CISA Question 198

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A3

  In a biometric access control system, the greatest concern for an IS auditor is unauthorized access — i.e., when someone who should not be granted access is allowed in. This situation is known as a false positive (or Type II error). --- Why Option A (False Positives) Is Correct False positives mean the system incorrectly matches a person’s biometric data (like a fingerprint or face) with an authorized user’s profile. This results in unauthorized access to secure areas — a serious security breach. From an audit and risk perspective, the main goal of physical access controls is to protect assets and sensitive areas from unauthorized entry — so this is the top concern.

• Chose A1

  A false positive in a biometric system means that the system incorrectly grants access to someone who should not be allowed in (unauthorized access).

• Chose C2

  False negatives occur when the biometric system fails to recognize a legitimate user, denying access even though the person is authorized. This is of GREATEST concern because it directly impacts the availability of the system and could prevent authorized users from gaining access to critical areas or systems. In the context of a biometric system used for physical access control, false negatives can lead to significant operational disruptions, reduced security (if users are locked out and try alternative unauthorized methods to gain access), and frustration.