Define Data Access Provisioning CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's access recertification policy requires that all user access to the financial system be reviewed quarterly. During a recent review, the security team found that several users who had transferred to different departments still had access to their previous department's financial data. What is the most likely root cause of this issue?

   • AThe recertification process was conducted too frequently, leading to reviewer fatigue and oversight.
   • BThe HR system did not notify the security team about the employees' department transfers.
   • CThe financial system does not support automated deprovisioning of user access.
   • DThe recertification process did not include a check for whether users' current job roles still require the access they were granted previously.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is deploying a new customer support application. The security team wants to ensure that only authorized support agents can access customer data. Which provisioning strategy is most appropriate?

   • AGrant each support agent individual permissions to the customer data as needed.
   • BCreate a role for support agents and assign the necessary permissions to that role, then add users to the role as they are hired.
   • CProvide all employees with access to the customer support application and rely on the application's security to restrict access.
   • DUse a shared account for all support agents to access the customer support application.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare organization is required to recertify user access to its electronic health record (EHR) system every six months. The compliance team has noticed that some managers simply approve all access requests without reviewing them. Which control would most effectively improve the quality of the recertification process?

   • AIncrease the frequency of recertification to every three months.
   • BDelegate the recertification task to the IT security team instead of the managers.
   • CAutomate the recertification process so that all access is automatically renewed unless a manager explicitly revokes it.
   • DRequire managers to provide a business justification for each access right they approve during the recertification cycle.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's access recertification process is conducted annually. During a review, the security team finds that a user who left the company six months ago still has active access to the payroll system. What is the most likely reason this happened?

   • AThe recertification process is too frequent, causing reviewers to overlook inactive users.
   • BThe deprovisioning process was not triggered when the employee left, and the annual recertification did not catch it because the user was not flagged as inactive.
   • CThe payroll system does not support automated deprovisioning of user access.
   • DThe HR system did not notify the security team about the employee's departure.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary goal of the reapproval process for data access?

   • ATo automatically grant additional permissions to users based on their job performance
   • BTo provide a one-time approval for all new access requests without further review
   • CTo ensure that all users have the same level of access to simplify management
   • DTo periodically verify that users and service accounts still require their current access permissions
   Reveal Solution Discussion Select an answer first