CISA Logical Access Controls 2 — Questions and Answers
Question 1: An IS auditor reviewing a financial system finds that users can access any record regardless of their department. Which access control model is MOST appropriate to remediate this?
- Mandatory Access Control (MAC)
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Rule-Based Access Control
Correct answer: Role-Based Access Control (RBAC)
RBAC restricts access based on job roles, ensuring users only access data relevant to their department functions.
Question 2: Which of the following BEST describes the principle of least privilege in the context of logical access controls?
- Users are granted access to all resources they may ever need
- Users receive only the minimum access rights necessary to perform their job (Correct answer)
- Access rights are assigned based on user seniority
- Administrators approve all access requests before granting
Correct answer: Users receive only the minimum access rights necessary to perform their job
Least privilege limits user access to only what is essential for their specific job duties, reducing the attack surface.
Question 3: During an access review, an auditor discovers that a terminated employee's account was not disabled for 30 days. Which control failure does this PRIMARILY represent?
- Inadequate authentication controls
- Failure in access provisioning
- Weak password policy enforcement
- Inadequate access de-provisioning process (Correct answer)
Correct answer: Inadequate access de-provisioning process
Timely de-provisioning of access upon termination is a critical control; failure here creates unauthorized access risk.
Question 4: A company implements a system where a user's security clearance level must be equal to or greater than the data classification level to gain access. This BEST describes:
- Role-Based Access Control
- Discretionary Access Control
- Mandatory Access Control (Correct answer)
- Attribute-Based Access Control
Correct answer: Mandatory Access Control
MAC enforces access based on security labels and clearances, typically used in government or highly sensitive environments.
Question 5: An IS auditor is evaluating single sign-on (SSO) implementation. What is the PRIMARY risk associated with SSO?
- Increased password complexity requirements
- Single point of failure for authentication (Correct answer)
- Higher administrative overhead for access management
- Reduced user productivity due to multiple logins
Correct answer: Single point of failure for authentication
If SSO credentials are compromised, an attacker gains access to all integrated systems simultaneously.
Question 6: Which access control technique would BEST prevent a database administrator from reading sensitive payroll data while still allowing them to perform administrative functions?
- Password complexity requirements
- Data masking or column-level encryption (Correct answer)
- Two-factor authentication
- Account lockout policies
Correct answer: Data masking or column-level encryption
Data masking or column-level encryption restricts visibility of sensitive data even from privileged DBAs performing legitimate admin tasks.
Question 7: When auditing access control logs, an IS auditor should prioritize reviewing which of the following?
- Successful logins during business hours
- Failed login attempts and after-hours access by privileged users (Correct answer)
- Password change frequency across all users
- Total number of user accounts in the system
Correct answer: Failed login attempts and after-hours access by privileged users
Failed logins may indicate intrusion attempts, and after-hours privileged access is a key indicator of potential misuse or compromise.
CISA Logical Access Controls 2
An IS auditor reviewing a financial system finds that users can access any record regardless of their department.
Which access control model is MOST appropriate to remediate this?