CISA · Question #72
Which of the following should be an IS auditor's GREATEST concern when assessing an IT service configuration database?
The correct answer is D. The database is write-accessible for all users.. The greatest concern for an IS auditor when assessing an IT service configuration database is widespread write-access, as it introduces severe risks to data integrity and system stability.
Question
Which of the following should be an IS auditor’s GREATEST concern when assessing an IT service configuration database?
Options
- AThe database is not encrypted at rest.
- BThe database is read-accessible for all users.
- CThe database is executable for all users.
- DThe database is write-accessible for all users.
How the community answered
(32 responses)- A16% (5)
- B6% (2)
- C31% (10)
- D47% (15)
Why each option
The greatest concern for an IS auditor when assessing an IT service configuration database is widespread write-access, as it introduces severe risks to data integrity and system stability.
While a lack of encryption at rest is a security concern regarding data confidentiality, it does not pose as immediate a threat to the integrity and operational stability of the configuration data as unrestricted write access.
Read-access for all users primarily raises concerns about information disclosure, which is a confidentiality issue, not directly impacting the integrity of the configuration database itself.
A database file being 'executable' for all users is an unusual and typically incorrect description; database files themselves are data stores, not executables, so this is not a primary or relevant concern.
If an IT service configuration database is write-accessible for all users, it significantly increases the risk of unauthorized or accidental changes, leading to system misconfigurations, service outages, and potential security vulnerabilities due to compromised data integrity.
Concept tested: Data integrity and access control
Source: https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-identity-access
Topics
Community Discussion
No community discussion yet for this question.