Access Controls ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A security team is investigating a potential data breach. The audit logs show that a user's account was used to access a large number of files in a short period, but the user claims they did not perform the access. The team suspects the account may be compromised. Which action should the team take to preserve evidence while minimizing further risk?

   • ANotify the user and ask them to change their password
   • BDisable the account and take a forensic image of the affected systems
   • CDelete the user's account and restore the affected files from backup
   • DChange the user's password and continue monitoring the account
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A financial firm is preparing for an external audit. The audit will require evidence that user access rights are reviewed periodically and that terminated employees lose access promptly. Which combination of controls should the access governance team implement?

   • AGrant all employees the same default access level and rely on the audit team to identify excessive permissions during the audit.
   • BPerform an annual manual review of all user accounts and disable accounts that have been inactive for 90 days.
   • CAutomate the account-provisioning process and schedule quarterly access reviews with sign-off by business owners.
   • DIntegrate HR systems with the identity management platform to trigger immediate account deactivation on termination, and schedule quarterly access certifications.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security auditor is reviewing the access logs of a cloud storage service. The auditor notices that a service account has read access to a sensitive bucket, but the account's last activity was over six months ago. The auditor also finds that the service account is still listed as active in the identity provider. What should the auditor recommend?

   • ADisable the service account immediately and remove its access to the bucket.
   • BRotate the service account's credentials and keep the access in place.
   • CAdd a monitoring alert for any future activity from the service account.
   • DReview the service account's purpose and owner, then disable or remove access if it is no longer needed.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In information security, what is the primary purpose of access control?

   • ATo encrypt all data stored on an organization's servers and endpoints
   • BTo monitor network traffic for signs of malicious activity
   • CTo ensure that only authorized subjects can interact with protected objects in permitted ways
   • DTo create backups of critical information assets on a regular schedule
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A multinational corporation must comply with data protection regulations that require access to personal data to be restricted based on the purpose of processing. The company has employees in different departments who need access to the same data for different purposes. For example, marketing needs access for campaign analysis, and support needs access for customer service. The access control system must enforce that employees only access data for their authorized purpose. Which access control model is best suited?

   • ARole-Based Access Control (RBAC)
   • BMandatory Access Control (MAC)
   • CDiscretionary Access Control (DAC)
   • DAttribute-Based Access Control (ABAC)
   Reveal Solution Discussion Select an answer first