How can login-control scenarios show up on CIA Part 3?

Question

AcadiFi · Accepted Answer

Frame this as a access-control reasoning question. The CIA exam is usually asking for the professional sequence, not the loudest r...

Unlock with Scholar — $19/month

Get full access to all Q&A answers, practice question explanations, and progress tracking.

Start 7-Day Free Trial Compare Plans

No credit card required for free trial

At fictional Harbor Stone Services reviews access to a finance application. The auditor considers authentication strength, user provisioning, privileged access, periodic review, termination removal, and monitoring of failed login attempts. The internal auditor should identify the objective first, then decide what evidence is relevant and sufficient. If the fact pattern involves audit management, the same discipline applies: clarify authority, competence, resources, and stakeholder expectations before choosing a response.

The common trap is thinking a password rule alone proves access is controlled. A weaker answer either jumps to a conclusion without evidence or treats the issue as a personality problem. A stronger answer names the risk, ties it to criteria, gathers evidence, and communicates the result to the right level of management or the board.

For exam purposes, state that good access control combines authentication, authorization, monitoring, and timely removal. Then apply the facts: what is known, what is missing, what procedure is appropriate, and what communication or follow-up is needed. That pattern works across Part 1 governance questions, Part 2 engagement-performance questions, and Part 3 business or technology scenarios. Practice more in our CIA Part 3 question bank.

How can login-control scenarios show up on CIA Part 3?

Master Part 3 with our CIA Course

Related Questions

Practice Questions