Identity and Access Management CISA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A hospital uses an ABAC system to control access to patient records. The policy allows a nurse to access records only if the patient is assigned to their ward and the access time is within their shift. A nurse complains that they cannot access a patient's record during an emergency when the patient is not assigned to their ward. The hospital wants to maintain security while allowing emergency access. Which approach is BEST?

   • AImplement a 'break-glass' procedure that allows temporary access with mandatory post-access review.
   • BRequire the nurse to call the IT helpdesk to grant temporary access.
   • CModify the ABAC policy to allow any nurse to access any patient record during an emergency.
   • DUse a role-based access control (RBAC) model instead of ABAC.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key best practice for managing privileged accounts?

   • AUsing a password vault to store and rotate privileged credentials
   • BGranting privileged access to all employees to improve efficiency
   • CSharing privileged credentials among administrators for convenience
   • DDisabling logging for privileged sessions to protect privacy
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's security team wants to monitor all activities performed by privileged users (e.g., domain admins, DBAs) to detect insider threats. The company uses a PAM solution. Which capability is MOST important to enable?

   • AIntegration with the HR system to automatically revoke access for terminated employees
   • BWorkflow-based approval for privileged access requests
   • CSession recording and real-time monitoring of privileged sessions
   • DPassword vaulting and automatic rotation of privileged account passwords
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is implementing MFA for all remote access. The security team wants to choose a method that is resistant to phishing and does not require additional hardware. Which MFA method best meets these requirements?

   • AWebAuthn using a built-in platform authenticator (e.g., Windows Hello, Touch ID)
   • BOne-time passcode (OTP) sent via SMS
   • CWebAuthn using a hardware security key
   • DPush notification to a mobile authenticator app that requires the user to approve the login
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A hospital's IT department manages a shared 'admin' account used by all system administrators to log into the electronic health record (EHR) system. After a recent audit finding, the CISO wants to enforce individual accountability for all administrative actions in the EHR. The hospital uses an on-premises Active Directory and cannot replace the EHR system. Which control should the CISO implement FIRST?

   • ARequire all administrators to use their own domain accounts and add those accounts to the EHR's administrator role.
   • BCreate a new shared account with a more complex password and document its use in the IT policy.
   • CImplement a privileged access management (PAM) solution that rotates the shared account's password after each use.
   • DConfigure the EHR to require multi-factor authentication (MFA) for the shared admin account.
   Reveal Solution Discussion Select an answer first