Are you studying for the CEH or CISSP certifications?
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
During an access control review an IT auditor identifies that settings for passwords controls are less restrictive for IT developers than for business users. What is the most effective action that the IT auditor should take?
Document the observation as an exception.
Recommend that all password configuration settings are standardized.
Determine whether this is a policy violation and document it.
Recommend that logs of IT developer access are reviewed quarterly.
If the policy documents the purpose and approval for different procedures, then the auditor only needs to document observations and tests as to whether the procedures are followed. This condition would not be considered an exception if procedures are followed according to approved policies. There may be valid reasons for these settings to be different; therefore, the auditor would not normally recommend changes before researching company policies and procedures. While reviewing logs may be a good compensating control, the more important course of action would be to determine if policies are being followed.
Study thousands of practice questions that organized by skills and ranked by difficulty.
Create a tailored training plan based on the knowledge you already possess.
Know when you’re ready for the high-stakes exam. Have the confidence that you will pass on your first attempt.