Identity and Access Management CISA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A government agency handles classified documents. The agency requires that access to documents be determined by the document's classification level (e.g., Confidential, Secret, Top Secret) and the user's security clearance. Which access control model is most appropriate?

   • AAttribute-based access control (ABAC)
   • BDiscretionary access control (DAC)
   • CRole-based access control (RBAC)
   • DMandatory access control (MAC)
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm is implementing a new document management system. The compliance officer requires that access to customer records be granted based on the employee's role (e.g., 'Loan Officer', 'Compliance Auditor') and that no employee can both approve a loan and disburse funds. Which access control model best satisfies these requirements?

   • AMandatory access control (MAC) using security labels on documents and users
   • BAttribute-based access control (ABAC) with policies based on user attributes
   • CDiscretionary access control (DAC) where each record owner sets permissions
   • DRole-based access control (RBAC) with segregation-of-duties (SoD) constraints
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational company has a policy that employee access to internal systems must be revoked within 24 hours of termination. The HR system updates the employee status in real time, but the IT team manually processes terminations during business hours. An auditor finds that a terminated employee's access remained active for three days. Which control would MOST effectively ensure timely revocation?

   • AChange the policy to allow 72 hours for access revocation.
   • BRequire the IT team to process terminations within 24 hours and document any delays.
   • CAutomate the deprovisioning process by integrating HR system changes with the identity management system to trigger account disablement.
   • DConduct a weekly audit of active accounts against the HR system to identify and disable terminated employees.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of segregation of duties (SoD) in IAM governance?

   • ATo ensure that all users have the same level of access
   • BTo reduce the number of user accounts
   • CTo prevent fraud and errors by requiring multiple individuals to complete critical tasks
   • DTo simplify the access management process
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A mid-sized company has been managing user access rights locally within each application (e.g., HR system, finance system, file shares). An audit reveals inconsistent access rights and orphaned accounts. The company wants to improve consistency and reduce administrative overhead. Which approach should the company adopt?

   • AA hybrid approach where each application owner defines roles but IT implements them
   • BPeriodic manual reviews of access rights in each application
   • CDecentralized administration with each department managing its own access rights
   • DCentralized access control administration using an identity management platform
   Reveal Solution Discussion Select an answer first