CISA Domain 5A-6 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-6 (Data Encryption) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-6 Data Encryption Practice Test 002

10 questions • Single best answer

Question 1

An external audit firm engaged by a regional credit union is reviewing transparent database encryption on its core banking platform. The auditor confirms AES-256 is enabled, but the master encryption key is stored in a configuration file on the same database server, readable by all database administrators. Which finding is MOST significant?

A. The encryption algorithm has not been reviewed against current cryptographic standards this year B. Database administrators can access both the encrypted data and the key that protects it C. The database encryption configuration was not formally approved by the change advisory board D. Encryption is applied at the database layer instead of at the individual field or column level

Question 2

A state government agency asks its internal audit function to assess whether sensitive citizen records are adequately protected by encryption across multiple systems. Management provides an encryption standard but no consolidated list of systems holding sensitive data. What should the IS auditor do FIRST when planning the engagement?

A. Run vulnerability scans to identify systems using weak or deprecated cipher suites B. Review the encryption standard for alignment with current government cryptographic guidance C. Interview system owners to confirm which applications have encryption currently enabled D. Determine how data is classified and where sensitive citizen data is stored and transmitted

Question 3

During an audit of an insurance company's customer portal, the IS auditor must assess whether data in transit is protected by strong encryption. The network team provides a configuration document stating that only TLS 1.2 and higher are permitted on all public endpoints. Which of the following is the BEST evidence that this requirement is enforced?

A. Results of an independent scan showing protocols and ciphers negotiated by each public endpoint B. A signed attestation from the network manager that legacy protocols were disabled last quarter C. Screenshots of the load balancer TLS settings provided by the network administration team D. The approved change request authorizing removal of TLS 1.0 and TLS 1.1 from production

Question 4

An IS auditor reviewing key management at a national retail chain finds that a single security administrator can generate, export, and restore the master keys protecting payment data in the hardware security module. No other individual participates in these activities. Which recommendation is MOST appropriate?

A. Require the administrator to log every key activity in a ticket for later review by IT management B. Move the master keys from the hardware security module to a cloud-based key management service C. Implement dual control and split knowledge so no single person can perform master key operations D. Increase the master key rotation frequency to reduce the time window available for potential misuse

Question 5

A cloud migration review identifies that a hospital network's new SaaS clinical platform encrypts data at rest using keys generated and held solely by the provider. A regional regulation requires the hospital to retain exclusive control over keys protecting patient records. Which recommendation should the IS auditor make?

A. Obtain the provider's SOC 2 report to confirm that its key management controls operate effectively B. Adopt a customer-managed key model in which the hospital controls key creation, access, and revocation C. Add a contract clause requiring the provider to notify the hospital of any key compromise within 24 hours D. Encrypt the hospital's network connections to the SaaS platform using a dedicated site-to-site VPN

Question 6

A post-implementation review of a payroll application finds that Social Security numbers are now protected with field-level encryption in the database, as the project required. However, the application's debug logging, enabled during go-live, writes decrypted employee records to log files on a shared application server. Which conclusion is MOST appropriate?

A. The encryption control is undermined because sensitive data persists in plaintext outside the database B. The encryption control is effective because the database meets the project's stated design requirement C. The logging issue is a performance concern that should be addressed in the next maintenance release D. The finding is low risk because the shared application server is located on the internal network only

Question 7

An audit manager at a logistics company is designing tests for a policy requiring all backup files sent to an offsite vault to be encrypted. The backup team states that encryption is enabled by default in the backup software. Which testing approach provides the MOST reliable assurance that the policy is being followed?

A. Review the backup software's vendor documentation to confirm the default encryption settings B. Inspect the backup policy to verify it specifies an approved encryption algorithm and key length C. Interview backup operators to confirm that they never change the default encryption setting D. Select a sample of vaulted backup media and verify that the data cannot be read without the key

Question 8

An IS auditor at a university finds that research datasets are encrypted inconsistently: some departments encrypt everything, while others encrypt nothing. IT staff explain that they decide what to encrypt based on their own judgment because no guidance exists. Which party should be accountable for determining the encryption requirements for each dataset?

A. The chief information officer, who oversees the technology used to implement encryption B. The IT security team, who configures and administers the encryption tools across departments C. The data owner, who classifies the data and defines protection requirements based on its value D. The internal audit function, who identifies control gaps and recommends where encryption is needed

Question 9

A financial services firm learns that an encryption algorithm used across several of its applications has been deprecated by a standards body due to newly identified weaknesses. The chief information security officer asks internal audit to evaluate whether management's response is adequate. What should the IS auditor do FIRST?

A. Determine whether management has an inventory identifying where the deprecated algorithm is used B. Recommend immediate replacement of the algorithm with a stronger alternative in all applications C. Test whether data encrypted with the deprecated algorithm can be decrypted by unauthorized parties D. Review vendor roadmaps to confirm when affected products will support stronger algorithms

Question 10

A prior audit at a pharmaceutical distributor reported that 18% of corporate laptops lacked full-disk encryption. During follow-up, management states that remediation is complete and provides a summary from the endpoint management console. Which of the following is the BEST evidence that the finding has been resolved?

A. Physical inspection of a small judgmental sample of laptops selected from the IT storage room B. Encryption status from the endpoint console reconciled against the complete hardware asset inventory C. An updated end-user computing policy requiring full-disk encryption on all corporate laptops D. A signed memo from the IT director confirming that all noncompliant laptops were encrypted or retired

Related Posts