ISC2 CC Practice Test 23 — 15 Questions

Question 1

A company's physical security includes fencing, security guards, access badges, and biometric locks on server room doors. This layered approach is an example of which access control concept?

Accepted Answer

Defense in depth. Defense in depth uses multiple overlapping physical and logical controls to protect assets.

Answer

Least privilege

Answer

Need-to-know

Answer

Separation of duties

Question 2

An employee uses their username to claim an identity and then enters a password to prove it. What is the term for the process of proving the claimed identity?

Accepted Answer

Authentication. Authentication is the process of proving a claimed identity (e.g., via password, biometric).

Answer

Authorization

Answer

Accounting

Answer

Identification

Question 3

A company is implementing separation of duties for financial transactions. Which of the following are examples of this principle? (Choose TWO.)

Accepted Answer

One employee creates a purchase order, another approves it. Separation of duties requires multiple people to complete a critical task to prevent fraud.

Answer

A manager can both initiate and approve a wire transfer

Answer

All employees use the same password for the accounting system

Answer

A user has read-only access to financial reports

Question 4

A security administrator is configuring a session timeout policy. Which of the following are valid reasons for implementing session timeouts? (Choose TWO.)

Accepted Answer

Limit the window for session hijacking attacks. Session timeouts mitigate unauthorized access from unattended sessions and reduce risk of session hijacking.

Answer

Enforce password complexity requirements

Answer

Provide single sign-on functionality

Answer

Prevent brute-force attacks on passwords

Question 5

An organization uses fencing, bollards, and lighting around the perimeter, guards at the main entrance, and biometric readers on server room doors. This approach is an example of:

Accepted Answer

Defense in depth. Defense in depth employs multiple layers of security to protect assets.

Answer

Separation of duties

Answer

Least privilege

Answer

Need-to-know

Question 6

Which TWO of the following are recommended practices for managing privileged accounts? (Select TWO.)

Accepted Answer

Create a separate admin account for privileged tasks. Separating admin accounts from daily accounts and using PAM solutions are key practices.

Answer

Use the same account for daily work and administrative tasks

Answer

Disable logging for admin activities to reduce overhead

Answer

Share admin passwords among team members for convenience

Question 7

An account lockout policy is implemented to protect against which type of attack?

Accepted Answer

Brute force. Account lockout detects and prevents brute-force attacks by disabling the account after a threshold of failed attempts.

Answer

Man-in-the-middle

Answer

Social engineering

Answer

Phishing

Question 8

Which of the following best describes the purpose of a session timeout?

Accepted Answer

To automatically log out inactive users. Session timeouts automatically log out idle users after a period of inactivity, reducing the risk of unauthorized access if a user leaves a session open.

Answer

To enforce password complexity

Answer

To restrict access based on need-to-know

Answer

To prevent brute-force attacks

Question 9

In a directory service using LDAP, what is the distinguished name (DN) for a user named John Smith in the Sales organizational unit of the company domain company.com?

Accepted Answer

CN=John Smith, OU=Sales, DC=company, DC=com. The DN format includes CN (common name), OU (organizational unit), and DC (domain components) in order from specific to general.

Answer

DC=company, DC=com, OU=Sales, CN=John Smith

Answer

OU=Sales, CN=John Smith, DC=company, DC=com

Answer

CN=John Smith, DC=Sales, DC=company, DC=com

Question 10

A security administrator is configuring a system to prevent unauthorized access after a user leaves their workstation unattended. Which access control mechanism should be implemented?

Accepted Answer

Session timeout. Session timeouts automatically log out idle users to prevent unauthorized access.

Answer

Password complexity

Answer

Biometric authentication

Answer

Account lockout

Question 11

A security administrator is configuring user permissions and ensures that each user has only the minimum rights needed to perform their job. Which access control principle is the administrator applying?

Accepted Answer

Least privilege. Least privilege grants users only the permissions necessary to perform their tasks, reducing the potential impact of account compromise.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 12

A security auditor is reviewing access controls at a financial institution. The auditor identifies a scenario where one employee can initiate a payment transaction, and the same employee can also approve it. Which access control principle is being violated, and what is the primary risk?

Accepted Answer

Separation of duties; risk of fraud. Separation of duties requires that no single person has the ability to complete a high-risk action without another person's involvement. The scenario describes a violation of this principle, which increases the risk of fraud because an individual could both initiate and approve a fraudulent payment without oversight.

Answer

Defense in depth; risk of single point of failure

Answer

Need-to-know; risk of data exposure

Answer

Least privilege; risk of excessive permissions

Answer

Privileged access management; risk of account compromise

Question 13

A security analyst is reviewing access control mechanisms. Which TWO of the following are examples of logical access controls? (Select two.)

Accepted Answer

Smart card authentication for system access. Logical access controls are technology-based mechanisms. Passwords and smart cards are logical; fences and guards are physical.

Answer

Security guard at entrance

Answer

Bollards at parking lot

Answer

Perimeter fence

Question 14

An organization uses a Privileged Access Management (PAM) solution. Which of the following is a primary benefit of PAM?

Accepted Answer

Controls and monitors privileged access. PAM solutions monitor, control, and audit privileged account usage, reducing risk of misuse.

Answer

Provides a single sign-on for all users

Answer

Eliminates the need for passwords

Answer

Automates user provisioning for all accounts

Question 15

Which process involves verifying the identity of a user who claims to be a specific person?

Accepted Answer

Authentication. Authentication is the process of proving a claimed identity, typically with passwords, biometrics, or tokens.

Answer

Authorization

Answer

Identification

Answer

Accounting