easyMultiple ChoiceObjective-mapped
CISM Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` Policy: Access Control Effective Date: 2024-01-01 Review Date: 2024-12-31 Owner: CISO Scope: All employees and contractors Statement: Access to internal systems must be granted based on the principle of least privilege. Exceptions must be approved by the data owner and documented. ```
Refer to the exhibit. A security manager notices that several contractors have been granted access to a financial system without documented exceptions. Based on the policy, what is the most likely governance deficiency?
⚠ Common exam trap
The trap here is that candidates may focus on who approved the access (Option B) rather than recognizing that the core governance deficiency is the lack of documentation for approved exceptions, which is a distinct control requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lack of documentation for approved exceptions.
The policy requires documented exceptions for any access granted outside standard provisioning rules. The security manager observed that contractors had access without such documentation, which directly violates the governance requirement for maintaining an audit trail of approved exceptions. Without this documentation, the organization cannot demonstrate that access was properly authorized, creating a compliance gap.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy does not specify quarterly review of access rights.
Why it's wrong here
The policy does not mention review frequency; this is not the immediate issue.
- ✗
The data owner did not approve the exceptions.
Why it's wrong here
The scenario does not indicate whether approval was obtained; the focus is on documentation.
- ✗
Contractors should not have any access to financial systems.
Why it's wrong here
The policy allows exceptions; contractors may have access if properly documented.
- ✓
Lack of documentation for approved exceptions.
Why this is correct
The policy requires documented exceptions, which are missing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.