CPA Isc Quiz: Evaluate Logical Access Controls And Authentication

What this quiz covers

This quiz focuses on Evaluate Logical Access Controls And Authentication, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Password complexity requirements for each sampled account.
2. Whether the users have completed security awareness training.
3. Whether MFA is enabled for each sampled account.
4. The operating effectiveness of the user access review (recertification) control. (correct answer)

Explanation: Confirming with system owners that active accounts are still needed and appropriately privileged is a user access recertification test - directly evaluating whether access review controls are operating effectively. Answer D is correct. Password complexity (A), training completion (B), and MFA status (C) are separate control areas.

Question 2

1. A static password of at least 16 characters.
2. SMS-based one-time passwords sent to the user's mobile phone.
3. Security questions asking for personal information such as mother's maiden name.
4. Hardware security keys (FIDO2/WebAuthn) that provide phishing-resistant MFA by cryptographically binding authentication to the legitimate website. (correct answer)

Explanation: FIDO2/WebAuthn hardware keys are phishing-resistant because authentication is cryptographically tied to the origin (website URL) - fake phishing sites cannot intercept the authentication. Answer D is correct. Long static passwords (A) can still be phished. SMS OTPs (B) can be intercepted via SIM swapping. Security questions (C) are easily researched.

Question 3

1. Administrators can access all systems simultaneously during incident response.
2. JIT access eliminates the need for multi-factor authentication for privileged accounts.
3. Privileged access is granted only when needed and for a defined duration, reducing the window of exposure if credentials are compromised. (correct answer)
4. JIT access automatically logs all administrator activities without requiring a separate audit log.

Explanation: JIT access minimizes standing privileged access - credentials are only active for specific tasks and time windows, dramatically reducing the risk if privileged credentials are stolen. Answer C is correct. JIT restricts, not broadens, concurrent access (A). MFA remains necessary (B). JIT is not a logging mechanism (D).

Question 4

1. To improve system performance by distributing administrative load across multiple accounts.
2. To ensure privileged users complete their work faster with dedicated accounts.
3. To comply with a specific regulatory requirement mandating individual accounts.
4. To maintain individual accountability - actions performed under named accounts can be attributed to specific individuals in audit logs. (correct answer)

Explanation: Named individual privileged accounts ensure that every administrative action is attributed to a specific person in audit logs, supporting accountability, forensics, and non-repudiation. Answer D is correct. Performance (A) and efficiency (B) are not the control objectives. While regulations may require named accounts (C), accountability is the fundamental security principle.

Question 5

1. The IAM solution eliminates the need for any manual access reviews since provisioning is automated.
2. Access changes are applied consistently and promptly when HR events occur (new hire, role change, termination), reducing orphaned accounts and access creep. (correct answer)
3. The IAM solution provides stronger encryption for all system passwords.
4. Automated provisioning eliminates the need for access control policies.

Explanation: HR-IAM integration ensures access lifecycle events are processed promptly and consistently - new accounts are created immediately, terminations are actioned on the last day, and role changes update access automatically. Answer B is correct. Manual reviews remain necessary to verify appropriateness (A). IAM manages access, not password encryption (C). Policies remain necessary to define access rules (D).

Question 6

1. Brute-force attacks that attempt many password combinations in rapid succession. (correct answer)
2. Phishing attacks that trick users into entering credentials on fake websites.
3. Credential stuffing attacks using previously breached username/password pairs.
4. Man-in-the-middle attacks that intercept authentication sessions.

Explanation: Account lockout policies limit the number of failed login attempts before an account is temporarily locked - directly preventing brute-force attacks that rely on rapid trial-and-error. Answer A is correct. Phishing (B) is mitigated by MFA and awareness training. Credential stuffing (C) uses valid credentials and may bypass lockouts if attempts are distributed. MITM attacks (D) are mitigated by TLS and certificate validation.

Question 7

1. Allow the user to retain all prior finance system access since they may occasionally consult on financial matters.
2. Grant the user full IT administrative access immediately without reviewing their prior access.
3. Remove the user's finance system access and provision new IT system access appropriate to the new role, following a formal access change request and approval. (correct answer)
4. Retain all prior access for 90 days as a transition period before deprovisioning.

Explanation: Role changes require immediate access adjustment - removing old access that is no longer needed and provisioning new access for the current role. This prevents access creep and maintains least privilege. Answer C is correct. Retaining old access (A, D) violates least privilege. Granting full IT access without review (B) violates least privilege in the other direction.

Question 8

1. Accept this since corporate network access is inherently secure.
2. Accept this since cloud applications do not require MFA for internal users.
3. Accept this if the VPN requires MFA.
4. Flag this as a control gap - insider threats, compromised network access, or VPN breaches mean internal network location alone does not provide sufficient authentication assurance for a financial application. (correct answer)

Explanation: The corporate network is not a trusted authentication factor - insider threats, compromised devices on the network, and network breaches mean MFA should be required for all access to sensitive financial applications regardless of network location. Answer D is correct. Internal network location is not a substitute for MFA (A, B, C).

Question 9

1. Combining user access listing analysis (population), recertification testing, new user provisioning testing, termination testing, and privileged access testing across the audit period. (correct answer)
2. Reviewing the access control policy document and confirming its approval date.
3. Interviewing the IT security manager about the access control process.
4. Confirming that the IAM system was purchased from a reputable vendor.

Explanation: Comprehensive logical access control testing covers the full user lifecycle: who has access (population analysis), ongoing appropriateness (recertification), new grants, removals, and privileged account management - across the entire audit period. Answer A is correct. Policy review (B), interviews (C), and vendor reputation (D) provide design evidence but not operating effectiveness.

Question 10

1. A preventive access control that blocks suspicious logins in real time.
2. A corrective control that resets compromised user credentials.
3. A detective access control that identifies potentially compromised or malicious accounts through anomalous behavior patterns. (correct answer)
4. A compensating control used when traditional MFA is not available.

Explanation: Behavioral analytics detects anomalies after access occurs - identifying suspicious patterns that may indicate compromised credentials or insider threats. This is a detective control. Answer C is correct. Behavioral analytics typically alerts rather than blocks immediately (A). It detects, not corrects (B). It is a primary detective control, not a compensating one (D).

Question 11

1. Three accounts belong to employees who changed departments within the year.
2. Five accounts belong to employees who terminated employment 3-6 months ago and were not identified in the recertification. (correct answer)
3. Two accounts have not been used in 60 days.
4. One account belongs to a contractor on an extended engagement.

Explanation: Terminated employee accounts that survived the recertification process represent a fundamental access review failure - the primary purpose of recertification is to identify and remove inappropriate access. Answer B is correct. Department changes (A) may require review but are not as severe. Dormant accounts (C) require attention but are lower risk. Active contractor accounts (D) may be appropriate.

Question 12

1. A strong password policy requiring at least 12 characters.
2. Quarterly user access reviews to identify inactive accounts.
3. Regular security awareness training on phishing risks.
4. Multi-factor authentication that requires a second factor (token, biometric, or push notification) in addition to the password. (correct answer)

Explanation: MFA is the most effective preventive control against credential theft - even if a password is stolen, the attacker cannot authenticate without the second factor. Answer D is correct. Strong passwords (A) can still be stolen. Quarterly reviews (B) are detective controls. Training (C) reduces phishing risk but cannot prevent all credential theft.

Question 13

1. A segregation of duties deficiency in logical access controls - combining vendor creation and payment approval creates an unchecked fraud risk. (correct answer)
2. An efficient business process reducing approval delays.
3. An acceptable configuration since the employee is in the accounts payable department.
4. A minor finding that can be addressed through compensating controls only if the dollar amounts are material.

Explanation: Combining vendor creation and payment approval in one account enables a classic vendor fraud scheme - creating a fictitious vendor and approving payments to it. This is a fundamental segregation of duties violation in logical access. Answer A is correct. Efficiency (B) does not justify the control gap. Department membership (C) does not eliminate the risk. All segregation of duties gaps require remediation or formal compensating controls (D).

Question 14

1. Accept as compliant since service accounts are different from user accounts.
2. Note as a policy exception - service accounts should follow defined authentication standards or have documented compensating controls and risk acceptance, not be informally excluded. (correct answer)
3. Accept as a low-risk finding since automated processes are not human users.
4. Accept if the service accounts have read-only access to the database.

Explanation: Service accounts with weak authentication are a significant risk - if compromised, they provide persistent access to the financial database. Policy exceptions require formal documentation, risk acceptance, and compensating controls. Answer B is correct. Policy exceptions require formal treatment (A, C, D).

Question 15

1. Requiring privileged users to change their passwords monthly.
2. Implementing PAM (privileged access management) to vault all privileged credentials.
3. Requiring CAB approval before privileged access is granted.
4. Reviewing privileged user activity logs and session recordings regularly to identify unauthorized or suspicious administrative actions. (correct answer)

Explanation: Regular review of privileged user logs and session recordings is the primary detective control for privileged access - identifying unauthorized activities after they occur. Answer D is correct. Password rotation (A) and PAM vaulting (B) are preventive controls. CAB approval (C) is an authorization control for access grants, not ongoing activity monitoring.

Question 16

1. Passwords must be changed every 90 days regardless of any indication of compromise.
2. Passwords must contain at least one uppercase letter, one number, and one special character.
3. Passwords should be at least 8-15 characters (preferably longer), checked against known breached password lists, and changed only when evidence of compromise exists. (correct answer)
4. Passwords must be exactly 8 characters to ensure consistent processing time.

Explanation: NIST SP 800-63B revised password guidance: emphasize length over complexity rules, check against breach databases, and require changes only upon compromise evidence - not arbitrary rotation. Answer C is correct. Mandatory 90-day rotation (A), strict complexity rules (B), and fixed length requirements (D) are all inconsistent with current NIST guidance.

Question 17

1. Whether the deficiencies were self-reported by management.
2. Whether the combination of deficiencies creates a reasonable possibility that a material misstatement in the financial statements could occur and not be prevented or detected. (correct answer)
3. Whether the IT department has a remediation plan in place.
4. Whether the deficiencies were identified in the prior year's audit.

Explanation: Material weakness classification requires assessment of whether the aggregate of deficiencies creates a risk of material financial misstatement going undetected - the fundamental threshold question. Answer B is correct. Self-reporting (A), remediation plans (C), and prior year history (D) are relevant but secondary to the risk assessment.

Question 18

1. No finding - dormant accounts are normal in large organizations.
2. A finding that the MFA policy is not enforced for dormant accounts.
3. A logical access control deficiency - dormant accounts represent unnecessary access that should be disabled, as they could be exploited by attackers if credentials are compromised. (correct answer)
4. A finding that the system does not generate sufficient audit logs.

Explanation: Dormant accounts violate least privilege and represent unnecessary access risk - if the associated credentials are stolen, attackers have an undetected entry point. Answer C is correct. Dormant accounts are a control issue requiring action (A). MFA status is a separate issue (B). Log generation is unrelated (D).

Question 19

1. API calls will be slower due to certificate validation overhead.
2. Expired, revoked, or stolen certificates could allow unauthorized systems to authenticate and access sensitive APIs, or legitimate systems could be denied access. (correct answer)
3. The certificate authority will charge higher renewal fees.
4. System administrators will have difficulty monitoring API traffic.

Explanation: Poor certificate management creates dual risks: expired/unrenewed certificates disrupt legitimate access, while stolen or improperly revoked certificates enable unauthorized access - both are serious operational and security risks. Answer B is correct. Performance (A), fees (C), and monitoring difficulty (D) are minor concerns.

Question 20

1. Granting permanent access to all users within the corporate network since it is already protected by a firewall.
2. Trusting all traffic that originates from internal IP addresses.
3. Granting broad access to all users after a single strong authentication event.
4. Never trusting, always verifying - continuously validating identity, device health, and access rights for every access request regardless of network location. (correct answer)

Explanation: Zero trust replaces implicit network-based trust with continuous verification - every access request must be authenticated and authorized regardless of whether it originates inside or outside the corporate network. Answer D is correct. Network-location-based trust (A, B) is the opposite of zero trust. Single broad authentication (C) contradicts continuous verification.