The answer is a recent user access review report signed by department managers. This is the best evidence that access rights are appropriately assigned because it provides documented, detective-level confirmation that data owners—the department managers—have explicitly verified and approved each user’s access privileges. Unlike preventive controls such as role-based templates or automated provisioning logs, a signed review report directly validates that the rights assigned are correct and current, serving as an authoritative attestation from those who own the data. On the CISA exam, this question tests your understanding that logical access control audits prioritize evidence of independent verification over system-generated logs; a common trap is choosing an access control list or provisioning policy, which show intent but not actual validation. Remember the memory tip: “Sign-off from the boss proves access isn’t a loss”—the manager’s signature is the gold standard for proving appropriate assignment.
CISA Information System Auditing Process Practice Question
This CISA practice question tests your understanding of information system auditing process. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An IS auditor is reviewing the logical access controls of a system. Which of the following is the BEST evidence that access rights are appropriately assigned?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A recent user access review report signed by department managers
Option D is the best evidence because a user access review report signed by department managers provides documented confirmation that the assigned access rights have been explicitly verified and approved by the data owners. This is a detective control that directly validates the appropriateness of access assignments, whereas the other options are either preventive or detective controls that do not confirm the correctness of the rights themselves.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
An audit log showing all successful and failed login attempts
Why it's wrong here
Shows activity but not whether access rights are appropriate.
✗
A password policy requiring complex passwords
Why it's wrong here
Password policy addresses authentication, not authorization.
✗
An access control matrix defining roles and permissions
Why it's wrong here
Defines intended access but not actual assignment.
✓
A recent user access review report signed by department managers
Why this is correct
Management sign-off confirms proper assignment.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse a control design document (access control matrix) with evidence of control effectiveness, failing to recognize that only a recent, signed user access review provides proof that the assigned rights have been validated by the data owner.
Trap categories for this question
Command / output trap
Shows activity but not whether access rights are appropriate.
Detailed technical explanation
How to think about this question
User access reviews typically involve comparing the access control matrix (e.g., RBAC role definitions) against actual system entitlements, often using automated tools like SAP GRC or Azure AD access reviews. The signed review report serves as an audit trail that satisfies compliance requirements such as SOX or PCI DSS, which mandate periodic recertification of access rights by business owners. Without this sign-off, there is no assurance that the principle of least privilege is being maintained in practice.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CISA exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information System Auditing Process — This question tests Information System Auditing Process — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: A recent user access review report signed by department managers — Option D is the best evidence because a user access review report signed by department managers provides documented confirmation that the assigned access rights have been explicitly verified and approved by the data owners. This is a detective control that directly validates the appropriateness of access assignments, whereas the other options are either preventive or detective controls that do not confirm the correctness of the rights themselves.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IS auditor is reviewing the logical access controls of a financial application. Which of the following is the BEST way to verify that user access rights are appropriate?
medium
A.Interview the IT security manager about the access control process.
B.Review the access control list for each user.
C.Re-perform a sample of transactions to detect unauthorized access.
✓ D.Compare the user access rights with the job descriptions and responsibilities.
Why D: Option D is correct because comparing user access rights directly against job descriptions and responsibilities is the most effective method to verify that access is appropriate based on the principle of least privilege. This approach ensures that each user's permissions align with their actual job functions, which is the core objective of a logical access control review. Interviewing or reviewing lists alone does not validate the appropriateness of access against business roles.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.