Certified Information Systems Auditor (CISA) QAE Practice Exam

Static encryption keys pose a risk primarily because they can be easily compromised. When an encryption key remains unchanged over a long period, it increases vulnerability to various forms of attacks, such as brute force, key extraction, or cryptanalysis. If an attacker gains access to a static key, they can decrypt any data that was secured with that key, leading to unauthorized access and potential data breaches. Regularly changing encryption keys or using dynamic key management techniques can mitigate this risk by ensuring that even if a key is compromised, the exposure window is reduced, and past data remains secure.

In contrast, options regarding the frequency of key changes, the need for constant updates, or the effectiveness of encryption do not directly address the inherent risks associated with the use of static keys, making them less relevant to the context of how static encryption keys can be a security vulnerability.