A large enterprise has a high turnover rate and uses a manual process for granting and revoking access. An audit reveals that terminated employees retain access for an average of 30 days. The CISO wants to reduce this to less than 24 hours without increasing the IT team's workload. Which solution is most effective?

Set all accounts to expire after 90 days and require users to re-authenticate.

Conduct a monthly audit of active accounts and disable those of former employees.

Require managers to submit a ticket to IT for each termination.

Integrate the HR system with the identity management platform to automatically disable accounts upon termination.

A company's help desk receives a call from someone claiming to be a manager who needs their password reset immediately. The caller is insistent and provides the manager's employee ID. The help desk agent follows procedure and resets the password. Later, it is discovered that the caller was not the manager. Which access control countermeasure would have most effectively prevented this social engineering attack?

Implement a policy that password resets can only be done in person.

Train help desk staff to recognize social engineering tactics.

Require the caller to verify their identity through a secondary channel, such as a one-time code sent to the manager's mobile device.

Log all password reset requests and review them monthly.

What is the primary purpose of auditing access logs?

To encrypt data stored in the logs

To detect unauthorized access attempts and support incident investigations

To improve system performance by identifying slow queries

To automatically block all failed login attempts

A company has a policy that all access to sensitive data must be logged and reviewed. The CISO wants to detect anomalies such as a user accessing data at unusual times or from unusual locations. Which practice is most effective?

User and entity behavior analytics (UEBA)

Simple alerting on failed logins

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 1

Access Controls CCISO Practice Questions (Page 8)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

10 Concepts in This Objective

Access Control Fundamentals
Access Control Models
Identification, Authentication, Authorization, and Accountability
Authentication Methods
Authorization Mechanisms
Access Control Implementation
Access Control Administration
Access Control Monitoring and Auditing
Access Control Threats and Countermeasures
Access Control Best Practices and Standards

Questions 36–40

36expert · hard
A large enterprise has a high turnover rate and uses a manual process for granting and revoking access. An audit reveals that terminated employees retain access for an average of 30 days. The CISO wants to reduce this to less than 24 hours without increasing the IT team's workload. Which solution is most effective?
Select an answer first
37application · medium
A company is deploying a new HR system. The CISO requires that no single administrator can both create user accounts and approve access requests. This is to prevent fraud. Which control is being implemented?
Select an answer first
38application · medium
A company's help desk receives a call from someone claiming to be a manager who needs their password reset immediately. The caller is insistent and provides the manager's employee ID. The help desk agent follows procedure and resets the password. Later, it is discovered that the caller was not the manager. Which access control countermeasure would have most effectively prevented this social engineering attack?
Select an answer first
39foundation · easy
What is the primary purpose of auditing access logs?
Select an answer first
40expert · hard
A company has a policy that all access to sensitive data must be logged and reviewed. The CISO wants to detect anomalies such as a user accessing data at unusual times or from unusual locations. Which practice is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Access Controls CCISO Practice Questions (Page 8)

Questions 36–40

A company is deploying a new HR system. The CISO requires that no single administrator can both create user accounts and approve access requests. This is to prevent fraud. Which control is being implemented?

What is the primary purpose of auditing access logs?

A company has a policy that all access to sensitive data must be logged and reviewed. The CISO wants to detect anomalies such as a user accessing data at unusual times or from unusual locations. Which practice is most effective?

Keep studying — Information Security Core Competencies