- Which of the following physical access controls is specifically designed to prevent 'tailgating' (piggybacking) into secured facilities?
Answer: Mantraps or turnstiles that allow only one person to pass through at a time after individual authentication.
Tailgating - following an authorized person through a secured door - is specifically prevented by mantraps and turnstiles that physically permit only one person per authentication event. Answer D is correct. Cameras (A) detect tailgating after the fact. Sign-in logs (B) track visitors but do not prevent tailgating. Key-card doors (C) alone do not prevent one person from following another through.
- Which of the following is the primary purpose of privileged access management (PAM)?
Answer: To control, monitor, and audit the use of highly privileged accounts (such as system administrators and root accounts) that have elevated access rights to critical systems.
PAM solutions control and monitor privileged accounts - the highest-risk accounts in any environment - through features like just-in-time access, session recording, and credential vaulting. Answer A is correct. Providing admin access to all (B) violates least privilege. Encrypting passwords from admins (C) is not PAM's purpose. Internet restrictions (D) are web filtering controls.
- An organization requires all contractors to use unique individual accounts rather than shared contractor accounts. The primary reason for this requirement is:
Answer: To maintain individual accountability so that all actions can be traced to a specific contractor, and access can be promptly revoked when a specific contractor's engagement ends.
Individual contractor accounts enable accountability (each action is attributable) and precise deprovisioning (only the departing contractor's account is disabled). Answer D is correct. Unique accounts do not automatically grant the same access as employees (A). Individual accounts are more complex to manage than shared accounts (B). System usage billing (C) is not the reason.
- The principle of 'least privilege' in logical access control requires that:
Answer: Users are granted only the minimum level of access necessary to perform their job functions.
Least privilege limits access rights to only what is necessary for a user's role, reducing the attack surface and limiting damage from compromised accounts or insider threats. Answer A is correct. Shared accounts (B) eliminate accountability. Unlimited admin access (C) violates least privilege. Password minimums (D) are an authentication control.
- An organization implements multi-factor authentication (MFA) for all remote access. MFA requires users to provide:
Answer: Two or more authentication factors from different categories: something you know, something you have, or something you are.
MFA combines factors from at least two different categories - knowledge (password), possession (token, phone), or inherence (biometrics) - making it significantly harder for attackers to compromise accounts even if one factor is stolen. Answer D is correct. Multiple passwords (A) are all 'something you know' - one category. A single password (B) is single-factor. Biometrics + token without password (C) is valid MFA but the full definition requires different categories.
- Which of the following access control models enforces access decisions based on security classifications assigned to both the subject (user) and the object (data), preventing users from accessing data classified above their clearance level?
Answer: Mandatory access control (MAC)
Mandatory access control (MAC) assigns security labels to both users (clearance levels) and data (classification levels), and the system enforces access based on these labels - users cannot access data above their clearance regardless of resource owner preferences. Answer B is correct. DAC (A) is owner-controlled. RBAC (C) is role-based. ABAC (D) uses multiple attributes but is not defined by clearance/classification labels specifically.
- An organization discovers that a privileged database administrator has been using their elevated access to read executive compensation data unrelated to their job duties. Which type of control failure does this represent?
Answer: Logical access failure - the DBA's privileges should have been limited to only the databases and data required for their job function.
A DBA accessing data unrelated to their duties indicates that logical access privileges were not sufficiently restricted - least privilege was not enforced. Answer C is correct. Encryption (A) protects against external threats but not insider misuse by authorized users. Physical access (B) is unrelated. Change management (D) governs system changes, not access rights.
- Which of the following is the most significant risk associated with 'access creep' in an organization's IT environment?
Answer: Over time, users accumulate access rights from role changes and project assignments, eventually having far more access than their current role requires, increasing fraud and data breach risk.
Access creep occurs when users retain old access rights after changing roles, accumulating excessive privileges that violate least privilege and create significant fraud risk. Periodic access reviews are the primary mitigation. Answer B is correct. Password management (A), performance (C), and license limits (D) are unrelated to access creep risk.
- An organization's access control policy requires that access to financial systems be granted based on job role, not individual request. An employee in the marketing department requests access to the general ledger application. Under this policy, the correct action is to:
Answer: Deny the request since the marketing role does not include a business need for general ledger access, and least privilege requires access aligned to job function.
Under least privilege and RBAC, access must be tied to job function. Marketing has no business need for the general ledger; the request should be denied. Answer A is correct. Granting access without a business need (B, C) violates least privilege. Exceptions require documented business justification and risk acceptance (D) - not applicable here since there is no legitimate need.
- Which of the following physical access controls is primarily detective in nature?
Answer: CCTV cameras recording all movement in and around the data center.
CCTV cameras record activity for later review - they detect and document security events but do not prevent unauthorized access by themselves (preventive controls do that). Answer C is correct. Biometric scanners (A), locked cabinets (B), and security guards (D) are all preventive physical controls.
- During an IT audit, an auditor finds that a former employee's active directory account was not disabled after termination three months ago. This represents a failure of which control?
Answer: User access provisioning and deprovisioning controls - accounts must be promptly disabled upon termination to prevent unauthorized access.
Failure to disable a terminated employee's account is a deprovisioning control failure - a significant risk because the former employee retains access to systems and data. Answer A is correct. Encryption (B) and physical badge return (C) are separate controls. Change management (D) is unrelated to identity lifecycle.
- A company implements 'single sign-on' (SSO) technology for all its enterprise applications. Which of the following is the primary security consideration that must be addressed with SSO?
Answer: If an SSO account is compromised, the attacker gains access to all applications the user can access, making strong authentication for SSO critical.
SSO centralizes authentication, so a compromised SSO credential gives an attacker access to every connected application. This makes robust MFA and monitoring of SSO accounts critically important. Answer D is correct. SSO requires no database schema alignment (A). SSO reduces password burden (B). SSO works with on-premises and cloud applications (C).
- Which of the following best describes the difference between logical access controls and physical access controls?
Answer: Logical controls govern access to digital systems, data, and applications; physical controls govern access to physical locations, hardware, and facilities.
Logical access controls manage digital access (user accounts, permissions, authentication). Physical access controls manage entry to physical spaces (server rooms, buildings, equipment). Answer C is correct. Answer A reverses the definitions. Answer B incorrectly limits logical controls to databases. Answer D is incorrect - they are distinct control categories.
- Which of the following represents an effective compensating control when segregation of duties cannot be fully implemented due to organizational size constraints?
Answer: Enhanced monitoring and logging of all transactions performed by the individual with combined responsibilities, combined with regular supervisory review.
When segregation cannot be achieved, enhanced monitoring and supervisory review of the individual's transactions serve as compensating detective controls, providing oversight that mitigates the risk. Answer A is correct. Additional access (B) worsens the risk. Outsourcing (C) transfers rather than mitigates the risk. Documentation without action (D) is insufficient.
- An auditor reviewing logical access controls finds that several system administrator accounts share generic usernames (e.g., 'admin1', 'admin2') used by multiple staff members. Which control principle is most significantly violated?
Answer: Individual accountability - shared accounts prevent attribution of actions to specific individuals, undermining audit trails.
Shared accounts destroy individual accountability - when multiple people use the same account, it is impossible to determine which individual performed a specific action, eliminating the value of audit logs. Answer B is correct. While least privilege (A) and segregation (C) may also be concerns, individual accountability is the most direct violation. Encryption (D) is unrelated.
- Role-based access control (RBAC) differs from discretionary access control (DAC) in that RBAC:
Answer: Assigns access rights based on predefined organizational roles, reducing the complexity of managing individual user permissions.
RBAC assigns permissions to roles (job functions) and users are assigned to roles, simplifying access management at scale. DAC allows resource owners to control access. Answer C is correct. Data owner discretion (A) describes DAC. Sensitivity labels (B) describe mandatory access control (MAC). User-defined access levels (D) also describe DAC.
- A company's server room requires employees to use an access card and enter a PIN to gain entry. This is an example of:
Answer: Physical access control using multi-factor authentication (something you have + something you know).
Physical entry requiring both an access card (something you have) and a PIN (something you know) is physical MFA - two factors from different categories applied to physical access. Answer B is correct. This is physical, not logical access control (A). The card and PIN are different factor categories, making it multi-factor (C). Access cards and PINs are preventive controls, not detective (D).
- An access review is conducted to verify that user access rights remain appropriate. This is also known as:
Answer: A user access recertification or entitlement review, where managers confirm that their employees' access is still needed and appropriate.
Access recertification (or entitlement review) is a periodic process where data/system owners and managers review and confirm or revoke each user's access rights to ensure continued appropriateness. Answer B is correct. Penetration testing (A) is a separate security assessment. Physical access logs (C) are unrelated. Password policy review (D) is a policy review, not an access review.
- An IT auditor selects a sample of user accounts in a critical financial application and requests that the system owner confirm whether each user still requires their current level of access. This procedure tests which access control objective?
Answer: Authorization appropriateness - confirming that access rights remain aligned with current job responsibilities.
This procedure tests whether authorized access rights remain appropriate - a core access control objective ensuring users only have access they currently need. Answer B is correct. Authentication testing (A) tests login controls. Encryption (C) and physical access (D) are separate control areas.
- A company uses identity and access management (IAM) software to automate user provisioning and deprovisioning. The primary benefit of this automation is:
Answer: Ensuring access is granted and revoked consistently, promptly, and with a complete audit trail, reducing the risk of orphaned accounts or access overprovisioning.
IAM automation ensures that provisioning follows defined rules consistently, deprovisioning occurs immediately upon termination, and all actions are logged - reducing manual errors and orphaned accounts. Answer A is correct. Policies remain necessary to define rules (B). Self-approval violates authorization controls (C). IAM does not replace MFA (D).
