- A company's logical access controls are tested and found to have several significant deficiencies: terminated employees with active accounts, excessive privileged access, and no periodic access reviews. The external auditor is evaluating whether these collectively represent a material weakness. The key question is:
Answer: Whether the combination of deficiencies creates a reasonable possibility that a material misstatement in the financial statements could occur and not be prevented or detected.
Material weakness classification requires assessment of whether the aggregate of deficiencies creates a risk of material financial misstatement going undetected - the fundamental threshold question. Answer B is correct. Self-reporting (A), remediation plans (C), and prior year history (D) are relevant but secondary to the risk assessment.
- A company requires all privileged accounts (system admins, database admins) to use separate named accounts rather than sharing a single 'admin' account. The primary control objective of this requirement is:
Answer: To maintain individual accountability - actions performed under named accounts can be attributed to specific individuals in audit logs.
Named individual privileged accounts ensure that every administrative action is attributed to a specific person in audit logs, supporting accountability, forensics, and non-repudiation. Answer D is correct. Performance (A) and efficiency (B) are not the control objectives. While regulations may require named accounts (C), accountability is the fundamental security principle.
- Which of the following represents the most comprehensive approach to evaluating the operating effectiveness of logical access controls?
Answer: Combining user access listing analysis (population), recertification testing, new user provisioning testing, termination testing, and privileged access testing across the audit period.
Comprehensive logical access control testing covers the full user lifecycle: who has access (population analysis), ongoing appropriateness (recertification), new grants, removals, and privileged account management - across the entire audit period. Answer A is correct. Policy review (B), interviews (C), and vendor reputation (D) provide design evidence but not operating effectiveness.
- An auditor evaluating logical access controls selects a sample of active user accounts in a financial system and requests confirmation from the system owner that each account is still needed and appropriately privileged. This procedure tests:
Answer: The operating effectiveness of the user access review (recertification) control.
Confirming with system owners that active accounts are still needed and appropriately privileged is a user access recertification test - directly evaluating whether access review controls are operating effectively. Answer D is correct. Password complexity (A), training completion (B), and MFA status (C) are separate control areas.
- Which of the following authentication methods provides the strongest protection against credential theft attacks such as phishing?
Answer: Hardware security keys (FIDO2/WebAuthn) that provide phishing-resistant MFA by cryptographically binding authentication to the legitimate website.
FIDO2/WebAuthn hardware keys are phishing-resistant because authentication is cryptographically tied to the origin (website URL) - fake phishing sites cannot intercept the authentication. Answer D is correct. Long static passwords (A) can still be phished. SMS OTPs (B) can be intercepted via SIM swapping. Security questions (C) are easily researched.
- During an access control audit, an auditor finds that a terminated employee's account was disabled 14 days after their departure date. Which control failed?
Answer: The user deprovisioning process - accounts should be disabled on or before the employee's last day to prevent unauthorized access by former employees.
A 14-day delay in disabling a terminated employee's account is a deprovisioning control failure - the account should be disabled immediately upon or before termination to close the unauthorized access window. Answer B is correct. Password complexity (A) and MFA (C) are irrelevant after termination. Quarterly reviews (D) should catch orphaned accounts but are not the primary control for timely deprovisioning.
- An auditor finds that an employee in the accounts payable department has both the ability to create new vendors in the vendor master file and to approve vendor payments. This represents:
Answer: A segregation of duties deficiency in logical access controls - combining vendor creation and payment approval creates an unchecked fraud risk.
Combining vendor creation and payment approval in one account enables a classic vendor fraud scheme - creating a fictitious vendor and approving payments to it. This is a fundamental segregation of duties violation in logical access. Answer A is correct. Efficiency (B) does not justify the control gap. Department membership (C) does not eliminate the risk. All segregation of duties gaps require remediation or formal compensating controls (D).
- Which of the following scenarios represents the strongest evidence that an organization's access recertification controls are effective?
Answer: Access reviews are completed on schedule, exceptions are investigated and actioned within defined timeframes, access is removed for employees who no longer need it, and the process is documented with evidence of management sign-off.
Effective recertification produces demonstrable outcomes: timely completion, investigated exceptions, removed inappropriate access, and documented evidence. Answer A captures all dimensions of operating effectiveness. Performing reviews (B) and policy approval (C) are necessary but insufficient without evidence of outcomes. No incidents (D) may reflect good controls or good luck - it doesn't confirm the recertification was effective.
- An organization implements just-in-time (JIT) privileged access for system administrators. The primary benefit of JIT access is:
Answer: Privileged access is granted only when needed and for a defined duration, reducing the window of exposure if credentials are compromised.
JIT access minimizes standing privileged access - credentials are only active for specific tasks and time windows, dramatically reducing the risk if privileged credentials are stolen. Answer C is correct. JIT restricts, not broadens, concurrent access (A). MFA remains necessary (B). JIT is not a logging mechanism (D).
- An organization implements an identity and access management (IAM) solution that automatically provisions and deprovisions user access based on HR system changes. The primary control benefit of this integration is:
Answer: Access changes are applied consistently and promptly when HR events occur (new hire, role change, termination), reducing orphaned accounts and access creep.
HR-IAM integration ensures access lifecycle events are processed promptly and consistently - new accounts are created immediately, terminations are actioned on the last day, and role changes update access automatically. Answer B is correct. Manual reviews remain necessary to verify appropriateness (A). IAM manages access, not password encryption (C). Policies remain necessary to define access rules (D).
- An organization's logical access policy states that all access to production systems must be through named individual accounts with MFA. An auditor finds three service accounts with shared passwords and no MFA, used by automated processes to connect to the financial database. How should this be evaluated?
Answer: Note as a policy exception - service accounts should follow defined authentication standards or have documented compensating controls and risk acceptance, not be informally excluded.
Service accounts with weak authentication are a significant risk - if compromised, they provide persistent access to the financial database. Policy exceptions require formal documentation, risk acceptance, and compensating controls. Answer B is correct. Policy exceptions require formal treatment (A, C, D).
- Which of the following best describes the access control principle applied when a user is granted only the permissions required to perform their specific job duties?
Answer: Principle of least privilege - access rights are limited to the minimum necessary for the user's role.
Least privilege limits each user's access to only what their job requires - minimizing the attack surface and limiting damage from compromised accounts. Answer A is correct. Separation of duties (B) requires two-person involvement in transactions. Defense in depth (C) describes layered controls. Need to know (D) is similar but specifically refers to information sharing, not system access permissions.
- An organization implements a zero-trust network architecture. From a logical access control perspective, the key principle of zero trust is:
Answer: Never trusting, always verifying - continuously validating identity, device health, and access rights for every access request regardless of network location.
Zero trust replaces implicit network-based trust with continuous verification - every access request must be authenticated and authorized regardless of whether it originates inside or outside the corporate network. Answer D is correct. Network-location-based trust (A, B) is the opposite of zero trust. Single broad authentication (C) contradicts continuous verification.
- Which of the following password policy requirements aligns with current NIST guidance (SP 800-63B) for organizational authentication?
Answer: Passwords should be at least 8-15 characters (preferably longer), checked against known breached password lists, and changed only when evidence of compromise exists.
NIST SP 800-63B revised password guidance: emphasize length over complexity rules, check against breach databases, and require changes only upon compromise evidence - not arbitrary rotation. Answer C is correct. Mandatory 90-day rotation (A), strict complexity rules (B), and fixed length requirements (D) are all inconsistent with current NIST guidance.
- An auditor testing authentication controls for a cloud-based financial application finds that MFA is not enforced for user accounts accessing the application from within the corporate network. The auditor should:
Answer: Flag this as a control gap - insider threats, compromised network access, or VPN breaches mean internal network location alone does not provide sufficient authentication assurance for a financial application.
The corporate network is not a trusted authentication factor - insider threats, compromised devices on the network, and network breaches mean MFA should be required for all access to sensitive financial applications regardless of network location. Answer D is correct. Internal network location is not a substitute for MFA (A, B, C).
- Which of the following represents an effective detective control over privileged user access in a financial system?
Answer: Reviewing privileged user activity logs and session recordings regularly to identify unauthorized or suspicious administrative actions.
Regular review of privileged user logs and session recordings is the primary detective control for privileged access - identifying unauthorized activities after they occur. Answer D is correct. Password rotation (A) and PAM vaulting (B) are preventive controls. CAB approval (C) is an authorization control for access grants, not ongoing activity monitoring.
- An organization uses certificate-based authentication for system-to-system API calls. Which of the following represents the most significant risk if certificate management controls are weak?
Answer: Expired, revoked, or stolen certificates could allow unauthorized systems to authenticate and access sensitive APIs, or legitimate systems could be denied access.
Poor certificate management creates dual risks: expired/unrenewed certificates disrupt legitimate access, while stolen or improperly revoked certificates enable unauthorized access - both are serious operational and security risks. Answer B is correct. Performance (A), fees (C), and monitoring difficulty (D) are minor concerns.
- An organization has 500 application user accounts. During an annual access review, the system owner recertifies 490 accounts as appropriate and removes 10. The auditor selects 25 accounts from the recertified 490 for testing. Which of the following would represent a significant finding in this testing?
Answer: Five accounts belong to employees who terminated employment 3-6 months ago and were not identified in the recertification.
Terminated employee accounts that survived the recertification process represent a fundamental access review failure - the primary purpose of recertification is to identify and remove inappropriate access. Answer B is correct. Department changes (A) may require review but are not as severe. Dormant accounts (C) require attention but are lower risk. Active contractor accounts (D) may be appropriate.
- Which of the following authentication attack types is most effectively mitigated by implementing account lockout policies?
Answer: Brute-force attacks that attempt many password combinations in rapid succession.
Account lockout policies limit the number of failed login attempts before an account is temporarily locked - directly preventing brute-force attacks that rely on rapid trial-and-error. Answer A is correct. Phishing (B) is mitigated by MFA and awareness training. Credential stuffing (C) uses valid credentials and may bypass lockouts if attempts are distributed. MITM attacks (D) are mitigated by TLS and certificate validation.
- A financial services company uses behavioral analytics to detect anomalous user activity (e.g., accessing unusual amounts of data, logging in from new countries). This type of control is best classified as:
Answer: A detective access control that identifies potentially compromised or malicious accounts through anomalous behavior patterns.
Behavioral analytics detects anomalies after access occurs - identifying suspicious patterns that may indicate compromised credentials or insider threats. This is a detective control. Answer C is correct. Behavioral analytics typically alerts rather than blocks immediately (A). It detects, not corrects (B). It is a primary detective control, not a compensating one (D).
