Which item is NOT typically included in an access control system audit?

Which item is NOT typically included in an access control system audit?

• A. Credential validity
• B. Permissions
• C. Audit logs
• D. Maintenance schedules

Answer: (D)

An access control system audit focuses on who has access, what access they have, and whether those access events are properly recorded. Credential validity is checked to ensure current users actually possess valid credentials and that revoked or expired ones can’t grant entry. Permissions are reviewed to verify that each user’s access rights align with their role and the principle of least privilege. Audit logs are examined to confirm that access attempts and security events are being captured for monitoring and investigation. Maintenance schedules, while important for keeping the system functioning, do not directly assess access rights or event recording, so they aren’t typically part of an access control audit.

An access control system audit focuses on who has access, what access they have, and whether those access events are properly recorded. Credential validity is checked to ensure current users actually possess valid credentials and that revoked or expired ones can’t grant entry. Permissions are reviewed to verify that each user’s access rights align with their role and the principle of least privilege. Audit logs are examined to confirm that access attempts and security events are being captured for monitoring and investigation. Maintenance schedules, while important for keeping the system functioning, do not directly assess access rights or event recording, so they aren’t typically part of an access control audit.