CISA Question of the Day: Encryption Key Management

Quiz Yazan Ibrahim

CISA exam practice question — CISA Question of the Day: Encryption Key Management

CISA exam practice question: daily practice for the Certified Information Systems Auditor (CISA) exam — domain: Protection of Information Assets.

Question

An IT auditor finds that a database is encrypted, but the encryption keys are stored on the same application server in plaintext within a configuration file. Which control most effectively mitigates the risk that an attacker who compromises the server can obtain the keys and decrypt the database?

  • A. Place keys in a tamper-resistant Hardware Security Module (HSM) or dedicated key management appliance with strict access controls and non-exportable keys.
  • B. Tighten administrator account restrictions and monitoring on the application server to reduce the likelihood of an attacker accessing the stored keys.
  • C. Implement a documented key-rotation schedule (for example, rotating keys every 90 days) to limit the time window for key exposure.
  • D. Encrypt the stored keys using a key-encryption-key (KEK) and keep the KEK on a backup server located offsite.
Show the answer and explanation

Correct answer: A. Place keys in a tamper-resistant Hardware Security Module (HSM) or dedicated key management appliance with strict access controls and non-exportable keys.

Storing keys in an HSM or dedicated key management appliance provides physical and logical separation of keys from data, enforces non-exportability, strong access controls, and tamper resistance — the most effective way to prevent a server compromise from yielding usable keys. Tightening administrator controls (option B) reduces risk but still leaves keys co-located with the application and vulnerable if the server is breached. Key rotation (option C) reduces exposure duration but does not prevent immediate compromise when keys are stored on the server. Encrypting keys with a KEK on an offsite backup server (option D) can help, but if the KEK is software-stored or accessible, it may still be compromised; proper KEK management can be complex and is generally less robust than an HSM that enforces key protections in hardware.

Want more practice?

Prepare for the Certified Information Systems Auditor (CISA) exam with IT Department Audit: Risk, IT Control and Governance Evaluation.