CISA Logical Access Controls 3

Question 1

An organization uses biometric authentication for physical access but relies solely on passwords for system access. From a logical access control perspective, what recommendation should an IS auditor make?

Accepted Answer

Implement multi-factor authentication for system access

Answer

MFA adds an additional verification layer beyond passwords, significantly strengthening logical access controls.

Question 2

Which of the following is the MOST effective control to detect unauthorized privilege escalation in an operating system?

Accepted Answer

Real-time monitoring and alerting of privilege use

Answer

Real-time monitoring detects and alerts on privilege escalation events as they occur, enabling immediate response.

Question 3

A CISA candidate reviews a system where owners of data objects can grant access to other users at their discretion. This is characteristic of:

Accepted Answer

Discretionary Access Control

Answer

In DAC, the data owner has discretion to grant or restrict access to their objects as they see fit.

Question 4

An auditor discovers that application developers have read access to production data. Which fundamental security principle is being violated?

Accepted Answer

Segregation of duties

Answer

Developers should not have access to production environments; segregation of duties prevents conflicts of interest and reduces fraud risk.

Question 5

What is the PRIMARY purpose of conducting periodic user access reviews?

Accepted Answer

To identify and remove excessive or inappropriate access rights

Answer

Access reviews ensure access rights remain appropriate as roles change, preventing accumulation of unnecessary privileges over time.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Logical Access Controls 3