Access Controls ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is investigating a potential insider threat. The team suspects that an employee has been accessing customer records outside of business hours. The employee's manager says the employee often works late, but the security team wants to confirm whether the access is legitimate. Which evidence would be most useful?

   • AThe employee's authentication logs showing successful logins during the late-night hours.
   • BA comparison of the employee's access patterns with other employees in the same role who also work late.
   • CA review of the employee's access rights and the access logs to determine whether the records accessed are within the employee's job responsibilities.
   • DThe employee's access logs showing which customer records were accessed and the employee's manager's statement that late work is common.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is preparing for a compliance audit. The auditor requires evidence that user access rights are reviewed at least quarterly and that any excessive permissions are removed. The company currently has no formal access review process. Which action should the security team take first?

   • AAsk each employee to confirm their own access rights via a self-service portal.
   • BAutomate the removal of all permissions that have not been used in the last 90 days.
   • CConduct a one-time review of all user accounts and remove any that are inactive.
   • DImplement a quarterly access review process where business owners certify the access rights of their team members.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A company is undergoing a security audit. The auditor finds that several former employees still have active accounts in the company's systems. The company has no formal process for revoking access when employees leave. Which of the following is the most effective way to address this issue?

   • AUse a single sign-on solution and rely on the identity provider to disable accounts
   • BConduct a quarterly review of all accounts and disable any that are no longer needed
   • CRequire managers to notify IT when an employee leaves, and have IT manually disable the account
   • DImplement an automated deprovisioning process that disables accounts within 24 hours of termination
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational company is deploying a new document management system. The security team must enforce that employees in the finance department can read and edit financial documents, but only during business hours and only from company-managed devices. The system supports ABAC and RBAC. The company also requires that any access attempt outside these conditions be logged and alerted. Which implementation best meets all requirements?

   • AImplement RBAC with a Finance role and require users to use a VPN to access the system.
   • BConfigure ABAC policies that evaluate the user's department, the document type, the current time, and the device compliance status, and enable audit logging for all access decisions.
   • CUse MAC with security labels on documents and user clearances.
   • DConfigure RBAC with a Finance role that grants read/edit on financial documents, and rely on the network firewall to block access outside business hours.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In network access control, what is the function of a firewall's access control rules?

   • ATo detect and block malware in real time
   • BTo authenticate users before they can access the internet
   • CTo encrypt all traffic passing through the network
   • DTo filter traffic based on criteria such as source IP, destination IP, and port
   Reveal Solution Discussion Select an answer first