Exam CRISC topic 1 question 509 discussion

Answer should be B - Disable those accounts. This is the first thing needs to be done. Next, come up with the policy to address this risk

disable access first, policy second.

D, definately! FIRST step to address the risk? From a Risk officer's point of view it shoud be recommend developing a policy for disabling User access after empolee leaves the company. Risk officer is not responcible for disabling access (B)

Selected Answer: C See Question # 481

B. Disable user access The immediate priority when discovering terminated employee accounts with active access is to remove the potential threat by disabling those accounts. This action prevents any unauthorized access or misuse. After this immediate risk has been addressed, further analysis and policy development can be pursued.

B. Disable user access. The FIRST step to address the risk of terminated employee accounts maintaining access should be to immediately disable user access. This is a crucial action to prevent unauthorized access to company systems and data by individuals who no longer have a legitimate reason to access them. Disabling user access should be done promptly upon an employee's termination to minimize the potential risks associated with unauthorized access.

B, then look at root cause. If the question said from a risk practioner perspective i would say perform root cause first, but it doesnt say that.

Initially I thought answer should be b, but the way they've worded it "disable user access" seems to indicate disable it across the board which wouldn't really be a first thing. Out of the options you'd want to route cause it before jumping to solution mode

More info. In the 7th CRISC manual section 'root cause analysis' it says: a prudent risk practitioner examines the root cause of an incident to discover the conditions and factors that led to the event, rather than reacting to the symptoms of the problem.

The first step is to know why that access is maintained, it could be something exceptional for that user (in which case option 'B') or a general control problem ('D').

I like C as well An audit reveals that several terminated employee accounts maintain access. Which of the following should be the FIRST step to address the risk? -> ISACA defines risk as 'the possibility of harm coming to an asset or an organization. risk = threat * vulnerability * impact. the question is about treating the general risk of employee accounts surviving termination procedures. it is not about the correcting the specific occurrence of these several accounts. A. Perform a risk assessment -> plausible but I like C more because you will learn more about the risk through a post-mortem on an actual occurrence than through a proactive analysis of the theoretical risk B. Disable user access -> will treat the occurrence but not the risk. C. Perform root cause analysis -> if you want to treat the systemic risk then this is the first step D. Develop an access control policy -> ineffective at treating the risk. 'access control' is the wrong type of policy and we dont know why the company's identity+account management/HR policies and termination procedures are not being followed.

I will go with C as the first thing to do. Disabling the access without first finding out “why” may cause damage to the business function.

B is poorly written - it WOULD be correct written "disable these users' access". A and C are eliminated. D is correct.

It should be B. As a FIRST step, you want to address the risk, which is the active accesses in the system that can be exploited anytime. Answer D: Developing an access control policy (even without analysing the root cause) could take months before approval. I believe nobody wants to wait for that long before they delete the undesired accesses.

i would do B, C, then D. But it asks the first step to address the risk. Which is not D. Since the Users not working there anymore, no one should use the Accounts. therefore Disable them.

As a risk practitioner, right answer would be D. Cause disable those accounts is part of admin activity which system custodians will do not risk practitioner, risk practitioner cannot directly go and disable account.

The Question is not asking how to clear the RIsk. It is asking how such risks can be addressed. So is the correct answer