CGRC Security Authorization Process Quiz

1. Which of the following is NOT a component of the authorization process?

Authentication

Access request submission

Budget forecasting

Access approval and provisioning

2. In the CGRC authorization process, what should happen when an employee changes roles?

No access changes are needed

Old access rights are immediately revoked and new rights are provisioned

Access rights accumulate indefinitely

Manual review is permanently suspended

3. What is a critical component when designing authorization policies for regulated industries?

Ignoring compliance requirements

Alignment with applicable regulations and compliance standards

Eliminating all access controls

Removing audit capabilities

4. Which statement best describes the relationship between authentication and authorization?

They are identical processes

Authentication verifies identity; authorization grants access rights

Authorization happens before authentication

Only authentication is required for security

5. In CGRC, what is the purpose of logging and monitoring authorization activities?

To slow down system performance

To create an audit trail and detect unauthorized access attempts

To eliminate user productivity

To increase storage requirements unnecessarily

6. What does a privileged access management (PAM) system primarily protect?

User email accounts

Administrative and elevated access credentials

General office supplies

Marketing campaigns

7. Which authorization model is most flexible for complex environments with many conditions?

Discretionary access control (DAC)

Mandatory access control (MAC)

Attribute-based access control (ABAC)

List-based access control

8. What is the primary risk of not implementing proper authorization controls?

Increased employee satisfaction

Unauthorized access to sensitive data and systems

Reduced IT complexity

Lower compliance costs

9. In CGRC governance, who typically approves access requests?

IT staff exclusively

Business managers and data owners

External auditors only

System users themselves

10. What does segregation of duties achieve in authorization?

It increases operational costs only

It prevents any single individual from controlling critical processes

It eliminates the need for managers

It removes accountability from systems

11. What is the primary purpose of the authorization process in CGRC?

To grant users access rights based on verified identity and business need

To encrypt all data in transit

To monitor network traffic only

To eliminate all security risks

12. What is the purpose of periodic access reviews in authorization management?

To increase user frustration

To identify and remove unnecessary or inappropriate access rights

To reduce system performance

To eliminate compliance requirements

13. Which compliance framework emphasizes the importance of access control and authorization?

COSO ERM only

COBIT, ISO 27001, and SOC 2

Marketing standards exclusively

Facility management guidelines

14. In CGRC, what does the authorization matrix document?

Network topology diagrams

Mapping of users, roles, and permissions

Incident response procedures

Disaster recovery timelines

15. What is the primary benefit of implementing multi-factor authentication (MFA)?

It eliminates the need for passwords

It reduces authorization overhead

It strengthens identity verification beyond single credentials

It removes the need for access reviews

16. Which control type prevents unauthorized actions after access is granted?

Preventive control

Detective control

Corrective control

Compensating control

17. In the authorization process, what is the purpose of an access request review?

To delay all system deployments

To verify business justification and compliance with policies

To eliminate IT staff responsibilities

To increase administrative overhead unnecessarily

18. What does attribute-based access control (ABAC) evaluate to grant access?

Only user identity

User attributes, resource attributes, and environmental conditions

Password strength alone

Organizational chart hierarchy

19. Role-based access control (RBAC) assigns permissions based on what?

User seniority and tenure

Departmental budget allocation

User roles within the organization

Geographic location of the user

20. Which principle ensures that users receive only the minimum access needed to perform their job?

Defense in depth

Principle of least privilege

Zero trust architecture

Separation of duties