CISA Logical Access Controls 3 — Questions and Answers
Question 1: An organization uses biometric authentication for physical access but relies solely on passwords for system access. From a logical access control perspective, what recommendation should an IS auditor make?
- Replace biometrics with passwords for consistency
- Implement multi-factor authentication for system access (Correct answer)
- Increase password length requirements only
- Deploy single sign-on to reduce authentication burden
Correct answer: Implement multi-factor authentication for system access
MFA adds an additional verification layer beyond passwords, significantly strengthening logical access controls.
Question 2: Which of the following is the MOST effective control to detect unauthorized privilege escalation in an operating system?
- Periodic password resets for all users
- Real-time monitoring and alerting of privilege use (Correct answer)
- Segregation of duties for system administrators
- Annual user access reviews
Correct answer: Real-time monitoring and alerting of privilege use
Real-time monitoring detects and alerts on privilege escalation events as they occur, enabling immediate response.
Question 3: A CISA candidate reviews a system where owners of data objects can grant access to other users at their discretion. This is characteristic of:
- Mandatory Access Control
- Role-Based Access Control
- Discretionary Access Control (Correct answer)
- Lattice-Based Access Control
Correct answer: Discretionary Access Control
In DAC, the data owner has discretion to grant or restrict access to their objects as they see fit.
Question 4: An auditor discovers that application developers have read access to production data. Which fundamental security principle is being violated?
- Defense in depth
- Non-repudiation
- Segregation of duties (Correct answer)
- Data integrity
Correct answer: Segregation of duties
Developers should not have access to production environments; segregation of duties prevents conflicts of interest and reduces fraud risk.
Question 5: What is the PRIMARY purpose of conducting periodic user access reviews?
- To enforce password complexity policies
- To identify and remove excessive or inappropriate access rights (Correct answer)
- To measure system performance under load
- To document all user login activity
Correct answer: To identify and remove excessive or inappropriate access rights
Access reviews ensure access rights remain appropriate as roles change, preventing accumulation of unnecessary privileges over time.
Question 6: An IS auditor finds that a system allows three consecutive failed login attempts before locking the account for only 1 minute. What is the GREATEST risk this presents?
- Legitimate users are locked out too frequently
- Automated brute-force attacks can cycle through the lockout period (Correct answer)
- Password reset requests overwhelm the help desk
- Users will write down passwords to avoid lockouts
Correct answer: Automated brute-force attacks can cycle through the lockout period
A short lockout period allows automated tools to rapidly retry passwords, effectively bypassing the account lockout control.
Question 7: Which of the following BEST supports the audit trail requirements for logical access controls?
- Storing logs on the same server as the monitored application
- Centralizing logs to a write-once, tamper-evident repository (Correct answer)
- Retaining logs for a minimum of 30 days only
- Allowing system administrators to manage their own activity logs
Correct answer: Centralizing logs to a write-once, tamper-evident repository
Centralized, tamper-evident log storage ensures log integrity and prevents administrators from covering their tracks.
CISA Logical Access Controls 3
An organization uses biometric authentication for physical access but relies solely on passwords for system access.
From a logical access control perspective, what recommendation should an IS auditor make?