CISA Domain 5A-7 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-7 (Public Key Infrastructure) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-7 Public Key Infrastructure Practice Test 002

10 questions • Single best answer

Question 1

A pharmaceutical distributor is rolling out an electronic purchase-order platform where customers approve orders using digital signatures. During pre-implementation testing, an IS auditor confirms that each signature is created with the customer's private key. Which additional control is MOST important for supporting non-repudiation of approved orders?

A. Encrypting each purchase order with the distributor's public key before transmission B. Ensuring private signing keys are generated and held only by the individual customers C. Requiring customers to change their platform login passwords every ninety days D. Logging the IP address of each customer session that submits an approval

Question 2

An IS auditor reviewing a technology firm's remote-access architecture finds that the VPN gateway authenticates users with client certificates issued by the internal CA. Configuration review shows that certificate revocation checking through CRL or OCSP was disabled to resolve latency complaints last year. Which risk is MOST significant?

A. Users may experience connection failures when certificates near their expiration dates B. The internal CA may issue certificates with weaker key lengths than policy requires C. Certificate renewal requests may not be routed to the correct registration authority D. Certificates of terminated staff or lost devices will still be accepted for access

Question 3

During an audit of a software publisher's release process, an IS auditor discovers that the private key used to sign customer software updates is stored as a password-protected file on the build server. Several developers have administrative access to that server. Which recommendation is MOST appropriate?

A. Move the code-signing key into a hardware security module with controlled signing access B. Strengthen the password protecting the signing key file and rotate it on a quarterly basis C. Restrict developer administrative rights on the build server to business hours only D. Replace the code-signing certificate annually with one from a different public CA

Question 4

An IS auditor at an online travel agency finds that a single wildcard certificate secures the production booking site, customer portals, and several development servers maintained by an offshore contractor. The same private key is deployed on all of these servers. Which finding is MOST significant?

A. The wildcard certificate costs more than individual certificates for each host B. The certificate is renewed manually by staff rather than through an automated process C. Compromise of a weakly controlled server exposes the key protecting production sites D. The certificate's subject name does not list each individual server explicitly

Question 5

An IS auditor reviewing a bank's PKI key management procedures finds that the IT security team maintains escrowed copies of employees' private keys used for both email encryption and digitally signing loan approvals. Management explains that escrow supports data recovery. Which conclusion is MOST appropriate?

A. Escrow of all private keys is appropriate because it supports business continuity needs B. Escrowing signing keys undermines non-repudiation and should be limited to encryption keys C. Escrow is acceptable provided all escrowed keys are encrypted at rest by the security team D. Escrow should be discontinued for all keys because it violates encryption best practice

Question 6

A healthcare network's certification practice statement requires that every server certificate request be approved by two authorized registration officers before issuance. An IS auditor is testing whether this issuance control operated effectively throughout the twelve-month audit period. Which of the following is the BEST evidence?

A. Signed attestations from registration officers confirming they followed the procedure B. The certification practice statement approved by the PKI governance committee C. A sample of CA issuance records traced to two distinct authorized approvals D. A walkthrough observing a registration officer process a single new request

Question 7

During an audit of a state agency's two-tier PKI, an IS auditor finds that the root CA server is joined to the production domain, remains powered on, and is patched through the standard enterprise process. The root CA's certificate is trusted by all agency systems. Which recommendation is MOST appropriate?

A. Take the root CA offline and use it only to sign subordinate CA certificates B. Increase the root CA's patching frequency to weekly during maintenance windows C. Deploy endpoint detection software on the root CA server to monitor for threats D. Shorten the validity period of the root CA certificate to twelve months

Question 8

An energy company's security team informs the IS auditor that the private key of its issuing CA may have been exposed when a backup tape was lost in transit. The tape was unencrypted, and the issuing CA signs certificates used for operational technology authentication. Which action should management take FIRST?

A. Notify all certificate holders to change the passwords on their accounts B. Increase monitoring of authentication logs across all operational technology systems C. Engage a forensic firm to determine whether the tape has been accessed D. Revoke the issuing CA certificate and publish the revocation to relying parties

Question 9

An IS auditor at a logistics provider compares the PKI team's certificate inventory with results of a network discovery scan. The scan identifies 600 certificates in use, of which 240 are not recorded in the inventory, including certificates from public CAs purchased by business units. Which conclusion is MOST appropriate?

A. The inventory is acceptable because publicly issued certificates are managed by the issuing CAs B. The discovery scan likely overstated results and should be repeated before concluding C. Certificate life cycle management is ineffective because ownership and expiry are unknown D. The variance is a minor documentation issue that management can update at year end

Question 10

A retail bank exchanges payment files with a partner using mutually authenticated TLS. An IS auditor finds that the bank's gateway accepts any client certificate chaining to a major public CA, without checking the certificate's subject or fingerprint against the partner's identity. Which recommendation is MOST appropriate?

A. Restrict acceptance to the partner's specific certificate subject or pinned fingerprint B. Require the partner to obtain a new certificate with a longer key length from the same CA C. Replace mutual TLS with a shared secret key distributed to the partner by courier D. Ask the public CA to provide an annual attestation over its issuance controls

Related Posts