Which verification step ensures that access control is applied comprehensively?

Which verification step ensures that access control is applied comprehensively?

• A. Confirm that access control systems are in place on all system components
• B. Verify that access control is applied to at least half of the system components
• C. Ensure that only network devices are protected
• D. Review the access control policy without testing

Answer: (A)

The main idea is ensuring access control is enforced everywhere, not just in part of the environment. To truly verify comprehensive access control, you need to confirm that access control systems are implemented on every system component—servers, workstations, databases, network devices, cloud resources, and any other asset. When every component has proper access controls, there are no gaps an attacker could slip through. If you only verify that access control exists on half of the components, you’d miss potential weaknesses on the remaining ones. Limiting protection to network devices ignores endpoints and data stores that may be reachable without the same protections. Merely reviewing the policy without testing does not show that the controls are actually in place or functioning. So the step that best ensures comprehensive application is confirming that access control systems are present across all system components.

The main idea is ensuring access control is enforced everywhere, not just in part of the environment. To truly verify comprehensive access control, you need to confirm that access control systems are implemented on every system component—servers, workstations, databases, network devices, cloud resources, and any other asset. When every component has proper access controls, there are no gaps an attacker could slip through.

If you only verify that access control exists on half of the components, you’d miss potential weaknesses on the remaining ones. Limiting protection to network devices ignores endpoints and data stores that may be reachable without the same protections. Merely reviewing the policy without testing does not show that the controls are actually in place or functioning. So the step that best ensures comprehensive application is confirming that access control systems are present across all system components.