ISC2 CC Practice Test 24 — 15 Questions

Question 1

Which principle ensures that a user is granted only the permissions necessary to perform their job functions, thereby reducing the potential impact of a compromised account?

Accepted Answer

Least privilege. Least privilege limits permissions to the minimum required, reducing the blast radius if an account is compromised.

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth

Question 2

An organization uses Active Directory to manage user accounts. Which protocol does Active Directory primarily use to query and modify directory services?

Accepted Answer

LDAP. Active Directory uses LDAP (Lightweight Directory Access Protocol) as the underlying protocol for directory queries and modifications.

Answer

HTTP

Answer

FTP

Answer

SNMP

Question 3

A security analyst notices that a user is accessing files in a department they do not work in. Which principle is being violated?

Accepted Answer

Need-to-know. Need-to-know restricts access to data necessary for one's job, even if the user has broader permissions.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 4

A company implements a visitor management policy requiring all visitors to sign in, wear a badge, and be escorted. Which access control principle does this primarily support?

Accepted Answer

Defense in depth. Visitor management controls physical access and supports defense in depth by adding layers.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 5

A security administrator is implementing controls to prevent a single employee from approving and disbursing payments. Which principle is being applied?

Accepted Answer

Separation of duties. Separation of duties ensures no single person can complete a high-risk action alone.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 6

Which principle ensures that users are granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. Least privilege limits permissions to the minimum required, reducing the blast radius of a compromise.

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know

Question 7

In a directory service such as Active Directory, which component is responsible for storing information about users, groups, and computers in a hierarchical structure?

Accepted Answer

Organizational Unit (OU). Organizational Units (OUs) are containers that organize objects like users and computers in a hierarchy.

Answer

LDAP

Answer

Group Policy Object (GPO)

Answer

Domain controller

Question 8

A company wants to implement defense in depth for its data center. Which THREE of the following controls should be included? (Select THREE.)

Accepted Answer

Requiring access badges to enter the building. Defense in depth uses multiple layers: perimeter fencing (physical), access badges (physical/administrative), and encryption (logical).

Answer

Single sign-on (SSO) for all applications

Answer

Using a single firewall for all network traffic

Question 9

A system administrator uses a separate administrative account with elevated privileges only when performing system maintenance, and uses a standard user account for daily activities like email. This practice aligns with which principle?

Accepted Answer

Least privilege. Least privilege for administrators: using separate admin accounts minimizes the risk of accidental changes or compromise, as the admin account is only used when needed.

Answer

Need-to-know

Answer

Defense in depth

Answer

Separation of duties

Question 10

A visitor signs in at a company's reception, receives a badge, and is escorted throughout the building. This process is part of which type of access control?

Accepted Answer

Physical access control. Visitor management includes sign-in, badge issuance, and escort policies, all of which are physical access controls to secure the premises.

Answer

Technical access control

Answer

Administrative access control

Answer

Logical access control

Question 11

A bank implements a policy that requires two different employees to approve any wire transfer over $10,000. One employee initiates the transfer, and another approves it. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties prevents any single individual from having complete control over a high-risk action, reducing the risk of fraud.

Answer

Need-to-know

Answer

Least privilege

Answer

Defense in depth

Question 12

An organization wants to implement a physical access control that requires two different credentials to enter a high-security server room. Which concept does this best represent?

Accepted Answer

Defense in depth. Defense in depth involves multiple overlapping controls, such as requiring both a badge and a biometric scan.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 13

What is the difference between identification and authentication?

Accepted Answer

Identification claims identity; authentication proves identity. Identification is claiming an identity; authentication is proving that identity.

Answer

Identification proves identity; authentication claims identity

Answer

They are the same thing

Answer

Identification uses passwords; authentication uses biometrics

Question 14

A company wants to implement account lockout to prevent brute-force attacks. Which lockout threshold is most appropriate according to common best practices?

Accepted Answer

5 failed attempts. Typical lockout thresholds are between 3 and 10 failed attempts to balance security and usability.

Answer

1 failed attempt

Answer

No lockout, only logging

Answer

20 failed attempts

Question 15

An employee claims to have accessed a confidential document that is not related to their job role. The security team investigates and finds that the employee's account had read access to the folder containing the document. Which TWO access control concepts were likely violated?

Accepted Answer

Need-to-know. Need-to-know restricts access to data required for job duties; the employee should not have accessed the document if it wasn't job-related. Least privilege ensures users have only necessary permissions; the employee likely had excessive rights if they could access unrelated data.

Answer

Identification and authentication

Answer

Separation of duties

Answer

Defense in depth