CISA - Certified Information Systems Auditor Logical Access Controls Questions and Answers — Questions and Answers
Question 1: An IS auditor discovers that a shared administrator account is used by several network engineers to manage critical infrastructure. Which of the following is the GREATEST risk associated with this practice?
- Increased likelihood of password compromise due to social engineering.
- Complexity in managing access when an engineer changes roles.
- Inability to trace specific actions to an individual engineer. (Correct answer)
- Violation of the principle of 'need-to-know'.
Correct answer: Inability to trace specific actions to an individual engineer.
The primary risk of using shared accounts is the loss of accountability. If a malicious or erroneous action occurs, it is impossible to determine which specific individual performed the action because the audit logs will only show the shared account name.
Question 2: An organization wants to implement a logical access model where permissions are assigned to groups based on job functions, rather than to individual users. Which of the following access control models BEST meets this requirement?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Attribute-Based Access Control (ABAC)
- Role-Based Access Control (RBAC) (Correct answer)
Correct answer: Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is specifically designed to assign permissions to roles that correspond to business functions. Users are then assigned to these roles, which simplifies access management, enforces the principle of least privilege, and improves scalability.
Question 3: During a review of identity and access management, an IS auditor notes that the organization has not performed a user access review for over a year, despite significant employee turnover and role changes. The PRIMARY risk this creates is:
- inefficient onboarding of new employees.
- the accumulation of excessive access rights, known as privilege creep. (Correct answer)
- noncompliance with software licensing agreements.
- increased help desk costs for password resets.
Correct answer: the accumulation of excessive access rights, known as privilege creep.
Failure to conduct regular user access reviews leads to 'privilege creep,' where users accumulate access rights beyond what is required for their current job function. This increases the risk of unauthorized access and data breaches, as former employees may retain access or current employees may have excessive privileges.
Question 4: Which of the following is the PRIMARY security benefit of implementing a Single Sign-On (SSO) solution across an organization?
- It improves the user experience by eliminating the need for multiple logins.
- It reduces the attack surface by decreasing the number of stored credentials. (Correct answer)
- It centralizes the administration of user accounts.
- It transfers the risk of authentication to a third-party vendor.
Correct answer: It reduces the attack surface by decreasing the number of stored credentials.
The primary security benefit of SSO is that it reduces the attack surface. By centralizing authentication, it minimizes the number of places where passwords are stored and entered, which in turn reduces the risk of password theft, reuse, and leakage.
Question 5: An IS auditor is evaluating controls over privileged accounts in a large enterprise. Which of the following is the MOST effective control for mitigating the risks associated with administrator access?
- Implementing a Privileged Access Management (PAM) solution with session monitoring. (Correct answer)
- Enforcing a complex password policy for all administrator accounts.
- Conducting annual background checks on all system administrators.
- Requiring all administrators to sign a nondisclosure agreement (NDA).
Correct answer: Implementing a Privileged Access Management (PAM) solution with session monitoring.
A Privileged Access Management (PAM) solution is the most effective and comprehensive control. It provides a centralized mechanism to vault credentials, enforce least privilege, implement just-in-time access, and, most importantly, monitor and record privileged sessions, which creates strong accountability and detectability.
Question 6: A financial institution is designing the logical access controls for its new online banking platform. To provide strong assurance of user identity, which of the following should be the MINIMUM requirement for customer authentication?
- A complex password that changes every 90 days.
- A user ID combined with a security question.
- Biometric authentication, such as a fingerprint scan.
- Multi-factor authentication (MFA). (Correct answer)
Correct answer: Multi-factor authentication (MFA).
Multi-factor authentication (MFA) is the industry standard and best practice for providing strong authentication. It requires users to present two or more different types of credentials (e.g., something they know, something they have, something they are), making it significantly harder for unauthorized users to gain access even if one factor is compromised.
CISA - Certified Information Systems Auditor Logical Access Controls Questions and Answers
An IS auditor discovers that a shared administrator account is used by several network engineers to manage critical infrastructure.
Which of the following is the GREATEST risk associated with this practice?