CSIA Final Exam Version 1 — Full Practice
Exam with Answers
Section 1: Information Security
Fundamentals (1–20)
1. What is the primary goal of information security?
A. To increase computer speed B. To protect information and information systems C. To
eliminate all computer users D. To reduce the need for software
Answer: B. Information security protects information and systems against unauthorized
access, modification, disclosure, and destruction.
2. What does confidentiality mean?
A. Information is always available B. Information is never backed up C. Information is
accessible only to authorized parties D. Information can be changed by anyone
Answer: C. Confidentiality prevents unauthorized disclosure of information.
3. Which principle ensures information remains accurate and complete?
A. Integrity B. Availability C. Scalability D. Portability
Answer: A. Integrity protects information against unauthorized or improper modification.
4. What does availability mean in information security?
A. Every file is publicly accessible B. Every user has administrator privileges C. Information
cannot be encrypted D. Authorized users can access resources when needed
Answer: D. Availability ensures that authorized users can access systems and information
when required.
5. Which is an example of sensitive information?
A. A publicly available weather report B. A person's bank account credentials C. A public
company advertisement D. A published dictionary definition
Answer: B. Bank credentials can allow unauthorized access to financial accounts.
6. What is a security threat?
A. A potential cause of harm to a system or information B. A completed backup C. An
authorized software update D. A documented user instruction
,Answer: A. A threat is something capable of exploiting a weakness and causing harm.
7. What is a vulnerability?
A. A security policy B. A verified backup C. A weakness that could be exploited D. An
approved user account
Answer: C. Vulnerabilities are weaknesses in technology, configurations, processes, or
controls.
8. What is security risk?
A. The number of computers in an office B. The total amount of stored data C. The cost of
every software license D. The potential for loss or harm, considering likelihood and impact
Answer: D. Risk assessment considers how likely an event is and how serious its
consequences could be.
9. What is an information security policy?
A. A computer repair receipt B. A formal statement of security rules and expectations C. A
list of entertainment websites D. A software installation package
Answer: B. Security policies establish organizational requirements for protecting
information.
10. Which action best supports data integrity?
A. Allowing unrestricted editing B. Disabling audit logs C. Restricting changes and recording
important modifications D. Sharing administrator accounts
Answer: C. Access controls and audit trails help prevent and identify unauthorized changes.
11. What is the purpose of access control?
A. To determine who may access specific resources B. To make every file public C. To remove
all passwords D. To prevent authorized work
Answer: A. Access control limits access according to approved permissions.
12. What is authentication?
A. Deleting a user account B. Encrypting a backup drive C. Assigning a computer a name D.
Verifying a user's claimed identity
Answer: D. Authentication checks whether a person or system is who it claims to be.
13. What is authorization?
A. Confirming a person's identity B. Determining what an authenticated user is permitted to
do C. Creating a backup D. Detecting a power failure
, Answer: B. Authorization determines the actions and resources a user is allowed to access.
14. What is accountability in information security?
A. Allowing anonymous activity everywhere B. Removing all system records C. Being able to
associate actions with responsible users or systems D. Giving everyone the same password
Answer: C. Logs, individual accounts, and monitoring help establish accountability.
15. What is non-repudiation?
A. Providing evidence that helps prevent a party from credibly denying an action or
transaction B. Making information available to everyone C. Deleting all transaction records
D. Disabling digital signatures
Answer: A. Digital signatures and appropriate records can provide evidence of origin or
approval.
16. What is the purpose of a security awareness program?
A. To replace all technical controls B. To make employees system administrators C. To
prevent employees from using computers D. To teach people how to recognize and respond
to security risks
Answer: D. Awareness training helps people identify threats and follow secure procedures.
17. Which is an example of a physical security control?
A. A spam filter B. A locked server room C. An encrypted email D. A password complexity
rule
Answer: B. A locked server room restricts physical access to important equipment.
18. Which is an example of an administrative security control?
A. A firewall appliance B. A biometric scanner C. A documented access management policy
D. An encrypted hard drive
Answer: C. Administrative controls include policies, procedures, and governance
requirements.
19. What is defense in depth?
A. Using multiple complementary security controls B. Depending on one password for every
system C. Removing network monitoring D. Giving all users equal privileges
Answer: A. Multiple layers of protection reduce dependence on a single control.
20. What is the best reason to classify information?
Exam with Answers
Section 1: Information Security
Fundamentals (1–20)
1. What is the primary goal of information security?
A. To increase computer speed B. To protect information and information systems C. To
eliminate all computer users D. To reduce the need for software
Answer: B. Information security protects information and systems against unauthorized
access, modification, disclosure, and destruction.
2. What does confidentiality mean?
A. Information is always available B. Information is never backed up C. Information is
accessible only to authorized parties D. Information can be changed by anyone
Answer: C. Confidentiality prevents unauthorized disclosure of information.
3. Which principle ensures information remains accurate and complete?
A. Integrity B. Availability C. Scalability D. Portability
Answer: A. Integrity protects information against unauthorized or improper modification.
4. What does availability mean in information security?
A. Every file is publicly accessible B. Every user has administrator privileges C. Information
cannot be encrypted D. Authorized users can access resources when needed
Answer: D. Availability ensures that authorized users can access systems and information
when required.
5. Which is an example of sensitive information?
A. A publicly available weather report B. A person's bank account credentials C. A public
company advertisement D. A published dictionary definition
Answer: B. Bank credentials can allow unauthorized access to financial accounts.
6. What is a security threat?
A. A potential cause of harm to a system or information B. A completed backup C. An
authorized software update D. A documented user instruction
,Answer: A. A threat is something capable of exploiting a weakness and causing harm.
7. What is a vulnerability?
A. A security policy B. A verified backup C. A weakness that could be exploited D. An
approved user account
Answer: C. Vulnerabilities are weaknesses in technology, configurations, processes, or
controls.
8. What is security risk?
A. The number of computers in an office B. The total amount of stored data C. The cost of
every software license D. The potential for loss or harm, considering likelihood and impact
Answer: D. Risk assessment considers how likely an event is and how serious its
consequences could be.
9. What is an information security policy?
A. A computer repair receipt B. A formal statement of security rules and expectations C. A
list of entertainment websites D. A software installation package
Answer: B. Security policies establish organizational requirements for protecting
information.
10. Which action best supports data integrity?
A. Allowing unrestricted editing B. Disabling audit logs C. Restricting changes and recording
important modifications D. Sharing administrator accounts
Answer: C. Access controls and audit trails help prevent and identify unauthorized changes.
11. What is the purpose of access control?
A. To determine who may access specific resources B. To make every file public C. To remove
all passwords D. To prevent authorized work
Answer: A. Access control limits access according to approved permissions.
12. What is authentication?
A. Deleting a user account B. Encrypting a backup drive C. Assigning a computer a name D.
Verifying a user's claimed identity
Answer: D. Authentication checks whether a person or system is who it claims to be.
13. What is authorization?
A. Confirming a person's identity B. Determining what an authenticated user is permitted to
do C. Creating a backup D. Detecting a power failure
, Answer: B. Authorization determines the actions and resources a user is allowed to access.
14. What is accountability in information security?
A. Allowing anonymous activity everywhere B. Removing all system records C. Being able to
associate actions with responsible users or systems D. Giving everyone the same password
Answer: C. Logs, individual accounts, and monitoring help establish accountability.
15. What is non-repudiation?
A. Providing evidence that helps prevent a party from credibly denying an action or
transaction B. Making information available to everyone C. Deleting all transaction records
D. Disabling digital signatures
Answer: A. Digital signatures and appropriate records can provide evidence of origin or
approval.
16. What is the purpose of a security awareness program?
A. To replace all technical controls B. To make employees system administrators C. To
prevent employees from using computers D. To teach people how to recognize and respond
to security risks
Answer: D. Awareness training helps people identify threats and follow secure procedures.
17. Which is an example of a physical security control?
A. A spam filter B. A locked server room C. An encrypted email D. A password complexity
rule
Answer: B. A locked server room restricts physical access to important equipment.
18. Which is an example of an administrative security control?
A. A firewall appliance B. A biometric scanner C. A documented access management policy
D. An encrypted hard drive
Answer: C. Administrative controls include policies, procedures, and governance
requirements.
19. What is defense in depth?
A. Using multiple complementary security controls B. Depending on one password for every
system C. Removing network monitoring D. Giving all users equal privileges
Answer: A. Multiple layers of protection reduce dependence on a single control.
20. What is the best reason to classify information?
