CISA Domain 5A-6 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-6 (Data Encryption) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-6 Data Encryption Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a hospital's electronic health record system, the IS auditor confirms that patient data is encrypted at rest using AES-256. However, the encryption keys are stored in a plaintext configuration file on the same server that hosts the database. Which finding is MOST significant?

A. AES-256 may be computationally expensive given the large volume of patient records processed daily. B. The encryption keys are stored in plaintext on the same server as the data they protect. C. The organization has not documented a formal key rotation schedule for the system. D. System users are unaware that patient data is encrypted while it is at rest.

Question 2

An IS auditor is assessing whether customer data transmitted between an e-commerce web application and its payment gateway is adequately protected against interception and protocol downgrade attacks. The auditor has not yet reviewed how the channel is currently secured in the production environment. What should the auditor do FIRST?

A. Review the TLS configuration and supported cipher suites on the relevant servers. B. Recommend that the organization immediately adopt end-to-end encryption for all traffic. C. Interview the development team about how the application manages user sessions. D. Test whether the payment gateway enforces multifactor authentication at login.

Question 3

A government agency must exchange large volumes of classified data with an external partner. It wants to encrypt the transfers efficiently while ensuring that only the intended partner can decrypt the information at the receiving end. Which approach provides the BEST balance of performance and secure key exchange?

A. Encrypt the entire dataset directly using the partner's public asymmetric key. B. Share one symmetric key with the partner by email at the start of each week. C. Encrypt the data with a symmetric key and exchange that key using the partner's public key. D. Hash the data with SHA-256 before transmitting the files to the partner.

Question 4

An IS auditor reviewing a bank's cryptographic key management program finds that keys are generated and distributed properly, but there is no defined procedure for revoking, replacing, or retiring keys that are suspected of being compromised, and staff could not describe any such process. Which recommendation is MOST appropriate?

A. Establish a documented key lifecycle process that includes revocation and rekeying procedures. B. Increase the symmetric key length used to protect stored data from 128 bits to 256 bits. C. Require all customers and staff to change their account passwords each quarter. D. Store an additional copy of every cryptographic key in an offline location.

Question 5

During a review of an application's authentication module, the IS auditor notes that user passwords are stored using reversible encryption so that help desk staff can retrieve and read them when users call the help desk for assistance with lockouts. Which conclusion is MOST appropriate?

A. The encryption algorithm protecting the passwords should be upgraded to a longer key length. B. Help desk staff should be trained to reset rather than retrieve the stored passwords. C. The practice is acceptable because the passwords remain encrypted while they are stored. D. Passwords should be protected with salted one-way hashing rather than reversible encryption.

Question 6

A payment processor stores the master keys used to encrypt cardholder data across its environment. The IS auditor wants assurance that these keys cannot be extracted or misused by any single administrator acting alone or without oversight. Which control provides the BEST assurance that the keys remain protected?

A. Generating and storing the master keys within a hardware security module under dual control. B. Encrypting the key file and restricting access to members of the administrator group. C. Backing up the master keys to an encrypted network share on a nightly basis. D. Requiring every administrator to sign an acceptable use policy each year.

Question 7

An organization encrypts all employee laptops with full-disk encryption to protect data if a device is lost or stolen. The IS auditor is evaluating whether this control also protects sensitive files once they are copied by users to shared network folders. Which statement is MOST accurate regarding the coverage of this control?

A. Full-disk encryption ensures the files stay encrypted after they are copied to network shares. B. Full-disk encryption protects data at rest on the device but not data copied elsewhere or in transit. C. Full-disk encryption removes the need for separate access controls on the laptops. D. Full-disk encryption protects against malware running under the logged-in user session.

Question 8

During an audit of a manufacturing company's legacy systems, the IS auditor identifies an application that still relies on the DES algorithm to encrypt sensitive engineering designs. Management states the application works reliably and has never failed. Which finding should the auditor consider MOST significant?

A. DES encryption noticeably slows down processing on the company's modern server hardware. B. The application vendor no longer offers telephone-based technical support or product updates. C. DES uses a 56-bit key that is now considered cryptographically weak and breakable. D. Employees using the application have not been formally trained on how DES works.

Question 9

As part of a third-party assurance review, an IS auditor wants to verify that a cloud service provider actually rotates its database encryption keys in line with the annual schedule stated in its security policy. Which of the following would provide the BEST evidence that rotation has occurred?

A. Key management system logs showing dated key generation and retirement events. B. The provider's written security policy stating that encryption keys are rotated every year. C. An interview in which the provider's security manager confirms that rotation occurs. D. A vendor marketing brochure describing the provider's overall encryption architecture.

Question 10

A business continuity audit reveals that nightly backup tapes containing customer financial records are shipped to an offsite facility without encryption. A third-party transport vendor has sole physical custody of the tapes throughout the journey between the two sites. Which recommendation is MOST appropriate to protect the data?

A. Require the transport vendor to sign a confidentiality agreement covering handling of the backup tapes. B. Increase the frequency of the offsite backup shipments to reduce data in transit. C. Store the backup tapes inside a fireproof and tamper-evident container during transport. D. Encrypt the backup data before the tapes leave the facility, managing the keys separately.

Related Posts

Leave a Comment Cancel Reply