CAS-003 Question #840: Real Exam Question with Answer & Explanation

The correct answer is C: employment and termination procedures.. Auditing stale accounts from terminated employees and unverified new accounts directly informs and validates employment and termination procedures by exposing failures in account provisioning and deprovisioning workflows.

Question

During an audit, an information security analyst discovers accounts that are still assigned to employees who no longer work for the company and new accounts that need to be verified against a list of authorized users. This type of auditing supports the development of:

Options

Ainformation classification.
Bcontinuous monitoring.
Cemployment and termination procedures.
Dleast privilege.

Explanation

Auditing stale accounts from terminated employees and unverified new accounts directly informs and validates employment and termination procedures by exposing failures in account provisioning and deprovisioning workflows.

Common mistakes.

A. Information classification is the process of categorizing data by sensitivity level and has no direct relationship to managing user account lifecycles.
B. Continuous monitoring is an ongoing security oversight discipline, not a specific procedure tied to employee status changes.
D. Least privilege is a design principle that restricts access rights to the minimum necessary, but it does not define the provisioning and deprovisioning workflow being audited here.

Concept tested. User account lifecycle management and offboarding procedures

Reference. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice