CISA Logical Access Controls 4 — Questions and Answers
Question 1: An organization is implementing Zero Trust Architecture. Which core principle does this model rely on for logical access controls?
- Trust all internal network traffic implicitly
- Verify every access request regardless of network location (Correct answer)
- Grant broad access to reduce authentication friction
- Use perimeter firewalls as the primary access control
Correct answer: Verify every access request regardless of network location
Zero Trust operates on 'never trust, always verify,' requiring authentication and authorization for every access attempt regardless of source.
Question 2: Which type of access control list (ACL) entry represents the GREATEST security risk in a network environment?
- Deny all traffic from external IP ranges
- Permit specific ports from known source addresses
- Permit any source to any destination on all ports (Correct answer)
- Deny ICMP traffic between network segments
Correct answer: Permit any source to any destination on all ports
An 'any-to-any on all ports' rule effectively removes network access controls, exposing all systems to unrestricted traffic.
Question 3: During an audit, an IS auditor finds that privileged accounts are used for routine daily tasks by IT staff. What is the PRIMARY recommendation?
- Increase the complexity of privileged account passwords
- Implement separate standard accounts for routine tasks (Correct answer)
- Enable additional logging for privileged accounts only
- Require manager approval for each privileged account use
Correct answer: Implement separate standard accounts for routine tasks
Privileged accounts should be used only when elevated rights are needed; daily tasks should use standard accounts to reduce exposure risk.
Question 4: What does 'access recertification' mean in the context of logical access control governance?
- Issuing new credentials after a security incident
- Periodic formal review and reaffirmation of user access rights by managers (Correct answer)
- Requiring users to retake security training annually
- Resetting all passwords at a scheduled interval
Correct answer: Periodic formal review and reaffirmation of user access rights by managers
Access recertification is a formal process where managers periodically confirm that their direct reports' access rights remain appropriate.
Question 5: An IS auditor is evaluating a cloud application where multiple clients share the same infrastructure. Which logical access control is MOST critical in this environment?
- Strong password complexity requirements
- Tenant isolation to prevent cross-client data access (Correct answer)
- Regular vulnerability scanning of shared components
- Single sign-on integration with each client's identity provider
Correct answer: Tenant isolation to prevent cross-client data access
In multi-tenant environments, robust logical isolation ensures one tenant cannot access another tenant's data, even when sharing infrastructure.
Question 6: Which of the following represents a compensating control when segregation of duties cannot be fully implemented due to staffing constraints?
- Reducing the number of systems in the environment
- Enhanced monitoring and supervisory review of all transactions (Correct answer)
- Increasing user training on ethical behavior
- Implementing stronger physical access controls
Correct answer: Enhanced monitoring and supervisory review of all transactions
When full segregation of duties is infeasible, enhanced monitoring and supervisory review provides detective controls to identify misuse.
Question 7: A CISA exam question asks about the difference between identification and authentication. Which statement BEST describes authentication?
- The process of claiming a digital identity
- The process of verifying that a claimed identity is genuine (Correct answer)
- The process of granting access based on verified identity
- The process of recording user activity in an audit log
Correct answer: The process of verifying that a claimed identity is genuine
Authentication verifies the legitimacy of an identity claim through credentials such as passwords, tokens, or biometrics.
CISA Logical Access Controls 4
An organization is implementing Zero Trust Architecture.
Which core principle does this model rely on for logical access controls?