A security team wants to improve their ability to detect attacks that evade signature-based detection. They have a SIEM and want to add a tool that uses behavioral analysis to identify anomalies. Which tool is most appropriate?

User and entity behavior analytics (UEBA)

Network-based intrusion detection system (NIDS) with signature updates

A security team is investigating a suspected data exfiltration. The SIEM shows large outbound data transfers from a database server to an external IP. The team wants to confirm the exfiltration and identify the data involved. Which action is most effective?

Run a vulnerability scan on the database server

Review database access logs and correlate with network logs

Block the external IP immediately

An organization's security team wants to detect and block malicious network traffic in real time. They currently have a SIEM that collects logs but does not take action. Which additional tool should they deploy to meet this requirement?

Intrusion prevention system (IPS)

An organization wants to proactively identify vulnerabilities in its internal web application before attackers exploit them. The team has a limited budget and cannot afford a full penetration test. Which approach provides the most comprehensive automated assessment of known vulnerabilities?

Deploy an intrusion detection system (IDS) in front of the application

Perform a manual code review of the application source code

Review firewall logs for past attack attempts

Run a vulnerability scanner against the application

Certified Information Systems Auditor

Domain 5Objective 5

Security Operations and Monitoring CISA Practice Questions (Page 2)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

25questions here

5free pages

3concepts

26%of the exam

Questions 6–10

6application · medium
A security team wants to improve their ability to detect attacks that evade signature-based detection. They have a SIEM and want to add a tool that uses behavioral analysis to identify anomalies. Which tool is most appropriate?
Select an answer first
7expert · hard
A security team is investigating a suspected data exfiltration. The SIEM shows large outbound data transfers from a database server to an external IP. The team wants to confirm the exfiltration and identify the data involved. Which action is most effective?
Select an answer first
8application · medium
An organization's security team wants to detect and block malicious network traffic in real time. They currently have a SIEM that collects logs but does not take action. Which additional tool should they deploy to meet this requirement?
Select an answer first
9application · medium
A user receives an email that appears to be from the company's CEO, urgently requesting a wire transfer to a new vendor. The email address is slightly different from the CEO's real address. Which type of attack is this?
Select an answer first
10application · medium
An organization wants to proactively identify vulnerabilities in its internal web application before attackers exploit them. The team has a limited budget and cannot afford a full penetration test. Which approach provides the most comprehensive automated assessment of known vulnerabilities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.