CISA Logical Access Controls 5

Question 1

An IS auditor is reviewing a healthcare organization's EHR system. Which logical access control would BEST address the HIPAA minimum necessary standard?

Accepted Answer

Implementing context-based access that limits record visibility to treating clinicians

Answer

Context-based access ensures clinicians only see records for patients under their direct care, aligning with HIPAA's minimum necessary requirement.

Question 2

During a review of an application's authentication mechanism, an IS auditor finds session tokens that never expire. What is the PRIMARY risk?

Accepted Answer

Captured session tokens can be reused indefinitely by attackers

Answer

Non-expiring session tokens allow session hijacking attacks to persist indefinitely, granting long-term unauthorized access.

Question 3

Which of the following BEST describes an access control matrix?

Accepted Answer

A table defining what operations each subject can perform on each object

Answer

An access control matrix is a formal model that maps subjects (users/processes) to objects (resources) and their permitted operations.

Question 4

An organization uses OAuth 2.0 for API access delegation. Which security concern should an IS auditor PRIMARILY evaluate?

Accepted Answer

Scope limitations on access tokens and token revocation capabilities

Answer

Overly broad token scopes and lack of revocation mechanisms are primary OAuth security risks that can lead to excessive API access.

Question 5

An IS auditor finds that a legacy system cannot enforce password complexity requirements. What is the MOST appropriate recommendation?

Accepted Answer

Implement compensating controls such as additional authentication factors

Answer

When a system cannot enforce a technical control, compensating controls such as MFA or enhanced monitoring should be implemented to offset the risk.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Logical Access Controls 5