Question

During a review of an organization's identity and access management process, an IS auditor observes that system administrators create new user accounts and assign application entitlements immediately upon receiving an email request from any department manager. The requests are later reviewed in a monthly access report. Which of the following is the auditor's GREATEST concern?

Accepted Answer

Access is granted without documented approval from the resource or data owner prior to provisioning

Answer

The monthly access report is generated by the same administrators who create the accounts

Answer

Email requests are not encrypted while in transit to the administrators

Answer

User accounts are not automatically disabled after a period of inactivity