hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: The security administrator for a mid-sized…
You are the security administrator for a mid-sized e-commerce company. The company uses a Linux-based web server running Apache, with a MySQL database backend. User authentication is handled via LDAP. Recently, the security team discovered that a former employee's account was used to access the customer database two weeks after the employee was terminated. The account had not been disabled. The database contains personally identifiable information (PII). The incident was traced to an internal IP address from the marketing department. The marketing department's network segment is not segregated from the database server. Additionally, the database server's firewall rules allow any internal IP to connect to the MySQL port (3306). The company has a written policy that accounts must be disabled within 24 hours of termination, but the HR department did not notify IT in a timely manner. Which combination of controls would BEST prevent a recurrence of this incident?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate HR system with identity management to automatically disable accounts upon termination, and implement network segmentation with a firewall that restricts database access to only authorized application servers.
The best combination because it addresses both root causes: the account not being disabled (by integrating HR with identity management for automatic deprovisioning) and the lack of network segmentation (by restricting database access to only authorized application servers via firewall). Option B only addresses network issues, not account management. Option A is monitoring, not prevention. Option D adds complexity but does not directly fix the broken termination process or network segregation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a database activity monitoring (DAM) solution that alerts on unusual queries, and require strong passwords for all database accounts.
Why it's wrong here
Monitoring detects but does not prevent; strong passwords don't stop terminated accounts.
- ✗
Implement a firewall rule to block all traffic from the marketing network to the database server, and require all database access to go through a bastion host.
Why it's wrong here
This only addresses network segregation, not the account disablement issue.
- ✓
Integrate HR system with identity management to automatically disable accounts upon termination, and implement network segmentation with a firewall that restricts database access to only authorized application servers.
Why this is correct
Automated account disablement prevents use of terminated accounts; segmentation limits lateral movement.
- ✗
Implement two-factor authentication for all database access, and conduct quarterly access reviews.
Why it's wrong here
2FA helps but does not prevent if account is still active; quarterly reviews are too infrequent.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.