The answer is the potential for excessive privileges due to overlapping permissions, specifically for user jdoe. This is the most significant finding because in Windows NTFS, effective permissions are cumulative—they combine all allowed permissions from every group a user belongs to, minus any explicit denies. When a user like jdoe holds memberships in both HR_Managers and Payroll_Admin, the overlapping group memberships can unintentionally grant broader access than any single role intended, directly violating the principle of least privilege. On the CISA exam, this scenario tests your understanding of identity and access management (IAM) controls, particularly how auditors must identify risks from aggregated permissions rather than isolated group settings. A common trap is focusing on a single group’s permissions while ignoring the cumulative effect of multiple memberships. Remember the memory tip: “Overlap equals over-access”—when group memberships overlap, always check the sum of effective rights for excessive privileges.
CISA Information System Auditing Process Practice Question
This CISA practice question tests your understanding of information system auditing process. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```
Access Control List for /payroll:
User: jdoe (Read, Write)
User: asmith (Read)
Group: HR_Managers (Full Control)
Group: Payroll_Clerks (Read, Write)
Group: Internal_Audit (Read)
Effective permissions for user jdoe: Read, Write
```
Based on the exhibit, the IS auditor is reviewing access to the payroll folder. Which of the following is the MOST significant finding?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Potential excessive privileges for user jdoe due to overlapping permissions
Option D is the most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Internal_Audit group has Read access to payroll data
Why it's wrong here
Read access for auditors is generally appropriate.
✗
User asmith has only Read access to payroll
Why it's wrong here
Read access may be appropriate for their role.
✗
HR_Managers group has Full Control over payroll
Why it's wrong here
Full Control may be necessary for HR managers.
✓
Potential excessive privileges for user jdoe due to overlapping permissions
Why this is correct
Overlapping permissions may grant unintended access.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may focus on individual permission levels (Read vs. Full Control) rather than the cumulative effect of overlapping group memberships, which is the more critical security concern in access control auditing.
Detailed technical explanation
How to think about this question
In Windows environments, effective permissions are calculated by combining all allow permissions from a user's direct assignments and group memberships, with deny permissions overriding allows. Overlapping group memberships can create a 'permission explosion' where a user inadvertently gains Full Control or Modify rights through cumulative group permissions, even if each individual group's permissions seem limited. Real-world scenarios often involve nested groups (e.g., Domain Local, Global, Universal) where a user inherits permissions from multiple Active Directory groups, making it difficult to audit effective access without tools like icacls or AccessChk.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information System Auditing Process — This question tests Information System Auditing Process — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Potential excessive privileges for user jdoe due to overlapping permissions — Option D is the most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.