ISC2 CC Access Controls Concepts — 25 Questions

Question 1

Which principle ensures that users are granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. Least privilege limits permissions to the minimum required, reducing the blast radius of a compromise.

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know

Question 2

A security administrator is reviewing physical access controls. Which control is considered an external perimeter security measure?

Accepted Answer

Fencing around the property. External perimeter controls include fencing, bollards, and lighting to deter or delay intruders.

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Answer

Visitor badge policy

Question 3

An organization implements a policy where no single employee can approve a financial transaction over $10,000; a second manager must also approve. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties requires multiple people to complete a critical task, reducing fraud risk.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 4

Which of the following is an example of a logical access control?

Accepted Answer

Password complexity policy. Logical access controls are technology-based mechanisms like passwords, biometrics, and ACLs.

Answer

Security guard at entrance

Answer

Visitor logbook

Answer

Fence around building

Question 5

According to NIST SP 800-63, which password policy is most recommended?

Accepted Answer

Enforce a minimum length of 8 characters and check against breached password lists. NIST SP 800-63 emphasizes password length over complexity and discourages frequent mandatory changes.

Answer

Allow short passwords but require numbers and symbols

Answer

Use complex passwords with special characters and minimal length

Answer

Require frequent password changes every 30 days

Question 6

A company wants to implement account lockout to prevent brute-force attacks. Which lockout threshold is most appropriate according to common best practices?

Accepted Answer

5 failed attempts. Typical lockout thresholds are between 3 and 10 failed attempts to balance security and usability.

Answer

1 failed attempt

Answer

No lockout, only logging

Answer

20 failed attempts

Question 7

What is the process of claiming an identity called?

Accepted Answer

Identification. Identification is the act of claiming an identity, such as providing a username.

Answer

Authentication

Answer

Authorization

Answer

Accountability

Question 8

An LDAP distinguished name (DN) is written as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' represent?

Accepted Answer

Common Name. In LDAP, CN stands for Common Name, which is typically the user's name.

Answer

Domain Component

Answer

Organizational Unit

Answer

Country Name

Question 9

A security analyst notices that a user is accessing files in a department they do not work in. Which principle is being violated?

Accepted Answer

Need-to-know. Need-to-know restricts access to data necessary for one's job, even if the user has broader permissions.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 10

An organization uses a Privileged Access Management (PAM) solution. Which of the following is a primary benefit of PAM?

Accepted Answer

Controls and monitors privileged access. PAM solutions monitor, control, and audit privileged account usage, reducing risk of misuse.

Answer

Provides a single sign-on for all users

Answer

Eliminates the need for passwords

Answer

Automates user provisioning for all accounts

Question 11

Which of the following is a recommended practice for administrative accounts?

Accepted Answer

Use a separate admin account distinct from daily use account. Admins should have a separate account for privileged tasks to reduce risk.

Answer

Use the same account for daily work and admin tasks

Answer

Grant admin rights to all users for convenience

Answer

Disable all admin accounts to improve security

Question 12

A company implements a visitor management policy requiring all visitors to sign in, wear a badge, and be escorted. Which access control principle does this primarily support?

Accepted Answer

Defense in depth. Visitor management controls physical access and supports defense in depth by adding layers.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 13

A security administrator is configuring a session timeout policy. Which of the following are valid reasons for implementing session timeouts? (Choose TWO.)

Accepted Answer

Limit the window for session hijacking attacks. Session timeouts mitigate unauthorized access from unattended sessions and reduce risk of session hijacking.

Answer

Enforce password complexity requirements

Answer

Provide single sign-on functionality

Answer

Prevent brute-force attacks on passwords

Question 14

An organization is designing a defense-in-depth strategy for physical security. Which of the following are examples of layered physical controls? (Choose THREE.)

Accepted Answer

Fencing and bollards around the property. Defense in depth uses multiple layers: perimeter, building, room, and equipment controls.

Answer

Encryption of data at rest

Answer

Intrusion detection system on the network

Question 15

A company is implementing separation of duties for financial transactions. Which of the following are examples of this principle? (Choose TWO.)

Accepted Answer

One employee creates a purchase order, another approves it. Separation of duties requires multiple people to complete a critical task to prevent fraud.

Answer

A manager can both initiate and approve a wire transfer

Answer

All employees use the same password for the accounting system

Answer

A user has read-only access to financial reports

Question 16

Which principle ensures that a user is granted only the permissions necessary to perform their job functions, thereby reducing the potential impact of a compromised account?

Accepted Answer

Least privilege. Least privilege limits permissions to the minimum required, reducing the blast radius if an account is compromised.

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth

Question 17

A security administrator is configuring a system to prevent unauthorized access after a user leaves their workstation unattended. Which access control mechanism should be implemented?

Accepted Answer

Session timeout. Session timeouts automatically log out idle users to prevent unauthorized access.

Answer

Password complexity

Answer

Biometric authentication

Answer

Account lockout

Question 18

An organization wants to implement a physical access control that requires two different credentials to enter a high-security server room. Which concept does this best represent?

Accepted Answer

Defense in depth. Defense in depth involves multiple overlapping controls, such as requiring both a badge and a biometric scan.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 19

A company requires that financial transactions be approved by two different managers before execution. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties ensures no single individual can complete a high-risk action alone.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 20

Which of the following is a recommended practice for password security according to NIST SP 800-63?

Accepted Answer

Use a minimum of 8 characters and check against breached password lists. NIST SP 800-63 recommends favoring password length over complexity and checking passwords against breached lists.

Answer

Require frequent password changes every 30 days

Answer

Set maximum password age to 90 days

Answer

Enforce complex passwords with special characters