CISA Domain 5A-7 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-7 (Public Key Infrastructure) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-7 Public Key Infrastructure Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor is reviewing the public key infrastructure at a large online retailer that operates its own internal certificate authority. The auditor observes that the root CA is kept powered on and continuously connected to the corporate network so that it can issue subordinate CA certificates on demand whenever a business unit requests one. Which finding is MOST significant?

A. The certificate policy document has not been formally reviewed within the past twelve months by the PKI governance committee. B. The root CA is kept online and network-connected instead of being maintained offline as an air-gapped trust anchor. C. Subordinate CA certificates are issued with a validity period of two years before they are scheduled for renewal. D. OCSP responses returned to relying client applications are cached locally for up to four hours before being refreshed.

Question 2

During a security controls review at a commercial bank, the IS auditor finds that internal client applications establish TLS sessions but are configured to skip certificate revocation checking through both CRL and OCSP. Management states that revocation lists are published on schedule but are rarely consulted by the applications. Which risk is the auditor's GREATEST concern?

A. Certificate validation will consume additional network bandwidth each time a revocation data source is queried by a client. B. The certificate authority will be required to publish revocation information more frequently than it currently does today. C. End users may experience slower connection times whenever the revocation responders are temporarily unreachable on the network. D. Certificates revoked due to key compromise will continue to be accepted and trusted by the relying applications.

Question 3

An IS auditor examining a government agency's certificate authority notes that the CA's signing private keys are held in a software-based keystore on a general-purpose application server rather than in a hardware security module. The keystore file is protected only by an operating system password shared among several administrators. What is the auditor's BEST recommendation?

A. Store the CA signing keys in a FIPS-validated hardware security module that enforces protection and non-exportability. B. Increase the length and complexity of the operating system password that currently protects the software keystore file. C. Copy the keystore file to a second server so that a usable backup is available if the primary host fails. D. Rotate the CA signing keys more frequently to limit the window in which any single key could be misused.

Question 4

A post-incident review at a manufacturing firm reveals that a customer-facing service suffered a multi-hour outage because its TLS certificate expired without anyone noticing. The IS auditor learns that certificate expiry dates across the environment are tracked manually in a spreadsheet that is updated only on an ad hoc basis. Which control would MOST effectively prevent recurrence?

A. Assign a designated staff member to review the certificate tracking spreadsheet on the first business day of every month. B. Extend the validity period of all issued certificates to the maximum duration permitted by the issuing authority. C. Implement automated certificate lifecycle management that inventories certificates and generates renewal alerts before expiry. D. Require the operations team to document each expired certificate in the incident management system after it occurs.

Question 5

While auditing the registration process of an enterprise PKI at a utility company, the IS auditor finds that the registration authority issues digital certificates based solely on emailed requests from staff, without independently verifying the identity of the requesting subject before issuance. Which conclusion is MOST appropriate regarding this practice and its effect on the reliability of issued certificates?

A. The registration authority should focus on reducing certificate issuance turnaround time to improve overall user satisfaction. B. Inadequate identity proofing at registration undermines the trusted binding between a certificate and its verified subject. C. The certificate authority should issue certificates with a shorter validity period to compensate for the request method. D. The registration authority is functioning acceptably because an email provides a written record of every request received.

Question 6

An IS auditor is assessing the governance of a newly deployed PKI at an insurance company. The auditor finds that the infrastructure is fully operational and issuing certificates, but no Certificate Policy or Certification Practice Statement has been formally documented, reviewed, or approved by management. What should the auditor recommend the organization do FIRST?

A. Develop and approve a Certificate Policy and Certification Practice Statement defining issuance, usage, and management rules. B. Deploy an additional subordinate certificate authority to segregate certificate issuance across the different business units. C. Purchase publicly trusted certificates from an established external commercial authority for all internal business systems. D. Enable OCSP stapling on the web servers to improve the performance of certificate revocation status checks.

Question 7

During an audit of key management practices at a research organization, the IS auditor notes that private keys used for encryption certificates are not backed up or escrowed anywhere, while private keys used for digital signing are routinely copied to a shared recovery archive accessible to several administrators. Which finding is MOST significant?

A. Encryption private keys that lack any backup could render previously archived encrypted business data permanently unrecoverable. B. Both categories of key should be stored together in a single archive to simplify recovery and administration. C. The organization should shorten the validity period of the signing certificates to reduce their potential exposure window. D. Archiving signing private keys undermines non-repudiation by allowing parties other than the signer to access the key.

Question 8

An IS auditor reviewing endpoint configurations at a logistics company discovers that administrators added an internally generated root certificate to the trusted root store of every workstation, yet the corresponding root CA operates with no documented security controls and unrestricted administrator access. What is the auditor's PRIMARY concern regarding this arrangement?

A. Distributing the root certificate to every workstation increased the administrative effort required for future certificate updates. B. Internally generated root certificates cannot be used to secure connections to the company's external business partners. C. A poorly controlled root CA trusted by every endpoint could sign fraudulent certificates that all workstations accept. D. Workstations may display a one-time warning message the first time the internal root certificate is added to the store.

Question 9

An IS auditor wants to confirm that certificate-based authentication controls for a company's remote-access VPN operated effectively throughout the audit period, not merely that the capability exists. The auditor is deciding which item to rely upon as audit evidence. Which of the following would provide the BEST evidence of operating effectiveness?

A. System logs and configuration records showing that only valid, unexpired, non-revoked certificates were accepted during the period. B. The written PKI procedure describing how user certificates are intended to be validated at the VPN gateway. C. An email from the network administrator confirming that certificate authentication is currently enabled on the VPN. D. A vendor datasheet stating that the VPN appliance supports certificate-based authentication mechanisms for remote users.

Question 10

During an audit of a payment processor's PKI, the IS auditor finds that a number of production server certificates were signed using the SHA-1 hashing algorithm together with 1024-bit RSA keys, and management confirms these certificates remain in active use across customer-facing systems. Which finding is MOST significant?

A. The affected certificates should be reissued so they follow a consistent organizational naming convention in the subject field. B. Certificates relying on SHA-1 and 1024-bit RSA use cryptographically weak parameters vulnerable to forgery and compromise. C. The certificate authority is issuing these certificates with a validity period longer than one full calendar year. D. The certificates were installed by the operations team rather than by the dedicated information security function.

Related Posts

Leave a Comment Cancel Reply