CISSP: Certified Information Systems Security Professional

Question

During a quarterly system-access review, an active privileged account was identified on the production system that had not existed during the previous review. The account was created one hour after that prior access review. Which option is the BEST way to reduce overall risk in addition to quarterly access reviews?

Explanation

Risk-based alerts provide timely, continuous detection of high-risk account events during the interval between periodic reviews, such as an unexpected privileged-account creation or atypical privileged-account activity. Account monitoring and reporting of atypical activity help reveal rogue behavior or an attack in progress; logging alone does not ensure that the activity is detected and acted upon.

Learn more

NIST SP 800-53 Rev. 5.1, Security and Privacy Controls for Information Systems and Organizations

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ252

Community Discussion