A company has a high rate of employee turnover. The security team is struggling to ensure that access rights are revoked promptly when employees leave. The HR system is not integrated with the identity management platform, and manual revocation often takes weeks. The company also needs to pass an audit that requires evidence of timely revocation. Which approach should the security team prioritize?

Schedule quarterly access reviews and revoke access for any account that has been inactive for 30 days.

Implement a manual process where managers must email the IT service desk to request access revocation.

Integrate the HR system with the identity management platform to automate account deactivation on termination, and establish a monthly audit of deactivated accounts.

Require all employees to change their passwords every 60 days, assuming that terminated employees will not know the new password.

A company is deploying a new application that uses a microservices architecture. Each microservice needs to access a shared database, but only specific microservices should be able to read or write certain tables. The security team wants to enforce this at the database level. Which approach is most appropriate?

Encrypt the database and give the decryption key only to authorized microservices.

Use a database firewall to filter queries based on the source IP of the microservice.

Create a database user for each microservice and grant table-level permissions based on the microservice's role.

Use a single database user for all microservices and rely on the application to enforce access control.

A financial services firm is preparing for an external audit. The auditor requires evidence that user access rights are reviewed regularly and that terminated employees' accounts are disabled promptly. The firm currently has no formal process for these activities. Which combination of actions should the firm implement to satisfy the auditor's requirement?

Conduct quarterly access reviews and automate account deprovisioning upon termination

Implement single sign-on and require users to change passwords every 90 days

Enable multi-factor authentication and log all access attempts

Perform annual access reviews and rely on managers to report terminations manually

Why is it important to regularly review user access rights?

To verify that users are using strong passwords

To identify and remove excessive or outdated permissions that may pose a security risk

To increase the number of users with administrative rights

To ensure that all users have the same level of access

What is the main purpose of auditing access logs?

To detect unauthorized access attempts and ensure accountability

To authenticate users during login

To encrypt data stored on the system

EC-CouncilAssociate C|CISO

Domain 4Objective 1

Access Controls ACCISO Practice Questions (Page 7)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

Questions 31–35

31expert · hard
A company has a high rate of employee turnover. The security team is struggling to ensure that access rights are revoked promptly when employees leave. The HR system is not integrated with the identity management platform, and manual revocation often takes weeks. The company also needs to pass an audit that requires evidence of timely revocation. Which approach should the security team prioritize?
Select an answer first
32expert · hard
A company is deploying a new application that uses a microservices architecture. Each microservice needs to access a shared database, but only specific microservices should be able to read or write certain tables. The security team wants to enforce this at the database level. Which approach is most appropriate?
Select an answer first
33application · medium
A financial services firm is preparing for an external audit. The auditor requires evidence that user access rights are reviewed regularly and that terminated employees' accounts are disabled promptly. The firm currently has no formal process for these activities. Which combination of actions should the firm implement to satisfy the auditor's requirement?
Select an answer first
34foundation · easy
Why is it important to regularly review user access rights?
Select an answer first
35foundation · easy
What is the main purpose of auditing access logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Access Controls ACCISO Practice Questions (Page 7)

Questions 31–35

Why is it important to regularly review user access rights?

What is the main purpose of auditing access logs?

Keep studying — Information Security Core Competencies