mediumMultiple SelectObjective-mapped
CCSP Practice Question: A cloud service provider (CSP) is undergoing a…
A cloud service provider (CSP) is undergoing a SOC 2 Type II audit. The auditor reviews the CSP's access control policies and identifies that user access reviews are performed quarterly. However, the auditor notes that there is no automated termination of access for terminated employees. Which TWO of the following control objectives are likely to be non-compliant based on this finding?
⚠ Common exam trap
ISC2 often tests the distinction between logical access controls (which include user account management, authentication, and authorization) and other control domains like change management or physical security, leading candidates to overlook that the finding directly impacts logical access controls (C) and least privilege (B) simultaneously.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege principle
The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change management procedures
Why it's wrong here
Change management is not directly impacted by access termination.
- ✓
Least privilege principle
Why this is correct
Failure to revoke access violates least privilege.
- ✓
Logical access controls
Why this is correct
Logical access controls include timely revocation of access upon termination.
- ✗
Encryption of data at rest
Why it's wrong here
Encryption is not directly related to access termination.
- ✗
Physical access controls
Why it's wrong here
Physical access controls are separate from logical access.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.