CISA Protection of Information Assets Practice Question
An IS auditor is examining how a hospital enforces least privilege for its electronic health record (EHR) system. During walkthroughs, the auditor observes that nurses can access the billing module and that no formal process exists to request, approve, or periodically recertify role assignments. Which of the following is the MOST appropriate recommendation?
⚠ Common exam trap
The trap here is treating a detective or administrative control, such as monitoring or an acceptable use acknowledgment, as a substitute for actually removing excessive entitlements through role design and recertification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement role-based access control (RBAC) with documented request, approval, and periodic recertification of role assignments.
The observation describes excessive entitlements combined with no formal role lifecycle, which is a least-privilege and access governance failure. Role-based access control aligns permissions to job duties, and documented request, approval, and periodic recertification provide the accountability and review evidence the auditor expects. Detective monitoring, user acknowledgments, and stronger authentication do not correct or govern the underlying entitlements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement role-based access control (RBAC) with documented request, approval, and periodic recertification of role assignments.
Why this is correct
RBAC ties entitlements to defined job functions, and pairing it with documented request, approval, and recertification removes the observed gap of informal role assignments. Because the nurses' billing access is unnecessary for their clinical duties, RBAC with recertification corrects the least-privilege failure while providing audit evidence that assignments are authorized and reviewed.
- ✗
Enable database activity monitoring (DAM) to alert on any nurse queries against billing tables.
Why it's wrong here
DAM detects and logs suspicious queries but does not remove excessive entitlements or create an approval and recertification process. The finding is that nurses hold unnecessary billing access with no lifecycle controls, and monitoring would only produce alerts for access that should not exist. It is a detective control that leaves the root cause of the least-privilege gap intact.
- ✗
Deploy multifactor authentication (MFA) for all EHR logins by clinical staff.
Why it's wrong here
MFA strengthens authentication of whoever logs in, but it does not limit what an authenticated nurse can reach inside the EHR. The auditor's concern is excessive authorization, not weak identity verification, so MFA leaves the billing access and the missing role lifecycle untouched. It addresses a different control objective than least privilege enforcement and role recertification.
- ✗
Require nurses to sign an acceptable use policy (AUP) acknowledging that billing data is confidential.
Why it's wrong here
An AUP sets behavioral expectations but does not restrict technical access or establish role governance. The nurses would still retain billing entitlements with no formal request, approval, or recertification, so the least-privilege deficiency persists. Administrative acknowledgment cannot substitute for access control design and periodic entitlement review, which is what the observation actually requires.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.