712-50 Question 249
Single answerAccess Control (6 questions)A global manufacturing company has grown through acquisitions and now operates multiple business units with separate IT teams. During an internal audit, the CISO learns that access to finance, HR, and engineering systems is granted differently in each region, terminated employees sometimes retain access for days, and privileged access reviews are performed inconsistently. The board has asked for a program that reduces unauthorized access risk while supporting rapid onboarding during future acquisitions. Which action should the CISO prioritize FIRST to create a scalable and effective access control program?
- A
Implement a centralized identity governance and administration (IGA) model with defined joiner-mover-leaver processes, role-based access standards, and periodic access recertification across business units
- B
Require all users to change passwords every 30 days and increase minimum password length for all systems, including legacy applications
- C
Deploy biometric authentication for all privileged administrators before addressing account provisioning and deprovisioning inconsistencies
- D
Conduct annual security awareness training focused on acceptable use, phishing, and password hygiene for all employees
Show answer and explanation
Correct answer: A
Explanation
The best first action is to establish centralized identity governance and administration with standardized joiner-mover-leaver processes, role-based access standards, and periodic recertification. In a post-acquisition environment, inconsistent provisioning models and delayed deprovisioning are classic indicators of weak identity lifecycle governance. A CISO operating at the CCISO level should prioritize programmatic, scalable controls that support business growth while reducing unauthorized access risk. This aligns with widely accepted practices from NIST guidance on access control and account management, including least privilege, separation of duties, timely account provisioning/deprovisioning, and periodic review of access rights. Concepts reflected in NIST SP 800-53 controls such as AC-2 (Account Management), AC-3 (Access Enforcement), AC-5 (Separation of Duties), and AC-6 (Least Privilege) are especially relevant. Password policy changes, stronger authentication for privileged users, and awareness training can all be valuable supporting measures, but they do not address the fundamental governance and lifecycle management gaps identified in the scenario.
- A. Correct.
Correct. The scenario highlights systemic access control governance failures: inconsistent provisioning, delayed deprovisioning, and uneven privilege reviews across acquired entities. A centralized IGA approach directly addresses these root causes by standardizing joiner-mover-leaver processes, formalizing role-based access, and enforcing recurring certification of access rights. This is the most effective first step for scalable governance in a multi-business-unit environment and aligns with least privilege and separation of duties principles.
- B. Incorrect.
Incorrect. Stronger password requirements may improve one aspect of authentication, but they do not solve the core issues described: inconsistent authorization decisions, delayed revocation for terminated staff, and fragmented privileged access review processes. This option reflects a common misconception of treating access control weaknesses primarily as a password problem.
- C. Incorrect.
Incorrect. Strengthening privileged administrator authentication can reduce risk for a small subset of accounts, but it does not address enterprise-wide lifecycle management failures affecting all users and systems. In this scenario, deprovisioning delays and inconsistent entitlement management create broader organizational risk. Biometric controls may be useful later, but they are not the first priority.
- D. Incorrect.
Incorrect. Security awareness training is beneficial, but it is an administrative control that does not remediate broken account lifecycle governance or inconsistent entitlement assignment. Someone might choose this because user behavior affects security outcomes, yet the audit findings point to process and control design gaps rather than lack of awareness.