hardMultiple ChoiceObjective-mapped

CISA Practice Question: Based on the exhibit, the IS auditor is reviewing…

Exhibit

Refer to the exhibit.
```
Access Control List for /payroll:
User: jdoe (Read, Write)
User: asmith (Read)
Group: HR_Managers (Full Control)
Group: Payroll_Clerks (Read, Write)
Group: Internal_Audit (Read)
Effective permissions for user jdoe: Read, Write
```

Based on the exhibit, the IS auditor is reviewing access to the payroll folder. Which of the following is the MOST significant finding?

⚠ Common exam trap

The trap here is that candidates may focus on individual permission levels (Read vs. Full Control) rather than the cumulative effect of overlapping group memberships, which is the more critical security concern in access control auditing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Potential excessive privileges for user jdoe due to overlapping permissions

The most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Internal_Audit group has Read access to payroll data
Why it's wrong here
Read access for auditors is generally appropriate.
✗
User asmith has only Read access to payroll
Why it's wrong here
Read access may be appropriate for their role.
✗
HR_Managers group has Full Control over payroll
Why it's wrong here
Full Control may be necessary for HR managers.
✓
Potential excessive privileges for user jdoe due to overlapping permissions
Why this is correct
Overlapping permissions may grant unintended access.

Go deeper

CISA Practice Question: Based on the exhibit, the IS auditor is reviewing…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question