CISA Logical Access Controls 5 — Questions and Answers
Question 1: An IS auditor is reviewing a healthcare organization's EHR system. Which logical access control would BEST address the HIPAA minimum necessary standard?
- Requiring strong passwords for all clinical staff
- Implementing context-based access that limits record visibility to treating clinicians (Correct answer)
- Enabling full audit logging of all record accesses
- Using VPN for all remote access to patient records
Correct answer: Implementing context-based access that limits record visibility to treating clinicians
Context-based access ensures clinicians only see records for patients under their direct care, aligning with HIPAA's minimum necessary requirement.
Question 2: During a review of an application's authentication mechanism, an IS auditor finds session tokens that never expire. What is the PRIMARY risk?
- Users must re-authenticate too frequently, reducing productivity
- Captured session tokens can be reused indefinitely by attackers (Correct answer)
- System performance degrades as sessions accumulate
- Password policies cannot be enforced without session expiration
Correct answer: Captured session tokens can be reused indefinitely by attackers
Non-expiring session tokens allow session hijacking attacks to persist indefinitely, granting long-term unauthorized access.
Question 3: Which of the following BEST describes an access control matrix?
- A biometric template database mapping users to physical characteristics
- A table defining what operations each subject can perform on each object (Correct answer)
- A network diagram showing firewall rules between zones
- A risk register mapping threats to corresponding controls
Correct answer: A table defining what operations each subject can perform on each object
An access control matrix is a formal model that maps subjects (users/processes) to objects (resources) and their permitted operations.
Question 4: An organization uses OAuth 2.0 for API access delegation. Which security concern should an IS auditor PRIMARILY evaluate?
- Whether OAuth uses symmetric or asymmetric encryption
- Scope limitations on access tokens and token revocation capabilities (Correct answer)
- The geographic location of the authorization server
- Whether users understand the OAuth authorization flow
Correct answer: Scope limitations on access tokens and token revocation capabilities
Overly broad token scopes and lack of revocation mechanisms are primary OAuth security risks that can lead to excessive API access.
Question 5: An IS auditor finds that a legacy system cannot enforce password complexity requirements. What is the MOST appropriate recommendation?
- Immediately decommission the legacy system
- Implement compensating controls such as additional authentication factors (Correct answer)
- Accept the risk as unavoidable for legacy systems
- Manually enforce password policies through HR policies only
Correct answer: Implement compensating controls such as additional authentication factors
When a system cannot enforce a technical control, compensating controls such as MFA or enhanced monitoring should be implemented to offset the risk.
Question 6: Which logical access control approach would BEST prevent an insider from exfiltrating bulk customer records from a database?
- Requiring VPN access for all database connections
- Implementing query result row-count limits and data loss prevention controls (Correct answer)
- Enforcing complex passwords for database accounts
- Requiring dual approval for all database schema changes
Correct answer: Implementing query result row-count limits and data loss prevention controls
Row-count limits on query results and DLP controls detect and restrict bulk data extraction, targeting the exfiltration method directly.
Question 7: An IS auditor is assessing a federated identity management system. Which of the following represents the GREATEST advantage from a logical access control perspective?
- Elimination of the need for any authentication mechanisms
- Centralized identity governance across multiple organizations without sharing credentials (Correct answer)
- Automatic granting of administrative rights across federated systems
- Removal of the need for access recertification processes
Correct answer: Centralized identity governance across multiple organizations without sharing credentials
Federated identity allows users to authenticate once with a trusted provider while accessing resources across organizations without transmitting actual credentials.
CISA Logical Access Controls 5
An IS auditor is reviewing a healthcare organization's EHR system.
Which logical access control would BEST address the HIPAA minimum necessary standard?