ISC2 CC Practice Test 28 — 15 Questions

Question 1

A software company wants to protect its source code repository. Developers may read and commit code, but only the release manager may create release tags, and the release manager cannot modify the protected branch directly. The company wants a model that enforces these rules consistently regardless of who owns the repository. Which access control model is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Role-based access control (RBAC), because permissions are tied to job functions like developer and release manager. Role-based access control defines permissions for roles and assigns users to those roles, so developers and the release manager receive exactly the rights their job functions require. Because the rules are centrally defined rather than owner-controlled, they are enforced consistently. Discretionary control would leave decisions to owners, mandatory control relies on labels, and rule-based control evaluates environmental conditions.

Answer

Discretionary access control (DAC), because repository owners can set permissions as they see fit

Answer

Mandatory access control (MAC), because labels and clearances prevent unauthorized modifications

Answer

Rule-based access control, because conditions such as branch protection rules can restrict actions

Question 2

A defense contractor classifies documents as Confidential, Secret, or Top Secret and requires that access decisions be based on these labels. Users receive clearances, and the system itself enforces that a user may read a document only if the user's clearance dominates the document's label. Users cannot change labels or grant access to others. Which access control model is being enforced?

Accepted Answer

Mandatory Access Control (MAC). The system bases every access decision on system-assigned classification labels and user clearances, and users cannot modify those labels or delegate access. That combination of non-discretionary, label-driven enforcement is Mandatory Access Control. The dominance rule described, where clearance must dominate the object label for read access, is a hallmark of mandatory models such as Bell-LaPadula.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 3

A data center manager wants to strengthen physical access control at the main entrance while keeping the process practical for employees arriving each morning. Which two measures BEST align with sound physical access control practices? (Choose two.)

Accepted Answer

Require employees to display a visible badge at all times while inside the facility.. Effective physical access control combines preventive enforcement with accountability. A mantrap ensures each entrant authenticates individually, eliminating tailgating, while mandatory visible badges let anyone on site verify that a person is authorized. Together they admit legitimate employees efficiently while making unauthorized entry difficult to conceal, which is exactly what a well-designed entrance control should achieve.

Answer

Place a sign on the door stating that the area is restricted to authorized personnel only.

Answer

Disable the door alarm and logging functions to speed up employee entry during peak hours.

Answer

Publish the entrance door code on the company intranet so employees can memorize it.

Question 4

A financial services firm is deploying a new customer portal. Auditors have required that access decisions consider the user's department, the data classification of the record, the time of day, and whether the request originates from a managed corporate device. The security architect proposes Attribute-Based Access Control (ABAC). Which two statements correctly describe how ABAC satisfies these requirements? (Choose two.)

Accepted Answer

ABAC policies can be expressed so that access is granted only when the department matches the record's owning business unit, the classification is permitted for that department, the request occurs during approved hours, and the device is managed.. ABAC makes decisions by evaluating policies over attributes of the subject, object, action, and environment, which allows department, data classification, time, and device posture to be combined into a single enforceable rule. The two correct statements capture that multi-attribute evaluation and the ability to express compound conditions that must all hold before access is granted.

Answer

ABAC decisions are made by comparing the user's security clearance against the classification label of the object, with no other inputs considered.

Answer

ABAC removes the need for authentication because attribute values alone are sufficient to prove a user's identity.

Answer

ABAC requires that each user be assigned exactly one static role, and all access is then determined solely by that role membership.

Question 5

A small design studio stores client files on a shared server. Each project folder is owned by the designer who created it, and that designer decides which colleagues may open the folder by granting permissions directly to individual accounts. Which access control model is the studio using?

Accepted Answer

Discretionary access control. Discretionary access control is defined by owner discretion: the person who owns a resource decides who else may use it. Each designer owns their project folder and personally grants permissions to individual colleagues, so the access decision rests with the owner rather than with central labels, roles, or global rules.

Answer

Role-based access control

Answer

Rule-based access control

Answer

Mandatory access control

Question 6

A retail company issues managers a hardware token that generates a one-time code, which they enter after their password when signing in to the payroll system. A help desk technician asks why the company does not simply require longer passwords instead. Which statement best explains the security benefit of the token?

Accepted Answer

The token combines something the manager knows with something the manager has, so a stolen password alone is insufficient to sign in.. The hardware token supplies a second authentication factor from a different category than the password. A password is something the manager knows, and the token is something the manager has. Requiring both means a compromised password by itself is not enough to reach the payroll system, which is a stronger defense than increasing password length alone.

Answer

The token encrypts the password while it travels across the network, preventing interception.

Answer

The token replaces the need for authorization checks in the payroll system once the manager signs in.

Answer

The token ensures that the manager's password meets complexity requirements imposed by policy.

Question 7

A network administrator needs to segment traffic between departments without additional hardware. Which technology allows this logical separation on a Layer 2 switch?

Accepted Answer

VLAN. VLANs (Virtual LANs) allow a single Layer 2 switch to be logically partitioned into multiple broadcast domains, separating traffic between departments without buying additional hardware. Each VLAN behaves like a separate physical switch, and inter-VLAN traffic must be routed.

Answer

Subnetting

Answer

VPN

Answer

DMZ

Question 8

A hospital's IT security team reviews how nurses access patient records. They find that a nurse who works in the cardiology unit can also open records for the oncology unit, even though the nurse never treats those patients. The team wants access decisions to be based on the department a nurse is assigned to plus the specific treatment relationship. Which access control model should they implement?

Accepted Answer

Attribute-based access control (ABAC). Attribute-based access control evaluates multiple characteristics at decision time, allowing the hospital to combine the nurse's department attribute with the treatment relationship between clinician and patient. That dynamic evaluation restricts cardiology nurses to records they are genuinely involved with, which neither static roles nor owner-discretion models can express without excessive role proliferation or inconsistent enforcement.

Answer

Discretionary access control (DAC)

Answer

Role-based access control (RBAC)

Answer

Mandatory access control (MAC)

Question 9

A retail company is reviewing physical access controls at its data center. Management wants to document measures that restrict who can enter the server hall and record when entries occur. Which TWO of the following are physical access controls that meet these goals? (Choose two.)

Accepted Answer

A mantrap with interlocking doors that admits one authenticated person at a time into the server hall.. Physical access controls govern movement into protected spaces and often produce an audit trail. A badge reader authenticates the person and logs the entry, while a mantrap enforces one-person-at-a-time passage and prevents tailgating. Together they restrict who reaches the servers and create records of when entry occurred. Firewalls, locked media cabinets, and monitor privacy filters protect other assets or confidentiality but do not control doorway access.

Answer

A firewall rule that blocks inbound traffic to the server subnet from the corporate network.

Answer

A locked cabinet that houses backup tapes and requires a key held by the storage administrator.

Answer

A privacy filter applied to the administrator's monitor so bystanders cannot read displayed data.

Question 10

A security analyst reviews server logs and sees that a single service account performed a login from an office workstation at 09:00 and then, two minutes later, executed administrative commands from an external IP address in another country. The account's password is long and complex. Which access control weakness does this pattern most likely indicate?

Accepted Answer

The account lacks multifactor authentication, so stolen credentials can be reused from anywhere. Two successful logins from geographically impossible locations within minutes indicate the credentials were stolen and reused. A long complex password cannot help once it is captured, but adding multifactor authentication means the attacker also needs the second factor, which blocks simple credential replay and is the control missing from this account.

Answer

The account lockout threshold is set too high, allowing unlimited authentication attempts

Answer

The password policy permits weak passwords that are easily guessed

Answer

The account is not subject to least privilege, so it holds excessive administrative rights

Question 11

A company is evaluating a new cloud service provider and performs a thorough investigation of the provider's security practices and compliance with industry standards. This activity is best described as:

Accepted Answer

Due diligence. Due diligence involves investigating and assessing risks before making decisions, such as vendor selection.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Due care

Question 12

A software company allows developers to access production servers only during an approved change window, and only after a manager approves a request that includes a ticket number and expiration time. Access is automatically revoked when the window closes. Which access control approach is being used?

Accepted Answer

Just-in-time (JIT) privileged access. The company grants elevated production access only after approval and only for a defined window, then revokes it automatically. That is just-in-time privileged access, which eliminates standing administrator rights and limits exposure to the change window. Time restrictions and approvals are components of the model, but the defining characteristic is temporary, request-driven elevation with automatic expiry.

Answer

Rule-based access control

Answer

Separation of duties

Answer

Time-of-day restriction

Question 13

An organization is updating its incident response plan. Which THREE elements should be included in the preparation phase? (Select THREE.)

Accepted Answer

Conducting tabletop exercises. Option C (Conducting tabletop exercises) is correct because tabletop exercises are a preparation-phase activity that validates and rehearses the incident response plan, roles, and communication paths before a real incident occurs. Option D (Acquiring forensic analysis tools) is correct because procuring and maintaining forensic toolkits (e.g., disk imaging, memory capture, and analysis utilities) is part of building the resources and capabilities needed during preparation. Option E (Creating an incident response team) is correct because establishing the CSIRT/IR team, defining its roles, and assigning responsibilities is a foundational preparation-phase element. Option A (Restoring data from backups) belongs to the recovery/eradication-and-recovery phase, since restoration happens after containment and eradication, not during preparation. Option B (Notifying law enforcement) is a coordination/communication action taken during or after detection and response, not a preparation-phase element.

Answer

Restoring data from backups

Answer

Notifying law enforcement

Question 14

A security analyst notices that an employee who transferred from Finance to Marketing still has full access to financial reporting systems six months later. The analyst wants to correct this through the access control lifecycle. Which action best addresses the root cause?

Accepted Answer

Perform a periodic access review and revoke entitlements that are no longer required for the employee's current role.. Excessive access after a role change is a lifecycle failure: provisioning added Finance rights, but deprovisioning or modification never removed them when the employee moved to Marketing. A periodic access review compares entitlements with current job needs and revokes what is no longer required. Authentication hardening such as complexity, lockout, or multifactor authentication protects the login but leaves the stale authorization untouched, so it cannot fix the root cause.

Answer

Require multifactor authentication for anyone accessing financial reporting systems.

Answer

Increase the password complexity requirement for all Finance systems.

Answer

Enable account lockout after three failed login attempts on the financial reporting systems.

Question 15

A security administrator receives an alert that a user's laptop has been infected with ransomware. The user reports that all files on the laptop are encrypted and a ransom note is displayed. The administrator immediately disconnects the laptop from the network. Which of the following should be the NEXT step in the incident response process?

Accepted Answer

Identify the scope of the incident and preserve evidence.. Once an infected system is isolated, the next critical step is to determine the full scope of the compromise and preserve evidence. This allows the organization to understand how the ransomware entered, what else may be affected, and how to eradicate it properly. Recovery actions such as restoring backups or rebuilding systems should come after containment and scoping are complete.

Answer

Restore the encrypted files from the most recent backup.

Answer

Pay the ransom to obtain the decryption key and recover the files quickly.

Answer

Rebuild the laptop from scratch and return it to the user.