2/26/25, 2:09 PM CISA Domain 5: Protection of Information Assets Comprehensive Questions and Answers Flashcards | Quizlet
CISA Domain 5: Protection of Information Assets
Comprehensive Questions and Answers
Save
Terms in this set (343)
Which of the following a. Incident response plan
specifically addresses how
to detect cyberattacks cyber attack is an incident
against an organization's IT
systems and how to
recover from an attack?
a. An incident response
plan
b. An IT contingency plan
c. A business continuity
plan
d. A continuity of
operations plan
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 1/43
,2/26/25, 2:09 PM CISA Domain 5: Protection of Information Assets Comprehensive Questions and Answers Flashcards | Quizlet
An IS auditor reviewing b. identify the network access points.
access controls for a
client-server environment A client-server environment typically contains several
should FIRST: access points and uses distributed techniques,
increasing the risk of unauthorized access to data and
a. evaluate the encryption processing. To evaluate the security of the client
technique. server environment, all network access points should
b. identify the network be identified.
access points. '
c. review the identity ex; think about cyberark and jump host multiple ways
management system. to access server
d. review the application
level access controls.
An organization is d. Implement Wi-Fi Protected Access 2.
planning to replace its
wired networks with This implements most of the requirements of the IEEE
wireless networks. Which 802.11i standard. The Advanced Encryption Standard
of the following would used in WPA2 provides better security. Also, WPA2
BEST secure the wireless supports both the Extensible Authentication Protocol
network from and the pre-shared secret key authentication model.
unauthorized access?
a. Implement Wired
Equivalent Privacy.
b. Permit access to only
authorized media access
control addresses.
c. Disable open broadcast
of service set identifiers.
d. Implement Wi-Fi
Protected Access 2.
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 2/43
,2/26/25, 2:09 PM CISA Domain 5: Protection of Information Assets Comprehensive Questions and Answers Flashcards | Quizlet
Which of the following is b. Assignment of criticality levels to data
the responsibility of
information asset owners? think about the data owner question - they know the
most about the information so they know what's most
a. Implementation of critical
information security within
applications
b. Assignment of criticality
levels to data
c. Implementation of
access rules to data and
programs
d. Provision of physical
and logical security for
data
b. signer to have a private key and the receiver to
have a public key.
Digital signatures require
the:
When a signer electronically signs a document, the
signature is created using the signer's private key,
a. signer to have a public
which is always securely kept by the signer (think of
key and the receiver to
like fingerprint everyone's is different/unique to them)
have a private key.
b. signer to have a private
As an example, Jane signs an agreement to sell a
key and the receiver to
timeshare using her private key. The buyer receives
have a public key.
the document. The buyer who receives the document
c. signer and receiver to
also receives a copy of Jane's public key. If the public
have a public key.
key can't decrypt the signature (via the cipher from
d. signer and receiver to
which the keys were created), it means the signature
have a private key.
isn't Jane's, or has been changed since it was signed.
The signature is then considered invalid.
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 3/43
, 2/26/25, 2:09 PM CISA Domain 5: Protection of Information Assets Comprehensive Questions and Answers Flashcards | Quizlet
Confidentiality of d. session key with the receiver's public key.
transmitted data can best
be delivered by This will ensure that the session key can only be
encrypting the: obtained using the receiver's private key, retained by
the receiver.
a. message digest with the
sender's private key.
b. session key with the
sender's public key.
c. messages with the
receiver's private key.
d. session key with the
receiver's public key.
a single-use symmetric key used for encrypting all
messages in one communication session
it's a temporary key that is only used once, during one
stretch of time, for encrypting and decrypting data;
session key
future conversations between the two parties would
be encrypted with different session keys.
like a password that has to be reset each time they log
in
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 4/43
CISA Domain 5: Protection of Information Assets
Comprehensive Questions and Answers
Save
Terms in this set (343)
Which of the following a. Incident response plan
specifically addresses how
to detect cyberattacks cyber attack is an incident
against an organization's IT
systems and how to
recover from an attack?
a. An incident response
plan
b. An IT contingency plan
c. A business continuity
plan
d. A continuity of
operations plan
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 1/43
,2/26/25, 2:09 PM CISA Domain 5: Protection of Information Assets Comprehensive Questions and Answers Flashcards | Quizlet
An IS auditor reviewing b. identify the network access points.
access controls for a
client-server environment A client-server environment typically contains several
should FIRST: access points and uses distributed techniques,
increasing the risk of unauthorized access to data and
a. evaluate the encryption processing. To evaluate the security of the client
technique. server environment, all network access points should
b. identify the network be identified.
access points. '
c. review the identity ex; think about cyberark and jump host multiple ways
management system. to access server
d. review the application
level access controls.
An organization is d. Implement Wi-Fi Protected Access 2.
planning to replace its
wired networks with This implements most of the requirements of the IEEE
wireless networks. Which 802.11i standard. The Advanced Encryption Standard
of the following would used in WPA2 provides better security. Also, WPA2
BEST secure the wireless supports both the Extensible Authentication Protocol
network from and the pre-shared secret key authentication model.
unauthorized access?
a. Implement Wired
Equivalent Privacy.
b. Permit access to only
authorized media access
control addresses.
c. Disable open broadcast
of service set identifiers.
d. Implement Wi-Fi
Protected Access 2.
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 2/43
,2/26/25, 2:09 PM CISA Domain 5: Protection of Information Assets Comprehensive Questions and Answers Flashcards | Quizlet
Which of the following is b. Assignment of criticality levels to data
the responsibility of
information asset owners? think about the data owner question - they know the
most about the information so they know what's most
a. Implementation of critical
information security within
applications
b. Assignment of criticality
levels to data
c. Implementation of
access rules to data and
programs
d. Provision of physical
and logical security for
data
b. signer to have a private key and the receiver to
have a public key.
Digital signatures require
the:
When a signer electronically signs a document, the
signature is created using the signer's private key,
a. signer to have a public
which is always securely kept by the signer (think of
key and the receiver to
like fingerprint everyone's is different/unique to them)
have a private key.
b. signer to have a private
As an example, Jane signs an agreement to sell a
key and the receiver to
timeshare using her private key. The buyer receives
have a public key.
the document. The buyer who receives the document
c. signer and receiver to
also receives a copy of Jane's public key. If the public
have a public key.
key can't decrypt the signature (via the cipher from
d. signer and receiver to
which the keys were created), it means the signature
have a private key.
isn't Jane's, or has been changed since it was signed.
The signature is then considered invalid.
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 3/43
, 2/26/25, 2:09 PM CISA Domain 5: Protection of Information Assets Comprehensive Questions and Answers Flashcards | Quizlet
Confidentiality of d. session key with the receiver's public key.
transmitted data can best
be delivered by This will ensure that the session key can only be
encrypting the: obtained using the receiver's private key, retained by
the receiver.
a. message digest with the
sender's private key.
b. session key with the
sender's public key.
c. messages with the
receiver's private key.
d. session key with the
receiver's public key.
a single-use symmetric key used for encrypting all
messages in one communication session
it's a temporary key that is only used once, during one
stretch of time, for encrypting and decrypting data;
session key
future conversations between the two parties would
be encrypted with different session keys.
like a password that has to be reset each time they log
in
https://quizlet.com/1011073188/cisa-domain-5-protection-of-information-assets-comprehensive-questions-and-answers-flash-cards/?new 4/43
