After an audit, it was discovered that the security group memberships were not properly adjusted for employees' accounts when they moved from one role to another. Which of the following has the…

Question

Options

• AMandatory access control enforcement.
• BUser rights and permission reviews.
• CTechnical controls over account management.
• DAccount termination procedures.
• EManagement controls over account management.
• FIncident management and response plan.

• A
  4% (2)
• B
  74% (42)
• C
  9% (5)
• D
  12% (7)
• F
  2% (1)

Explanation

Two failures are present. First (B), the organization did not conduct regular user rights and permission reviews - a periodic audit that compares current access rights against what each user actually needs based on their current role would have caught the stale group memberships. Second (E), management controls over account management are the policies, procedures, and oversight mechanisms (such as a formal role-change workflow) that ensure access is updated when employees change roles. Technical controls (C) are automated system-level enforcement, but the root failure here is the lack of management-level process and oversight. Mandatory access control, termination procedures, and incident response are not directly relevant to role-change permission drift.

No community discussion yet for this question.