mediumMultiple Choice

CISA Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

Exhibit:
Output from a database audit log:
Timestamp: 2024-03-15 14:23:45
User: john.doe
Action: SELECT
Table: Employee_salaries
Rows: 500
Source_IP: 10.0.0.15
Query: SELECT salary FROM Employee_salaries WHERE department = 'Executive'

Refer to the exhibit. An auditor notices this log entry during a review. The user john.doe does not have a legitimate business need to access executive salaries. Which of the following is the MOST likely control failure?

⚠ Common exam trap

The trap here is that candidates may focus on the log entry's existence and incorrectly assume audit logging is the issue (Option B), when in fact the log proves logging works, and the real failure is the lack of preventive access controls that should have blocked the query before it executed.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Inadequate access controls or role-based permissions

The log entry shows user john.doe successfully accessed executive salary data via a SELECT query. Since the user has no legitimate business need for this data, the most likely control failure is inadequate access controls or role-based permissions (RBAC). Proper RBAC would restrict access to sensitive columns or tables based on job function, preventing unauthorized queries regardless of other controls.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Database firewall misconfiguration
Why it's wrong here
A database firewall filters network traffic to database ports; it cannot grant or deny row-level access to salary records, so it is not the control that failed. It tempts because firewalls are access controls, and it would be correct if the log showed unauthorised external connections rather than an authorised user reading restricted data.
✗
Audit logging is not enabled
Why it's wrong here
The log entry exists and was reviewed, so audit logging is functioning; the failure is that access was permitted at all. It tempts because missing logs are a common audit finding, and it would be correct if the auditor could not determine who accessed the salary records.
✓
Inadequate access controls or role-based permissions
Why this is correct
Role-based permissions should restrict salary records to HR and payroll roles. john.doe accessing executive salaries indicates entitlements were granted too broadly or not reviewed, so least privilege and segregation were not enforced. The log shows authorisation succeeded when it should have been denied, confirming an access control failure.
✗
Lack of encryption at rest
Why it's wrong here
Encryption at rest protects stored data from disclosure if media is stolen; it does not restrict which users may query salary records, so it cannot explain john.doe's access. It tempts because it is a data-protection control, and it would be correct if the log showed exfiltration of an unencrypted database file.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper

CISA Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Access Control Model Comparison

Related to this question