Certified Information Systems Auditor (CISA) Protection of Information Assets Syllabus

What is the difference between an IDS and an IPS, and between signature-based and anomaly-based detection?

IDS detects and alerts on suspicious activity (passive/out-of-band). IPS detects and actively blocks/prevents it (inline). Signature-based detection matches known attack patterns (low false positives, misses new attacks); anomaly/behavior-based flags deviations from a baseline (detects zero-days but more false positives).

Contrast HIDS and NIDS.

NIDS (network-based) monitors traffic across a network segment from a sensor/tap and detects network attacks. HIDS (host-based) runs on an individual host monitoring system logs, file integrity, and processes on that machine. They complement each other; HIDS sees host activity (including decrypted) that NIDS cannot.

Which common network protocols are insecure, and what are their secure replacements?

Telnet → SSH; FTP → SFTP/FTPS; HTTP → HTTPS (TLS); SNMPv1/v2 → SNMPv3; LDAP → LDAPS; POP3/IMAP → with TLS. Secure versions add encryption and/or strong authentication to protect data in transit.

What is the difference between an IPsec VPN and an SSL/TLS VPN, and IPsec's two modes?

IPsec VPN operates at the network layer (site-to-site or client), needs a client, and secures all IP traffic. SSL/TLS VPN works at the application/transport layer, often clientless via a browser, good for remote user access. IPsec modes: Transport mode (encrypts payload only) and Tunnel mode (encrypts the entire packet, used for gateways).

What controls protect endpoints and mobile devices in a BYOD environment?

Endpoint: anti-malware/EDR, host firewall, patching, disk encryption, application whitelisting. Mobile/BYOD: Mobile Device Management (MDM)/containerization to separate corporate data, remote wipe, enforced screen lock/encryption, and acceptable-use policies. Containerization isolates corporate data from personal data.

Rank the major Wi-Fi security protocols from weakest to strongest and note the key weakness of the oldest.

WEP (weakest, broken RC4/weak IV — easily cracked) < WPA (TKIP) < WPA2 (AES-CCMP) < WPA3 (strongest, SAE handshake, forward secrecy). WEP should never be used.

What is the shared responsibility model in cloud security?

Security responsibilities are split between provider and customer. The provider secures the cloud infrastructure (hardware, hosts, physical). The customer secures what they put in the cloud (data, access/identity, configurations). The split shifts by model: in IaaS the customer manages more (OS up); in SaaS the provider manages most, but the customer still owns data and access.

Compare symmetric and asymmetric encryption (speed, key handling, examples).

Symmetric: one shared secret key for encrypt/decrypt; fast, good for bulk data; challenge is secure key distribution (e.g., AES, 3DES). Asymmetric: a public/private key pair; slower, solves key distribution and enables digital signatures (e.g., RSA, ECC). Hybrid systems use asymmetric to exchange a symmetric session key.

In asymmetric cryptography, which key provides confidentiality and which provides authentication/non-repudiation?

For confidentiality, encrypt with the recipient's PUBLIC key (only their private key decrypts). For authentication/non-repudiation (digital signature), encrypt the message hash with the SENDER'S PRIVATE key (anyone can verify with the sender's public key).

How is a digital signature created and what services does it provide?

The sender hashes the message and encrypts the hash with their private key. The recipient decrypts it with the sender's public key and compares hashes. It provides integrity (hash), authentication, and non-repudiation — but NOT confidentiality (the message itself isn't encrypted by the signature).

What is a hash function and what property must it have for security?

A hash is a one-way function producing a fixed-length digest from input, used to verify integrity. It must be collision-resistant (infeasible to find two inputs with the same hash) and one-way (cannot reverse). Examples: SHA-256/SHA-3. MD5 and SHA-1 are deprecated due to collisions.

What is a Public Key Infrastructure (PKI) and the role of the CA and RA?

PKI is the framework of hardware, software, policies, and people that manages digital certificates and public-key encryption. The Certificate Authority (CA) issues, signs, and revokes certificates (binds a public key to an identity). The Registration Authority (RA) verifies identities and approves requests before the CA issues a certificate.

How are revoked certificates checked, comparing CRL and OCSP?

A CRL (Certificate Revocation List) is a periodically published list of revoked certificate serial numbers — can be large and time-lagged. OCSP (Online Certificate Status Protocol) provides real-time, on-demand status queries for a single certificate, reducing latency and overhead versus downloading a full CRL.

What does an X.509 digital certificate bind, and what does it contain?

It binds a subject's identity to their public key, vouched for by a CA's signature. Contents include: subject/owner name, the public key, issuer (CA) name, validity period (not-before/not-after), serial number, and the CA's digital signature.

What are the key stages of the cryptographic key management lifecycle?

Generation, distribution/exchange, storage, use, rotation/update, archival/escrow, and destruction (and revocation). Secure key management — especially protected storage (e.g., HSM) and timely destruction — is often the weakest link in cryptosystems.

What is key escrow, and why is split knowledge / dual control used for keys?

Key escrow stores a copy of keys with a trusted third party for recovery (e.g., lawful access or business continuity). Split knowledge/dual control divides a key (or its custody) among multiple people so no single individual can reconstruct or use it alone — reducing insider abuse (an M-of-N control).

What is Data Loss Prevention (DLP) and what are its three deployment points?

DLP detects and blocks unauthorized transmission/leakage of sensitive data based on content inspection and policy. Deployment: data in motion (network/email/web gateways), data at rest (storage/endpoints scanning), and data in use (endpoint, e.g., USB/clipboard/print controls).

Differentiate data masking, tokenization, and encryption.

Masking replaces sensitive data with realistic but fake values (often irreversible, for non-production/test). Tokenization substitutes data with a non-sensitive token mapped in a secure vault (reversible only via the vault). Encryption mathematically transforms data so it's recoverable with a key. Tokenization removes the original from scope; encryption keeps a recoverable ciphertext.

What are the main categories of physical access controls for perimeter security?

Deterrent (fences, lighting, signage, guards), preventive/access (locks, badge/card readers, biometrics, bollards, mantraps/turnstiles), detective (CCTV, motion sensors, alarms), and physical barriers. Defense in depth uses layered perimeters from the property line inward.

What is a mantrap (access control vestibule) and what attack does it prevent?

A mantrap is a small two-door vestibule where the second door won't open until the first closes and the person is authenticated, allowing only one person through at a time. It prevents piggybacking/tailgating — an unauthorized person following an authorized person through a secure door.

What environmental controls protect a data center, and what does HVAC manage?

Controls include HVAC (temperature and humidity regulation), fire detection/suppression, water/flood sensors, and power conditioning. HVAC keeps temperature and humidity in range to prevent overheating and to control humidity — too low causes static/ESD, too high causes condensation/corrosion.

Compare wet-pipe, dry-pipe, pre-action, and gas-based fire suppression for a data center.

Wet-pipe: water always in pipes (cheap, but leak/accidental-discharge risk to equipment). Dry-pipe: water held back, fills only on activation. Pre-action: requires two triggers (detector + sprinkler head) before water flows — preferred for data centers. Gas (e.g., FM-200/inert gas): suppresses fire without water damage, ideal around electronics.

What power protection devices guard against electrical anomalies, and define brownout vs blackout vs surge.

Devices: surge protectors, UPS (short-term battery + line conditioning), and generators (long-term). Brownout = prolonged low voltage (sag); Blackout = total loss of power; Surge/spike = prolonged/momentary over-voltage. A UPS bridges to generator power and conditions the line.

What controls secure a data center facility beyond the perimeter?

Restricted/zoned access with badge + biometric at sensitive areas, visitor logs and escorts, CCTV with retention, locked racks/cages, environmental monitoring, redundant power/HVAC, and siting away from hazards. Access should follow least privilege and be reviewed regularly.

List media sanitization methods and which is required for highly sensitive data.

Clearing (overwriting — reusable media), purging (degaussing magnetic media or cryptographic erase), and destruction (shredding, pulverizing, incineration). For highly sensitive data, physical destruction or degaussing is required; simply deleting files or formatting is insufficient because data remains recoverable (data remanence).

Why is degaussing ineffective on SSDs, and what should be used instead?

Degaussing erases data by disrupting magnetic fields, but SSDs store data in flash memory (no magnetic medium), so degaussing does nothing. For SSDs use the built-in secure erase / cryptographic erase or physical destruction (shredding) to ensure data is unrecoverable.

What is a SIEM and what core functions does it provide for security monitoring?

A SIEM (Security Information and Event Management) aggregates and centralizes logs/events from across the environment, then correlates them to detect threats, generates real-time alerts, and supports forensic investigation, compliance reporting, and dashboards. Correlation across sources is its key value over isolated log review.

Differentiate vulnerability scanning and penetration testing.

Vulnerability scanning is an automated, broad identification of known weaknesses (often without confirming exploitability/context). Penetration testing actively exploits vulnerabilities to demonstrate real impact and chained attacks, typically manual and goal-driven. Scanning answers 'what's weak?'; pen testing answers 'what can an attacker actually do?'

What is the difference between black-box, white-box, and gray-box penetration testing?

Black-box: tester has no prior internal knowledge (simulates an external attacker). White-box: tester has full knowledge (architecture, source, credentials) for thorough review. Gray-box: tester has partial knowledge (e.g., a standard user account), balancing realism and coverage.

What are the phases of the incident response lifecycle (NIST)?

1) Preparation; 2) Detection and Analysis; 3) Containment, Eradication, and Recovery; 4) Post-incident Activity (lessons learned). Preparation and post-incident learning drive continuous improvement; containment is prioritized to limit damage before eradication.

In digital forensics, what is the chain of custody and the order of volatility?

Chain of custody is the documented, unbroken record of who collected, handled, transferred, and stored evidence (who/what/when/where/why) to ensure admissibility and integrity. Order of volatility means collecting the most volatile evidence first (CPU registers/cache → RAM → network state → disk → archives/backups) before it is lost.

What is threat intelligence, and name common emerging attack vectors a CISA candidate should recognize.

Threat intelligence is evidence-based, actionable knowledge about current and emerging threats, actors, and TTPs used to inform defenses (strategic, tactical, operational). Emerging vectors: advanced persistent threats (APTs), ransomware, supply-chain attacks, phishing/social engineering, zero-day exploits, and IoT/cloud-targeted attacks.