CPA Isc Quiz: Assess Logical And Physical Access Controls

What this quiz covers

This quiz focuses on Assess Logical And Physical Access Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Allows individual data owners to grant access to whoever they choose.
2. Grants access based on the sensitivity label of the data, not the user's role.
3. Assigns access rights based on predefined organizational roles, reducing the complexity of managing individual user permissions. (correct answer)
4. Allows users to define their own access levels within their assigned permissions.

Explanation: RBAC assigns permissions to roles (job functions) and users are assigned to roles, simplifying access management at scale. DAC allows resource owners to control access. Answer C is correct. Data owner discretion (A) describes DAC. Sensitivity labels (B) describe mandatory access control (MAC). User-defined access levels (D) also describe DAC.

Question 2

1. User access provisioning and deprovisioning controls - accounts must be promptly disabled upon termination to prevent unauthorized access. (correct answer)
2. Encryption controls - the former employee's data should have been encrypted.
3. Physical access controls - the former employee should have returned their access badge.
4. Change management controls - the account status change was not properly documented.

Explanation: Failure to disable a terminated employee's account is a deprovisioning control failure - a significant risk because the former employee retains access to systems and data. Answer A is correct. Encryption (B) and physical badge return (C) are separate controls. Change management (D) is unrelated to identity lifecycle.

Question 3

1. Security cameras that record all entry and exit events.
2. A sign-in log requiring all visitors to record their name and time of entry.
3. A security guard stationed at the building entrance.
4. A mantrap (airlock) requiring biometric verification, with only one door open at a time, allowing entry of one person after identity is confirmed. (correct answer)

Explanation: A mantrap with biometric verification is the strongest preventive physical control - it stops tailgating, requires individual identity verification, and physically prevents unauthorized entry. Answer D is correct. Security cameras (A) and sign-in logs (B) are detective controls. A security guard (C) is a human preventive control but is less reliable than an automated biometric mantrap.

Question 4

1. System performance may degrade due to too many simultaneous users.
2. The financial reporting system may not support the number of concurrent users.
3. Employees outside the finance function can view, modify, or delete sensitive financial data, violating the principle of least privilege and creating fraud and error risks. (correct answer)
4. The system may generate audit log entries for all user actions, consuming storage.

Explanation: Unrestricted access to financial systems violates least privilege and segregation of duties, enabling unauthorized modification of financial data by employees with no legitimate need for that access. Answer C is correct. Performance (A), user capacity (B), and log storage (D) are operational concerns, not the primary risk.

Question 5

1. SSO requires all applications to use the same database schema.
2. SSO increases the number of passwords employees must remember.
3. SSO is only compatible with cloud-based applications.
4. If an SSO account is compromised, the attacker gains access to all applications the user can access, making strong authentication for SSO critical. (correct answer)

Explanation: SSO centralizes authentication, so a compromised SSO credential gives an attacker access to every connected application. This makes robust MFA and monitoring of SSO accounts critically important. Answer D is correct. SSO requires no database schema alignment (A). SSO reduces password burden (B). SSO works with on-premises and cloud applications (C).

Question 6

1. Biometric scanners required for entry to restricted areas.
2. Locked server cabinets within the data center.
3. CCTV cameras recording all movement in and around the data center. (correct answer)
4. Security guards requiring badge verification before entry.

Explanation: CCTV cameras record activity for later review - they detect and document security events but do not prevent unauthorized access by themselves (preventive controls do that). Answer C is correct. Biometric scanners (A), locked cabinets (B), and security guards (D) are all preventive physical controls.

Question 7

1. Requiring two different passwords to access the same system.
2. Dividing IT functions between multiple data centers to reduce single points of failure.
3. Requiring employees to log out of systems when leaving their desk.
4. Ensuring that no single user has access rights that would allow them to complete a sensitive transaction from start to finish without another person's involvement. (correct answer)

Explanation: Separation of duties in access control means access rights are structured so that completing high-risk transactions (e.g., creating and approving a payment) requires more than one person, reducing fraud risk. Answer D is correct. Two passwords for one system (A) is MFA. Physical redundancy (B) is availability. Screen locking (C) is a session control.

Question 8

1. Authentication - verifying that users are who they claim to be when logging in.
2. Authorization appropriateness - confirming that access rights remain aligned with current job responsibilities. (correct answer)
3. Encryption - ensuring sensitive data accessed by users is protected.
4. Physical access - confirming users are authorized to enter the data center.

Explanation: This procedure tests whether authorized access rights remain appropriate - a core access control objective ensuring users only have access they currently need. Answer B is correct. Authentication testing (A) tests login controls. Encryption (C) and physical access (D) are separate control areas.

Question 9

1. Ensuring access is granted and revoked consistently, promptly, and with a complete audit trail, reducing the risk of orphaned accounts or access overprovisioning. (correct answer)
2. Eliminating the need for access control policies since automation enforces rules automatically.
3. Allowing employees to self-approve their own access requests.
4. Replacing the need for MFA by automating authentication.

Explanation: IAM automation ensures that provisioning follows defined rules consistently, deprovisioning occurs immediately upon termination, and all actions are logged - reducing manual errors and orphaned accounts. Answer A is correct. Policies remain necessary to define rules (B). Self-approval violates authorization controls (C). IAM does not replace MFA (D).

Question 10

1. Security cameras at all entry points.
2. Visitor sign-in logs at the reception desk.
3. Key-card access for all exterior doors.
4. Mantraps or turnstiles that allow only one person to pass through at a time after individual authentication. (correct answer)

Explanation: Tailgating - following an authorized person through a secured door - is specifically prevented by mantraps and turnstiles that physically permit only one person per authentication event. Answer D is correct. Cameras (A) detect tailgating after the fact. Sign-in logs (B) track visitors but do not prevent tailgating. Key-card doors (C) alone do not prevent one person from following another through.

Question 11

1. Encryption failure - the executive compensation data should have been encrypted.
2. Physical access failure - the DBA should not have physical access to servers storing the data.
3. Logical access failure - the DBA's privileges should have been limited to only the databases and data required for their job function. (correct answer)
4. Change management failure - the access was not approved through a change request.

Explanation: A DBA accessing data unrelated to their duties indicates that logical access privileges were not sufficiently restricted - least privilege was not enforced. Answer C is correct. Encryption (A) protects against external threats but not insider misuse by authorized users. Physical access (B) is unrelated. Change management (D) governs system changes, not access rights.

Question 12

1. Enhanced monitoring and logging of all transactions performed by the individual with combined responsibilities, combined with regular supervisory review. (correct answer)
2. Granting the individual additional access rights to complete tasks more efficiently.
3. Outsourcing all functions to a third party to eliminate the segregation gap.
4. Documenting the segregation gap in the risk register and taking no further action.

Explanation: When segregation cannot be achieved, enhanced monitoring and supervisory review of the individual's transactions serve as compensating detective controls, providing oversight that mitigates the risk. Answer A is correct. Additional access (B) worsens the risk. Outsourcing (C) transfers rather than mitigates the risk. Documentation without action (D) is insufficient.

Question 13

1. Discretionary access control (DAC)
2. Mandatory access control (MAC) (correct answer)
3. Role-based access control (RBAC)
4. Attribute-based access control (ABAC)

Explanation: Mandatory access control (MAC) assigns security labels to both users (clearance levels) and data (classification levels), and the system enforces access based on these labels - users cannot access data above their clearance regardless of resource owner preferences. Answer B is correct. DAC (A) is owner-controlled. RBAC (C) is role-based. ABAC (D) uses multiple attributes but is not defined by clearance/classification labels specifically.

Question 14

1. Least privilege - generic accounts may have more access than needed.
2. Individual accountability - shared accounts prevent attribution of actions to specific individuals, undermining audit trails. (correct answer)
3. Segregation of duties - the accounts are not separated by function.
4. Data encryption - generic accounts do not protect data at rest.

Explanation: Shared accounts destroy individual accountability - when multiple people use the same account, it is impossible to determine which individual performed a specific action, eliminating the value of audit logs. Answer B is correct. While least privilege (A) and segregation (C) may also be concerns, individual accountability is the most direct violation. Encryption (D) is unrelated.

Question 15

1. Users accumulate so many passwords that they begin writing them down.
2. Over time, users accumulate access rights from role changes and project assignments, eventually having far more access than their current role requires, increasing fraud and data breach risk. (correct answer)
3. Access creep causes system performance to degrade as more users access each system.
4. New employees cannot get timely access because existing accounts consume available licenses.

Explanation: Access creep occurs when users retain old access rights after changing roles, accumulating excessive privileges that violate least privilege and create significant fraud risk. Periodic access reviews are the primary mitigation. Answer B is correct. Password management (A), performance (C), and license limits (D) are unrelated to access creep risk.

Question 16

1. Penetration testing of user accounts to identify weak passwords.
2. A user access recertification or entitlement review, where managers confirm that their employees' access is still needed and appropriate. (correct answer)
3. An audit of physical access logs to verify employee attendance.
4. A review of the organization's password policy for compliance.

Explanation: Access recertification (or entitlement review) is a periodic process where data/system owners and managers review and confirm or revoke each user's access rights to ensure continued appropriateness. Answer B is correct. Penetration testing (A) is a separate security assessment. Physical access logs (C) are unrelated. Password policy review (D) is a policy review, not an access review.

Question 17

1. Deny the request since the marketing role does not include a business need for general ledger access, and least privilege requires access aligned to job function. (correct answer)
2. Grant the access since the employee may need it for occasional financial analysis.
3. Grant read-only access as a compromise between the request and the policy.
4. Approve the request and document it as an exception to the access control policy.

Explanation: Under least privilege and RBAC, access must be tied to job function. Marketing has no business need for the general ledger; the request should be denied. Answer A is correct. Granting access without a business need (B, C) violates least privilege. Exceptions require documented business justification and risk acceptance (D) - not applicable here since there is no legitimate need.

Question 18

1. To control, monitor, and audit the use of highly privileged accounts (such as system administrators and root accounts) that have elevated access rights to critical systems. (correct answer)
2. To provide all employees with administrator-level access to improve productivity.
3. To encrypt privileged user passwords so they cannot be read by IT administrators.
4. To restrict privileged users from accessing the internet during work hours.

Explanation: PAM solutions control and monitor privileged accounts - the highest-risk accounts in any environment - through features like just-in-time access, session recording, and credential vaulting. Answer A is correct. Providing admin access to all (B) violates least privilege. Encrypting passwords from admins (C) is not PAM's purpose. Internet restrictions (D) are web filtering controls.

Question 19

1. Users are granted only the minimum level of access necessary to perform their job functions. (correct answer)
2. All users share a common account to minimize the number of accounts requiring management.
3. System administrators have access to all systems to ensure they can respond to emergencies.
4. Passwords must be at least the minimum required length specified in the security policy.

Explanation: Least privilege limits access rights to only what is necessary for a user's role, reducing the attack surface and limiting damage from compromised accounts or insider threats. Answer A is correct. Shared accounts (B) eliminate accountability. Unlimited admin access (C) violates least privilege. Password minimums (D) are an authentication control.

Question 20

1. Logical controls restrict physical entry to buildings; physical controls restrict digital access to systems.
2. Logical controls apply only to databases; physical controls apply to all IT systems.
3. Logical controls govern access to digital systems, data, and applications; physical controls govern access to physical locations, hardware, and facilities. (correct answer)
4. Logical and physical controls are interchangeable terms referring to the same security mechanisms.

Explanation: Logical access controls manage digital access (user accounts, permissions, authentication). Physical access controls manage entry to physical spaces (server rooms, buildings, equipment). Answer C is correct. Answer A reverses the definitions. Answer B incorrectly limits logical controls to databases. Answer D is incorrect - they are distinct control categories.