Access Control Exception Analysis Quiz

1. When reviewing an exception for privileged account access, which CompTIA Security+ principle is most relevant?

Defense in depth

Least privilege

Data classification

Network segmentation

2. An access exception request is submitted for a sensitive system with no documented business case. A security analyst should:

Approve to maintain user satisfaction

Reject and require detailed justification

Grant temporary access pending documentation

Escalate to executive leadership only

3. Which documentation element helps prove that an access exception was properly authorized during a security audit?

User's personal email confirmation

Formal approval records with signatures or digital timestamps

Verbal approval from IT staff

System auto-generated access logs

4. An access exception includes both read and write permissions when only read is needed. This is an example of violating which principle?

Separation of duties

Need-to-know

Least privilege

Defense in depth

5. When reviewing exceptions for a departing employee, which principle should guide the access removal timeline?

Remove access immediately upon notification

Coordinate removal with IT and management

Allow access during the notice period

Delay removal for two weeks

6. A security analyst identifies that an exception violates the organization's access control policy. What is the appropriate escalation path?

Ignore the violation if the user is senior

Report to compliance and management for remediation

Remove access without notification

Request the policy be changed instead

7. When an access exception is terminated, what action is essential to prevent unauthorized access?

Send a reminder email to the user

Revoke credentials and update access lists

Document the termination date only

Wait for the user to request removal

8. An exception request is denied due to insufficient business justification. Which stakeholder should provide clarification?

The security analyst

The requestor and their manager

The system administrator

The IT help desk

9. How frequently should standing access control exceptions be re-evaluated for continued necessity?

Only when the user requests changes

Annually or per organizational policy

Never, once approved they are permanent

Every five years minimum

10. An access exception is requested for a system that handles personally identifiable information (PII). What additional review step should be mandatory?

Cost-benefit analysis only

Compliance and privacy impact assessment

User satisfaction survey

System load testing

11. A contractor requests access to a critical database for a short-term project. Which control type should be reviewed first when analyzing this exception?

Detective controls

Preventive controls

Compensating controls

Corrective controls

12. A manager requests an access exception for a new employee before identity verification is complete. How should a security analyst respond?

Approve it based on manager authority

Defer approval until verification is complete

Grant temporary access with no restrictions

Deny the request permanently

13. Which log type is most valuable for auditing access control exceptions after they've been granted?

Application performance logs

Access and authentication logs

System backup logs

Network traffic logs

14. An access exception review reveals scope creep where permissions exceed the stated business need. What should be the analyst's recommendation?

Accept the broader access for convenience

Reduce permissions to match documented requirements

Increase monitoring to compensate

Request additional budget for access management

15. When analyzing an exception for a third-party vendor, which control should be prioritized?

Monitoring and logging of vendor activities

Unlimited access to all systems

Shared credentials with internal staff

No documentation requirements

16. Role-based access control (RBAC) exceptions should be reviewed against which baseline?

User's hire date

Defined role responsibilities and job function

System administrator preferences

User's salary level

17. A security analyst discovers an access exception that lacks proper authorization documentation. What is the appropriate next step?

Immediately remove all access

Escalate for investigation and retroactive approval

Allow access pending future documentation

Archive the exception without action

18. Which authentication factor should be verified before granting an access control exception to a remote employee?

Single sign-on credentials only

Multi-factor authentication

Password strength only

Email verification only

19. An employee needs elevated privileges temporarily. What is the primary purpose of setting an expiration date on this exception?

To reduce storage requirements

To ensure least privilege principles are maintained

To notify the user of upcoming changes

To comply with password policies

20. When documenting an access control exception, which element is most critical for audit compliance?

User's department name

Business justification and approval chain

System uptime during approval

Administrator's personal notes

Security Analyst Reviewing an Access Control Exception Quiz