hardMultiple ChoiceObjective-mapped
CRISC Practice Question: Based on the exhibit, which control is most…
Exhibit
Refer to the exhibit. Control Self-Assessment (CSA) Results for Access Management: - User access recertification completed within 90 days: 92% (target: 95%) - Terminated employee accounts disabled within 24 hours: 98% (target: 99%) - Privileged access reviews completed quarterly: 100% (target: 100%) - Segregation of duties conflicts resolved within 30 days: 85% (target: 90%)
Based on the exhibit, which control is most critical to address first to reduce the risk of unauthorized access?
⚠ Common exam trap
ISACA often tests the misconception that reactive controls like access reviews or account disabling are more critical than proactive controls like SoD conflict resolution, but the question specifically targets the root cause of unauthorized access—accumulation of incompatible privileges—which only timeliness of SoD resolution can prevent in real time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Segregation of duties conflict resolution timeliness.
Segregation of duties (SoD) conflict resolution timeliness directly addresses the risk that unresolved conflicts could allow a single user to execute unauthorized actions across multiple systems. If SoD conflicts are not resolved promptly, a user might retain incompatible roles (e.g., both creating and approving purchase orders), enabling fraud or unauthorized access without detection. This control is foundational because it prevents the accumulation of excessive privileges that bypass other access controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Segregation of duties conflict resolution timeliness.
Why this is correct
At 85% vs target 90%, unresolved SoD conflicts pose a significant risk of unauthorized transactions.
- ✗
Privileged access review frequency.
Why it's wrong here
This control is fully effective.
- ✗
User access recertification completion rate.
Why it's wrong here
The gap is only 3%, less critical than SoD.
- ✗
Terminated employee account disabling timeliness.
Why it's wrong here
At 98%, this is close to the target and not the most critical.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.