Which approach BEST protects encryption keys used for highly sensitive data?

Generating and storing keys in an HSM with strict access and dual control

Management states that endpoint DLP agents are installed on all company laptops. Which audit procedure provides the MOST reliable evidence to support this claim?

Reconcile the laptop inventory against active agents reporting to the DLP console

Which technique BEST identifies users whose access has grown well beyond that of colleagues in the same role?

Peer group analysis of each user's entitlements against others in the same role

When should new employees FIRST receive information security awareness training?

During onboarding, before or as they receive access to information systems

The organization outsources security monitoring to a managed service provider. An IS auditor finds the contract has no requirement for how quickly the provider must report confirmed incidents. What should the auditor recommend?

Amend the contract to set incident notification timeframes and escalation contacts

Which control BEST mitigates the risk of business email compromise leading to fraudulent payments?

Verifying payment change requests through an independent channel

Customers must be able to verify the organization's signed software installers for years after the code-signing certificate expires. Which control BEST supports this?

Applying a trusted timestamp to each signature at the time of signing

A seized smartphone may be remotely wiped by its owner. What should investigators do FIRST?

Isolate it from networks, for example in a shielded enclosure, preserving its state

Free CISA Domain 5 Practice Questions with Answers

2026-10-19

These five CISA Domain 5 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 5, Protection of Information Assets, is 26% of the CISA exam.

Question 1: Security Incident Response Management

Which activity BEST prepares the organization to respond to incidents involving its cloud services?

A. Relying on the provider's incident response for all incidents
B. Defining cloud-specific playbooks, log access and provider contacts in advance
C. Using the existing on-premises playbooks unchanged
D. Purchasing a cloud security posture management tool

Answer: B. Cloud incidents need specific procedures, access and coordination arrangements.

Exam mindset: Prepare for where your systems actually run.

Question 2: Security Testing Tools and Techniques

Management reports that all critical penetration test findings have been fixed. What should happen next?

A. Management sign-off accepting any remaining risk from the findings
B. A retest to verify the vulnerabilities have been fixed
C. Run a new full test of different systems only
D. Close the findings based on management's written remediation report

Answer: B. Retesting confirms that fixes are effective and did not introduce new issues.

Exam mindset: Verify the fix.

Question 3: Information Asset Security Frameworks, Standards, and Guidelines

Under ISO/IEC 27001, which activity must the organization perform at planned intervals to check that its ISMS conforms and is effectively implemented?

A. Customer satisfaction surveys
B. Continuous vulnerability scanning
C. Annual external penetration tests
D. Internal audits of the ISMS

Answer: D. ISO/IEC 27001 requires internal audits at planned intervals, followed by management review.

Exam mindset: The ISMS must check itself.

Question 4: Data Encryption

A code review shows that the encryption key protecting stored customer records is hard-coded in the application source code. What is the GREATEST risk?

A. Anyone with the code can decrypt the data, and rotating the key needs a redeployment
B. The source code will be harder to maintain over time as the application evolves
C. The application may run more slowly due to repeated loading of the key from code
D. Developers may forget which encryption algorithm and mode the application uses for records

Answer: A. Source code is widely shared across developers, repositories and backups, so the key is effectively exposed. Hard-coding also prevents timely rotation if the key is compromised.

Exam mindset: A key is only as secret as where it is stored.

Question 5: Physical and Environmental Controls

The emergency power-off switch in the data center is mounted beside the exit door without a cover or label. What is the MOST significant risk?

A. The switch may violate the building's interior design and signage standards
B. Unauthorized visitors may use the exit door to leave the data center unnoticed
C. The switch may fail to operate when needed during a real emergency
D. Accidental activation could shut down all equipment in the data center

Answer: D. An unprotected switch next to a frequently used door can easily be pressed by mistake, cutting power to every system. Protective covers and clear labeling reduce this risk while keeping the switch accessible in emergencies.

Exam mindset: Safety controls must not create availability risks.

Keep practising

The quiz below draws more questions from every CISA Domain 5 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.