Isaca Updated CRISC Exam Questions and Answers by lia

The best method to ensure a terminated employee’s access to IT systems is revoked upon departure from the organization is to have the human resources (HR) system automatically revoke system access, which is a process that involves integrating the HR system with the IT system, and triggering the removal of access rights for the employee as soon as the termination is recorded in the HR system12.

This method is the best because it provides the most timely, accurate, and consistent way of revoking access, and reduces the risk of human error, oversight, or delay that may occur in manual or semi-automated processes12.

This method is also the best because it enhances the security and compliance of the organization, and prevents the terminated employee from accessing or compromising the IT systems or data after departure12.

The other options are not the best methods, but rather alternative or supplementary methods that may have some limitations or drawbacks. For example:

Login attempts are reconciled to a list of terminated employees is a method that involves monitoring and verifying the login activities of the IT systems, and comparing them with a list of terminated employees to identify and block any unauthorized access attempts34. However, this method is not the best because it is reactive rather than proactive, and may not prevent the terminated employee from accessing the IT systems before the reconciliation is done34.

A list of terminated employees is generated for reconciliation against current IT access is a method that involves creating and maintaining a list of terminated employees, and checking it against the current IT access rights to identify and remove any access that is no longer needed34. However, this method is not the best because it is manual and labor-intensive, and may introduce errors or inconsistencies in the list or the access rights34.

A process to remove employee access during the exit interview is implemented is a method that involves conducting an exit interview with the terminated employee, and revoking the employee’s access to the IT systems during or immediately after the interview34. However, this method is not the best because it depends on the availability and cooperation of the terminated employee, and may not cover all the IT systems or access rights that the employee had34. References =

1: IT Involvement in Employee Termination, A Checklist3

2: Best Practices to Ensure Departing Employees Retain No Access5

3: User Termination Best Practices - IT Security - Spiceworks2

4: IT Security for Employee Termination - Policies, Checklists, Templates - Endsight1

CRISC emphasizes thatthe effectiveness of policies depends on enforcement. Even well-written, standards-aligned policies have no value if they are not consistently followed. Lack of enforcement allows inconsistent behavior, increases control breakdowns, and undermines risk governance. Alignment with global standards is beneficial but not essential for effectiveness. A missing repository creates administrative inefficiencies but does not directly increase risk. Higher cost is a business consideration but not a risk governance concern. Insufficient enforcement is the most critical issue because it directly leads to risk exposure and control failure.

Implementing automated log monitoring is the best control to detect an advanced persistent threat (APT), which is a stealthy and continuous attack on a target network or system. Automated log monitoring can help to identify anomalous or suspicious activities, such as unusual network traffic, unauthorized access attempts, or data exfiltration, that may indicate the presence of an APT. Utilizing antivirus systems and firewalls, conducting regular penetration tests, and monitoring social media activities are controls that help to prevent or mitigate APTs, but not to detect them. References = Most Asked CRISC Exam Questions and Answers - The Knowledge Academy, question 200.

The correct answer isBbecause technical controls affecting access permissions should be implemented according toseparation of duties. Access permissions must be structured so that no single individual has incompatible responsibilities that could enable unauthorized activity, fraud, or unapproved changes. This is a core principle of access control governance and control design.

The other options are less appropriate:

A. Integration testing requirementsrelate to testing system interactions, not the primary basis for assigning access permissions.

C. Configuration baselinesare important for standard settings, but access authorization must first align with role separation and accountability.

D. Contingency scenariosare related to continuity and recovery, not normal access permission design.

Exact Extracts supporting the answer:

“The PRIMARY reason that an enterprise would establish segregation of duties controls is to prevent errors or fraudulent activity on high-risk transactions.”

“The MOST effective control to prevent segregation of duties violations is implementing role-based access.”

“To ensure that developers do not have access to implement changes to production applications an enterprise must have segregation of duties between application development and operations.”

“The control a risk practitioner would recommend is segregation of duties” when personnel can both change system configuration settings and modify logs.

These extracts show that access permissions and technical access controls should be aligned withseparation of dutiesto prevent misuse and reduce risk.

===========