ISC2 CC Access Controls Concepts — Timed 20 Questions

Question 1

An organization wants to implement the principle of least privilege for its database administrators. Which approach best achieves this goal?

Accepted Answer

Use role-based access control (RBAC) to grant permissions specific to each administrator's duties.. Role-based access control (RBAC) directly enforces the principle of least privilege by granting database administrators only the permissions required for their specific job functions. Unlike MAC, which focuses on data classification labels, RBAC maps roles (e.g., backup admin, security admin) to precise sets of privileges, ensuring no user has unnecessary access.

Answer

Implement mandatory access control (MAC) with labels for all data.

Answer

Allow administrators to self-assign permissions as needed.

Answer

Assign each administrator full database admin rights for simplicity.

Question 2

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting write access when only read access is required violates this principle by providing unnecessary and potentially harmful capabilities. This is a core access control concept in the CC exam.

Answer

Job rotation

Answer

Need-to-know

Answer

Separation of duties

Question 3

Which access control model uses subject and object labels to enforce access based on a security policy?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access decisions based on security labels assigned to subjects (users/processes) and objects (files/resources). The system, not the user, controls access by comparing these labels against a security policy, such as Bell-LaPadula or Biba. This is why MAC is the correct answer for label-based enforcement.

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 4

A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?

Accepted Answer

Separation of duties. Separation of duties (SoD) is an access control concept that requires a critical task, such as a financial transaction, to be split into multiple steps performed by different individuals. This prevents any single employee from having the authority to both initiate and approve a transaction, thereby reducing the risk of fraud or error. In this scenario, the policy directly enforces SoD by ensuring that no one person can complete the entire process alone.

Answer

Need-to-know

Answer

Least privilege

Answer

Job rotation

Question 5

An organization uses Active Directory and wants to grant a group of temporary interns access to a shared folder for exactly 30 days. Which access control approach is most efficient?

Accepted Answer

Create a security group with a time-based membership that expires automatically after 30 days.. Option B is correct because Active Directory supports time-based group membership via the `memberTimeToLive` attribute (introduced in Windows Server 2016 and later), which allows a security group to be configured so that members are automatically removed after a specified duration. This eliminates manual intervention and ensures the interns lose access exactly after 30 days without requiring password changes or calendar reminders.

Answer

Use a group managed service account with a 30-day password expiration.

Answer

Assign each intern directly to the folder permissions and set a calendar reminder to revoke.

Answer

Create a security group, add interns, and manually remove them after 30 days.

Question 6

Which TWO are characteristics of Role-Based Access Control (RBAC)?

Accepted Answer

Users are assigned to roles, and inherit permissions from those roles.. Option A is correct because RBAC defines roles that group specific permissions, and users are assigned to these roles. When a user is added to a role, they automatically inherit all permissions associated with that role, simplifying administration and ensuring consistent access rights across the organization.

Answer

Object owners can delegate permissions to others.

Answer

Access decisions are based on security labels.

Answer

It enforces a centralized policy that cannot be overridden by users.

Question 7

Which THREE are valid methods for authenticating a user in an access control system?

Accepted Answer

Fingerprint scan. A fingerprint scan is a valid authentication method because it falls under 'something you are' (biometric authentication). In access control systems, biometrics like fingerprint scans provide a high level of assurance by verifying a unique physical characteristic of the user, making it a strong factor for authentication.

Answer

User ID

Answer

Access control list

Question 8

You are the security administrator for a mid-sized e-commerce company. The company uses a Linux-based web server running Apache, with a MySQL database backend. User authentication is handled via LDAP. Recently, the security team discovered that a former employee's account was used to access the customer database two weeks after the employee was terminated. The account had not been disabled. The database contains personally identifiable information (PII). The incident was traced to an internal IP address from the marketing department. The marketing department's network segment is not segregated from the database server. Additionally, the database server's firewall rules allow any internal IP to connect to the MySQL port (3306). The company has a written policy that accounts must be disabled within 24 hours of termination, but the HR department did not notify IT in a timely manner. Which combination of controls would BEST prevent a recurrence of this incident?

Accepted Answer

Integrate HR system with identity management to automatically disable accounts upon termination, and implement network segmentation with a firewall that restricts database access to only authorized application servers.. Option B addresses both the user provisioning issue (automated account disablement) and the network access issue (segmentation and least privilege). Option A only addresses one aspect. Option C focuses on monitoring but not prevention. Option D adds unnecessary complexity and does not directly fix the root causes.

Answer

Deploy a database activity monitoring (DAM) solution that alerts on unusual queries, and require strong passwords for all database accounts.

Answer

Implement a firewall rule to block all traffic from the marketing network to the database server, and require all database access to go through a bastion host.

Answer

Implement two-factor authentication for all database access, and conduct quarterly access reviews.

Question 9

A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?

Accepted Answer

Rule-Based Access Control (RuBAC). Rule-Based Access Control (RuBAC) is the correct choice because it enforces access decisions based on a set of predefined rules, such as time-of-day restrictions and device compliance. In this scenario, the rules 'business hours only' and 'company-issued devices only' are static conditions that can be implemented as access control rules (e.g., using a firewall ACL or a policy engine) without requiring user attributes or labels. RuBAC is ideal when access is governed by operational policies that are not tied to user identity or data classification.

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 10

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Accepted Answer

Authorization. The AAA framework consists of Authentication, Authorization, and Accounting. Authentication verifies the identity of a user or device (e.g., via RADIUS or TACACS+). Authorization determines what resources or actions the authenticated entity is permitted to access (e.g., via privilege levels or ACLs). Accounting tracks and logs user activities for auditing and billing purposes. Therefore, Authorization (A) and Authentication (D) are two of the three core components of AAA.

Answer

Identification

Answer

Non-repudiation

Answer

Auditing

Question 11

Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?

Accepted Answer

The user's device attribute is incorrectly set to Windows.. Option D is correct because the policy likely includes a device attribute condition (e.g., device.os == 'Windows') that must be satisfied for the Deny effect to apply. Since the user is on a macOS device, the condition evaluates to false, so the Deny is not enforced, and the default Allow (or a broader Allow rule) permits write access. This is a common misconfiguration where the device attribute is set incorrectly, causing unintended access.

Answer

The condition is evaluated as OR instead of AND.

Answer

The time condition is evaluated as BETWEEN 09:00 and 17:00 exclusive.

Answer

The policy is misconfigured with effect Deny.

Question 12

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Question 13

Drag and drop the steps to implement a firewall rule allowing inbound HTTPS traffic into the correct order.

Question 14

Match each security control type to its description.

Question 15

Match each authentication factor to an example.

Question 16

A system administrator needs to grant a user the ability to read files in a specific folder but not modify them. Which access control principle should be applied?

Accepted Answer

Least Privilege. The principle of Least Privilege dictates that a user should be granted only the minimum permissions necessary to perform their job functions. In this scenario, granting read-only access to a specific folder (e.g., using NTFS 'Read' permission or Linux 'r--' on the directory) ensures the user cannot modify files, directly applying Least Privilege. This prevents accidental or intentional data alteration while still allowing necessary access.

Answer

Role-Based Access Control (RBAC)

Answer

Separation of Duties (SoD)

Answer

Mandatory Access Control (MAC)

Question 17

A financial company requires that any transaction over $10,000 must be approved by two different managers before being processed. This is an example of which access control principle?

Accepted Answer

Separation of Duties. The requirement for two different managers to approve a transaction over $10,000 enforces Separation of Duties (SoD). This access control principle ensures that no single individual has the authority to execute a high-risk action alone, thereby preventing fraud or error by splitting critical tasks across multiple roles. In this scenario, one manager cannot both initiate and approve the transaction, which directly aligns with SoD's goal of distributing responsibility.

Answer

Least Privilege

Answer

Need-to-Know

Answer

Dual Control

Question 18

During a security audit, it is discovered that a contractor has access to customer databases that were not required for their project. Which step should be taken first to mitigate the risk?

Accepted Answer

Revoke the contractor's access immediately. The immediate priority is to revoke the contractor's access to the unauthorized customer databases to stop any potential data exfiltration or misuse. Access controls follow the principle of least privilege, and any discovered over-provisioning must be corrected instantly to contain the risk. Delaying revocation for notification, assessment, or logging leaves the sensitive data exposed to an unauthorized user.

Answer

Notify the contractor's manager

Answer

Perform a risk assessment

Answer

Log the access for evidence

Question 19

An organization implements an access control system where users are assigned to groups, and permissions are granted to groups rather than individuals. This is known as:

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) assigns permissions to roles (or groups) rather than to individual users. Users are then made members of these roles, inheriting the permissions associated with the role. This matches the description in the question, where users are assigned to groups and permissions are granted to those groups.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 20

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

Accepted Answer

Check for explicit deny permissions on the folder. Even if group membership is correct, explicit deny permissions can override allow permissions. Checking for deny entries on the folder is a logical next step. User lockout would affect all accesses. Effective permissions would show the combined result but checking for denies is more direct. Password expiration is a login issue, not a permissions issue.

Answer

Group membership inheritance

Answer

User account lockout status

Answer

Effective permissions