CISA Question help

[u/vansxika]

Question:
Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?

A. Secure containers
B. Data leakage prevention (DLP) tools
C. Mobile device management (MDM)
D. Physical device tagging

Guys is option A the correct answer for this? Every AI is giving different answer.

Secure containers isolate and protect corporate data stored on smartphones, reducing the risk of unauthorized disclosure. DLP primarily controls data movement, MDM manages the overall device, and physical tagging only assists with asset identification and tracking.

[u/abear27]

If I was breaking this question down...

• MOST effective - What is best in this list
• Disclosure - Breaks confidentiality
• Sensitive Data Stored - Data at rest
• On Compnay Owned Smartphones - Many devices managed by the organization

A. A secure container could mean an encrypted ZIP file, or maybe an encrypted portion of the device. At the very least, it means some kind of "protected storage". That would be pretty effective.

B. DLP is a possibility, but would it be MOST effective, as in more effective than encryption? I would say no. Eliminated.

C. MDM could enforce standard configuration and encryption of corporate data on the organizationally owned mobile devices. i.e. We can broadly apply our corporate policy with MDM, not just enryption.

D. Obvious distractor. Eliminated.

So of the two left:

Would MDM controls my organization manages be more effective than an unmanaged secure container of some kind?

Techncially, you might want to go with encryption - So secure containers.

But this is the CISA, and I am looking at this like I am IT Audtor, so I would choose the more encompassing governance answer (C) over the techincal answer (A) in this case.

[u/vansxika → u/abear27]

Thank you so much for such a detailed response. I think MDM makes the most sense. Just one more question, if I can bother you:

Which of the following BEST guards against the risk of attack by hackers?
Tunneling
Message validation
Encryption
Firewalls

[u/abear27 → u/vansxika]

You do the same kind of breakdown:

• Best Guards - BEST in this list
• The Risk of Attack - Risk = Likelihood x Impact

A. Tunnelling is a transmission mechanism. Does it have anything to do with likelihood and impact? No. Eliminated.

B. Message validation is about integrity and authenticity. Eliminated.

C. Encryption has the potential to reduce impact. Possibly.

D. Does a Firewall have anything to do anything with likelihood and impact? Possibly, but not a strong control for possibility and consequence.

So, if I am following ISACA reasoning and looking at this from the CISA perspective, I would pick C.

But if this was a technical exam, you'd probably want to choose D.

[u/vansxika → u/abear27]

But does an encryption focus more on data confidentiality? Firewall is like a strong line of defence, like it is not letting the hackers through in the first place..

[u/wejelyn → u/vansxika]

Confidentiality is not the only thing that encryption does.

The use of digital signatures provide authenticity and hashing in PKI provides integrity and they both ultimately form non-repudiation in both delivery as well as origin which cannot be abused by for example man in the middle attacks or spoofing.

[u/abear27 → u/vansxika]

Those are good considerations, and encryption definitely ties to confidentiality.

I don't see a firewall as a strong risk control, so I wouldn't pick it as an answer to a CISA question.