Which of the following should be the PRIMARY focus for an information security manager when reviewing access controls for data stored in an off-premise cloud environment?

Question

Options

• AEnsuring access is granted only to those individuals whose job functions require it
• BReviewing and updating access controls in response to changes in organizational structure
• CImplementing strong encryption protocols to protect sensitive data
• DImplementing strong password policies and enforcing regular password changes

• A
  77% (24)
• B
  6% (2)
• C
  3% (1)
• D
  13% (4)

Explanation

The foundational principle of access control is least privilege - ensuring that each user can access only the data and resources their job role requires, and nothing more. In a cloud environment where data is outside the organization's physical perimeter, verifying that access is appropriately scoped to job function is the most critical access control concern. Options B, C, and D describe important security activities but are secondary: responding to org structure changes (B) is a maintenance activity, encryption (C) is a data protection control rather than an access control, and password policies (D) are authentication hygiene measures. None of these address the fundamental question of whether the right people have the right access.

No community discussion yet for this question.