easyMultiple Choice
CISM Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` Policy: Access Control Effective Date: 2024-01-01 Review Date: 2024-12-31 Owner: CISO Scope: All employees and contractors Statement: Access to internal systems must be granted based on the principle of least privilege. Exceptions must be approved by the data owner and documented. ```
Refer to the exhibit. A security manager notices that several contractors have been granted access to a financial system without documented exceptions. Based on the policy, what is the most likely governance deficiency?
⚠ Common exam trap
The trap here is that candidates may focus on who approved the access (Option B) rather than recognizing that the core governance deficiency is the lack of documentation for approved exceptions, which is a distinct control requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lack of documentation for approved exceptions.
The policy requires documented exceptions for any access granted outside standard provisioning rules. The security manager observed that contractors had access without such documentation, which directly violates the governance requirement for maintaining an audit trail of approved exceptions. Without this documentation, the organization cannot demonstrate that access was properly authorized, creating a compliance gap.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy does not specify quarterly review of access rights.
Why it's wrong here
Quarterly review frequency is a recertification control; the stem describes access granted without documented exceptions, so the gap is exception documentation, not review cadence. It is tempting because periodic reviews are real governance requirements, and would be correct if reviews were skipped.
- ✗
The data owner did not approve the exceptions.
Why it's wrong here
The data owner typically approves access, but the stem's deficiency is the absence of documented exceptions, not a missing approval signature. It is tempting because owner authorisation is a genuine control, and would be the answer if exceptions existed but lacked owner sign-off.
- ✗
Contractors should not have any access to financial systems.
Why it's wrong here
A blanket prohibition on contractor access misreads the policy, which permits access where documented exceptions exist; the deficiency is the missing documentation, not the contractor status itself. It is tempting as a strict security stance, and would be correct only if the policy explicitly barred all contractor access.
- ✓
Lack of documentation for approved exceptions.
Why this is correct
Contractors holding financial system access without documented exceptions means the exception approval process is not being evidenced, so approvals cannot be audited or reviewed. The deficiency is the missing documentation trail, not the access itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.