Question 225 of 509

Governance and Management of IT →hardMultiple ChoiceObjective-mapped

Quick Answer

The answer is to implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews. This is correct because an IGA tool directly addresses the root causes of orphaned accounts and provisioning delays by automating the entire user lifecycle—triggering account creation from HR events like new hires and immediate deactivation upon termination, while also enforcing scheduled, auditable access reviews with certification workflows. On the CISA exam, this scenario tests your understanding of automated access management as a core control for compliance with regulations like GDPR and SOX, often appearing as a distractor against manual recertification or standalone provisioning tools. A common trap is choosing a partial solution, such as only automating provisioning without de-provisioning, which fails to eliminate unused accounts. Memory tip: think “IGA = HR trigger + auto de-provision + enforced review” to cover security, productivity, and compliance in one solution.

CISA Governance and Management of IT Practice Question

This CISA practice question tests your understanding of governance and management of it. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

You are the IT governance lead at a multinational corporation with a complex IT environment spanning multiple business units. The company has recently experienced a series of minor security incidents where unauthorized access was gained through unused user accounts that were not disabled after employees left the organization. Additionally, there have been delays in provisioning access for new hires, leading to productivity losses. The IT department currently uses a manual process for access management, with each business unit maintaining its own user lists. The company has a policy that requires access reviews every quarter, but these are often missed or performed superficially. The CIO has asked you to recommend a solution that addresses these issues while ensuring compliance with regulations such as GDPR and SOX. Which of the following is the BEST course of action?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

Question 1hardmultiple choice

Read the full NAT/PAT explanation →

A
Require each business unit to submit monthly reports of active users to IT, which will then manually disable accounts not on the list.
Why wrong: This still relies on manual processes and business unit cooperation, which has proven ineffective.
B
Develop a new policy that mandates quarterly access reviews and disciplinary action for non-compliance.
Why wrong: Policy alone does not enforce execution; the existing policy is already being ignored.
C
Increase the frequency of access reviews to monthly and assign a dedicated team to perform them.
Why wrong: While more frequent reviews may help, without automation, the manual effort may still lead to delays and errors.
D
Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews.
Automation addresses the root causes: timely de-provisioning, consistent reviews, and compliance.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews.

Option D is correct because implementing an Identity Governance and Administration (IGA) tool directly addresses the root causes: manual, decentralized access management and lack of automated de-provisioning. IGA integrates with HR systems (e.g., Workday, SAP SuccessFactors) to trigger automatic account creation for new hires and immediate deactivation upon termination, eliminating orphaned accounts. It also enforces scheduled, auditable access reviews with certification workflows, ensuring compliance with GDPR (right to erasure, data minimization) and SOX (segregation of duties, access controls). This automated approach resolves both the security incidents from unused accounts and the productivity losses from delayed provisioning.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Require each business unit to submit monthly reports of active users to IT, which will then manually disable accounts not on the list.
Why it's wrong here
This still relies on manual processes and business unit cooperation, which has proven ineffective.
✗
Develop a new policy that mandates quarterly access reviews and disciplinary action for non-compliance.
Why it's wrong here
Policy alone does not enforce execution; the existing policy is already being ignored.
✗
Increase the frequency of access reviews to monthly and assign a dedicated team to perform them.
Why it's wrong here
While more frequent reviews may help, without automation, the manual effort may still lead to delays and errors.
✓
Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews.
Why this is correct
Automation addresses the root causes: timely de-provisioning, consistent reviews, and compliance.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often choose options that increase manual oversight (like monthly reports or dedicated teams) because they seem practical, but the CISA exam emphasizes automated, integrated solutions (IGA) as the only sustainable way to achieve compliance and security at scale in complex, multi-unit environments.

Detailed technical explanation

How to think about this question

IGA tools like SailPoint, Okera, or Microsoft Identity Manager use SCIM (System for Cross-domain Identity Management) and LDAP connectors to synchronize identity data from authoritative sources (HRIS) into target systems (Active Directory, cloud apps). They enforce role-based access control (RBAC) and automated provisioning via event-driven triggers (e.g., employee termination event in HRIS triggers a PowerShell script or REST API call to disable the account in Azure AD within minutes). Access reviews are automated with certification campaigns that send reminders, enforce attestation deadlines, and generate audit trails for SOX and GDPR compliance, including proof of data erasure.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related CISA practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Governance and Management of IT practice questions

Practise CISA questions linked to Governance and Management of IT.

Information Systems Acquisition, Development and Implementation practice questions

Practise CISA questions linked to Information Systems Acquisition, Development and Implementation.

Information Systems Operations and Business Resilience practice questions

Practise CISA questions linked to Information Systems Operations and Business Resilience.

Protection of Information Assets practice questions

Practise CISA questions linked to Protection of Information Assets.

Information System Auditing Process practice questions

Practise CISA questions linked to Information System Auditing Process.

CISA fundamentals practice questions

Practise CISA questions linked to CISA fundamentals.

CISA scenario practice questions

Practise CISA questions linked to CISA scenario.

CISA troubleshooting practice questions

Practise CISA questions linked to CISA troubleshooting.

Practice this exam

Start a free CISA practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CISA practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CISA question test?

Governance and Management of IT — This question tests Governance and Management of IT — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews. — Option D is correct because implementing an Identity Governance and Administration (IGA) tool directly addresses the root causes: manual, decentralized access management and lack of automated de-provisioning. IGA integrates with HR systems (e.g., Workday, SAP SuccessFactors) to trigger automatic account creation for new hires and immediate deactivation upon termination, eliminating orphaned accounts. It also enforces scheduled, auditable access reviews with certification workflows, ensuring compliance with GDPR (right to erasure, data minimization) and SOX (segregation of duties, access controls). This automated approach resolves both the security incidents from unused accounts and the productivity losses from delayed provisioning.

What should I do if I get this CISA question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.