mediumMultiple Choice
Auditor's Response to Unauthorized Access
During an audit of a cloud service provider, the IS auditor finds that the provider's datacenter access logs show multiple successful logins by an employee during non-business hours over several weeks. The employee works in the sales department. What should the auditor do first?
⚠ Common exam trap
Test-takers frequently confuse the auditor's role with that of a security incident responder, leading them to choose immediate disabling or escalation without first performing due diligence through inquiry and evidence gathering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discuss with the employee's supervisor to verify if access was authorized.
The IS auditor's first priority is to gather evidence and understand the context before taking action. The employee's sales role and non-business hours access may be legitimate (e.g., supporting a client in a different time zone). Discussing with the supervisor is a standard audit procedure to verify authorization, aligning with ISACA's audit evidence collection and due professional care.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recommend disabling the employee's access immediately.
Why it's wrong here
Auditors gather and evaluate evidence before recommending remediation; disabling access presumes the logins are unauthorised, yet the sales employee may legitimately work across time zones or hold approved after-hours duties. Immediate revocation is a containment action reserved for confirmed incidents, and would be the correct first step once investigation substantiates malicious activity.
- ✗
Review the access rights policy and compare with actual access.
Why it's wrong here
Reviewing the policy establishes whether the logins breached authorisation, but the auditor must first determine whether the activity is anomalous by examining the actual access records and the employee's duties. Policy review is correct later, when assessing whether controls and approvals were adequate.
- ✓
Discuss with the employee's supervisor to verify if access was authorized.
Why this is correct
Verifying authorisation with the supervisor establishes whether the after-hours sales-department logins were legitimate business activity before escalating. This satisfies the audit constraint of confirming intent first, since logs alone cannot distinguish approved remote work from compromised credentials or insider misuse.
- ✗
Report the finding immediately to senior management.
Why it's wrong here
Reporting to senior management before validating the logins against the employee's role and access rights risks escalating a false positive; the auditor must first gather sufficient evidence. Immediate escalation is tempting because unusual after-hours access may indicate a breach, and it is correct once the finding is substantiated.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.