirmed leakage incidents by data classification and channel

Related Posts

Leave a Comment Cancel Reply