CISA - Protection of Information Assets (26% of the exam) - Section 5.1

Evaluate network and end-point security, data loss prevention, data encryption and public key infrastructure.

Describe network security and endpoint security controls - including firewalls, intrusion detection and endpoint protection - alongside data loss prevention techniques. Evaluate data encryption and public key infrastructure (PKI) implementations to confirm that data in transit and at rest is protected to an appropriate standard.

network securityendpoint securitydata loss preventionencryptionpublic key infrastructure

Practice question for this objective

Free sampleProtection of Information Assetshard

An IS auditor is evaluating endpoint controls on a fleet of corporate laptops that store regulated client data. The chief information security officer states that full-disk encryption is enabled on every device. From an audit perspective, what does full-disk encryption PRIMARILY protect against?

AUnauthorised reading of files by a malicious process running under a logged-on user that already has access to the mounted volume
BDisclosure of data on a laptop that is lost or stolen while the device is powered off and the encryption key is not resident in memory Correct
CExfiltration of structured data over the network by an authenticated user who copies records into a webmail attachment from the running endpoint
DTampering with operating system binaries by malware that elevates privileges on the running endpoint after a successful phishing attack

Recognise that full-disk encryption protects data at rest on a powered-off endpoint and does not address threats against a running, unlocked session. Full-disk encryption binds plaintext access to possession of an unlock credential at boot time. Once the volume is mounted, the operating system presents cleartext to any authorised process, so the control is effective only when the device is powered off or in a pre-boot state. Lost or stolen device scenarios are the canonical use case. Live session threats, network exfiltration and runtime tampering require complementary controls such as data loss prevention, endpoint detection and response and secure boot.

Why A is wrong: Once a legitimate user has unlocked the volume, the operating system serves cleartext to authorised processes, so a malicious process running with that user's rights sees the same data as the user; full-disk encryption is transparent to the live session and does not address this.

Why B is correct: Full-disk encryption renders the sectors on the storage medium unreadable without the key, which is unlocked at boot using a credential, so a powered-off lost or stolen device cannot be read by an attacker who removes the disk or boots from external media.

Why C is wrong: Network exfiltration by an authenticated user is the domain of data loss prevention controls and egress filtering; full-disk encryption operates on the storage layer and provides no inspection of outbound content from a running, unlocked endpoint.

Why D is wrong: Integrity of running binaries is addressed by secure boot, application allow-listing and endpoint detection and response; full-disk encryption preserves confidentiality of at-rest data and does not measure or prevent in-memory tampering.

See more CISA practice questions, answers explained.

Exam traps in Protection of Information Assets

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISA bank for this domain.

Network data loss prevention sensors deployed in-line at the internet egress point with secure web gateway integration for transport layer security inspection
Why it is wrong: An in-line network sensor can block egress through the inspected channel, but it sees nothing when the laptop is offline or when the user writes to a Universal Serial Bus drive locally, so the offline removable media path in the stem is not covered.
The control was operating effectively because the hardware security module enforces dual authentication on every key operation regardless of who is physically present in the ceremony room at the time.
Why it is wrong: Hardware enforcement of dual authentication does not substitute for the dual-control procedure documented in the certificate policy; the ceremony evidence shows the procedural control was not operating, irrespective of the device's technical capability.
Periodic distribution of a certificate revocation list signed by the issuing certification authority and cached by relying parties
Why it is wrong: A certificate revocation list does communicate revoked serial numbers, but it is published on a fixed schedule and cached, so a relying party may accept a recently revoked certificate until the next list refresh, which fails the near real time requirement in the stem.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.