CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the privileged access management (PAM) process. Which TWO of the following are the MOST effective controls to prevent misuse of privileged accounts?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session recording and monitoring of privileged activities
Session recording and monitoring (A) allows audit and review of all actions, deterring misuse. Just-in-time (JIT) privileged access (B) grants temporary permissions only when needed, reducing the attack surface. Quarterly review (C) is detective, not preventive. Generic accounts assigned to multiple users (D) increase risk of unauthorized use and lack accountability. Shared passwords for emergency access (E) also reduce accountability and can be misused.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Session recording and monitoring of privileged activities
Why this is correct
Provides accountability and deterrence.
- ✓
Implementation of just-in-time (JIT) privileged access
Why this is correct
JIT access limits the duration of elevated privileges.
- ✗
Quarterly review of privileged account access
Why it's wrong here
Reviews are detective, not preventive.
- ✗
Assignment of generic administrative accounts to multiple users
Why it's wrong here
Generic accounts lack accountability.
- ✗
Use of shared passwords for emergency access
Why it's wrong here
Shared passwords reduce accountability and increase risk.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.