CISA Logical Access Controls 2

Question 1

An IS auditor reviewing a financial system finds that users can access any record regardless of their department. Which access control model is MOST appropriate to remediate this?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

RBAC restricts access based on job roles, ensuring users only access data relevant to their department functions.

Question 2

Which of the following BEST describes the principle of least privilege in the context of logical access controls?

Accepted Answer

Users receive only the minimum access rights necessary to perform their job

Answer

Least privilege limits user access to only what is essential for their specific job duties, reducing the attack surface.

Question 3

During an access review, an auditor discovers that a terminated employee's account was not disabled for 30 days. Which control failure does this PRIMARILY represent?

Accepted Answer

Inadequate access de-provisioning process

Answer

Timely de-provisioning of access upon termination is a critical control; failure here creates unauthorized access risk.

Question 4

A company implements a system where a user's security clearance level must be equal to or greater than the data classification level to gain access. This BEST describes:

Accepted Answer

Mandatory Access Control

Answer

MAC enforces access based on security labels and clearances, typically used in government or highly sensitive environments.

Question 5

An IS auditor is evaluating single sign-on (SSO) implementation. What is the PRIMARY risk associated with SSO?

Accepted Answer

Single point of failure for authentication

Answer

If SSO credentials are compromised, an attacker gains access to all integrated systems simultaneously.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Logical Access Controls 2