CISA Logical Access Controls 2

Question 1

An IS auditor reviewing a financial system finds that users can access any record regardless of their department. Which access control model is MOST appropriate to remediate this?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Rule-Based Access Control

Question 2

Which of the following BEST describes the principle of least privilege in the context of logical access controls?

Accepted Answer

Users receive only the minimum access rights necessary to perform their job

Answer

Users are granted access to all resources they may ever need

Answer

Access rights are assigned based on user seniority

Answer

Administrators approve all access requests before granting

Question 3

During an access review, an auditor discovers that a terminated employee's account was not disabled for 30 days. Which control failure does this PRIMARILY represent?

Accepted Answer

Inadequate access de-provisioning process

Answer

Inadequate authentication controls

Answer

Failure in access provisioning

Answer

Weak password policy enforcement

Question 4

A company implements a system where a user's security clearance level must be equal to or greater than the data classification level to gain access. This BEST describes:

Accepted Answer

Mandatory Access Control

Answer

Role-Based Access Control

Answer

Discretionary Access Control

Answer

Attribute-Based Access Control

Question 5

An IS auditor is evaluating single sign-on (SSO) implementation. What is the PRIMARY risk associated with SSO?

Accepted Answer

Single point of failure for authentication

Answer

Increased password complexity requirements

Answer

Higher administrative overhead for access management

Answer

Reduced user productivity due to multiple logins

Question 6

Which access control technique would BEST prevent a database administrator from reading sensitive payroll data while still allowing them to perform administrative functions?

Accepted Answer

Data masking or column-level encryption

Answer

Password complexity requirements

Answer

Two-factor authentication

Answer

Account lockout policies

Question 7

When auditing access control logs, an IS auditor should prioritize reviewing which of the following?

Accepted Answer

Failed login attempts and after-hours access by privileged users

Answer

Successful logins during business hours

Answer

Password change frequency across all users

Answer

Total number of user accounts in the system