ISC2 CC Access Controls Concepts — 50 Questions

Question 1

A company wants to implement account lockout to prevent brute-force attacks. Which lockout threshold is most appropriate according to common best practices?

Accepted Answer

5 failed attempts. A lockout threshold of 5 failed attempts is commonly recommended by best practices (e.g., NIST, CIS) to balance security and usability. It effectively mitigates brute-force attacks while minimizing the risk of locking out legitimate users due to typos.

Answer

1 failed attempt

Answer

No lockout, only logging

Answer

20 failed attempts

Question 2

A company implements a visitor management policy requiring all visitors to sign in, wear a badge, and be escorted. Which access control principle does this primarily support?

Accepted Answer

Defense in depth. Defense in depth is a layered security approach that uses multiple overlapping controls to protect assets. The visitor management policy—sign-in, badge, and escort—adds multiple layers of physical access control, which aligns with defense in depth.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 3

An organization wants to implement a physical access control that requires two different credentials to enter a high-security server room. Which concept does this best represent?

Accepted Answer

Defense in depth. The scenario describes implementing a physical access control that requires two different credentials to enter a high-security server room. This best represents defense in depth, which involves using multiple layers of security controls to protect assets. By requiring two different credentials (e.g., a badge and a biometric scan), the organization adds an extra layer of security, making it harder for an unauthorized person to gain access even if one credential is compromised.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 4

In a directory service such as Active Directory, which component is responsible for storing information about users, groups, and computers in a hierarchical structure?

Accepted Answer

Organizational Unit (OU). An Organizational Unit (OU) is a container within an Active Directory domain that is used to organize objects such as users, groups, computers, and other OUs into a hierarchical structure. This hierarchy mirrors the organizational structure and is used for delegation of administration and application of Group Policy. The OU is the actual directory partition component that stores these objects, making it the correct answer.

Answer

LDAP

Answer

Group Policy Object (GPO)

Answer

Domain controller

Question 5

Which of the following is an example of a logical access control?

Accepted Answer

Password policy requiring 8 characters. A password policy is a logical access control because it governs how subjects authenticate and what credentials they may use, operating at the data/identity layer rather than the physical layer. Logical controls include authentication, authorization, encryption, and account policies.

Answer

Biometric reader on a server room door

Answer

Fencing around a building

Answer

Security guards

Question 6

A security team is designing a visitor management policy. Which TWO of the following are essential components? (Select TWO.)

Accepted Answer

Requiring an escort for visitors. Option D is correct because requiring an escort for visitors ensures that unauthorized individuals are continuously monitored while inside the facility, which is a fundamental physical security control for preventing unauthorized access to sensitive areas. Option E is correct because signing visitors in and out creates an audit trail that records who is on-site, when they arrived, and when they departed, which is essential for accountability, emergency evacuation accounting, and post-incident investigations. Option A is not essential because biometric scans are a strong authentication mechanism but are typically reserved for employees or high-security areas, and visitor management can function effectively with photo ID verification and badge issuance. Option B is not essential because background checks on all visitors are impractical for most organizations and are usually limited to specific roles such as contractors or vendors with prolonged access. Option C is not marked correct because while temporary visitor badges are a common practice, the question asks for essential components, and the two marked answers represent the core control (escort) and the core record-keeping (sign in/out) that define a visitor management policy.

Answer

Requiring visitors to provide a biometric scan

Answer

Performing background checks on all visitors

Answer

Issuing temporary visitor badges

Question 7

Which of the following is an example of a logical access control?

Accepted Answer

Password policies. Logical access controls are software-based mechanisms that manage access to systems and data, such as password policies, access control lists, and encryption. Password policies are a logical control because they enforce rules on authentication credentials. The other options are physical controls.

Answer

Security guards

Answer

Perimeter fencing

Answer

Biometric reader on server room door

Question 8

An employee is assigned a user account with read-only access to the sales database. However, the employee's job requires viewing only customer contact information, not sales figures. Which access control principle is being violated?

Accepted Answer

Need-to-know. Need to know is violated because the employee can view sales figures that are not required for their job — they only need customer contact information. The principle states that access should be limited to the specific data necessary for the user's tasks, not just the minimum permission level.

Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties

Question 9

Which TWO of the following correctly describe components of a directory service distinguished name (DN) in LDAP? (Select two.)

Accepted Answer

OU=Sales. In LDAP, a distinguished name is built from relative distinguished names (RDNs) such as OU=Sales and CN=John Smith, which identify the entry's location and name within the directory hierarchy. OU=Sales (A) is correct because 'OU' stands for organizationalUnit, a standard DN attribute used to represent an organizational unit container in the directory tree. CN=John Smith (E) is correct because 'CN' stands for commonName, a standard DN attribute used to name an entry such as a user or group. UID=jsmith (B) is not a DN component in this context; 'UID' is a user ID attribute, not a standard RDN attribute for constructing a DN. SN=Smith (C) is the surname attribute and is not used as a DN RDN component. GID=1234 (D) is a group ID attribute and is not part of an LDAP DN.

Answer

UID=jsmith

Answer

SN=Smith

Answer

GID=1234

Question 10

Which of the following is an example of a logical access control?

Accepted Answer

Password complexity requirements. Logical access controls manage access to systems, data, and networks through software mechanisms such as passwords, encryption, and access control lists. Password complexity requirements are a logical control because they enforce rules on authentication credentials to prevent unauthorized access. They are not physical barriers but rather policies implemented in software.

Answer

Biometric reader on a door

Answer

Fencing around a building

Answer

Security guards

Question 11

According to NIST SP 800-63, which password policy is most effective for user authentication?

Accepted Answer

Require a minimum length of 15 characters and check against breached password lists, without requiring complexity or frequent changes. NIST SP 800-63B (Digital Identity Guidelines) explicitly recommends a minimum password length of 15 characters for memorized secrets when used as a single-factor authenticator, and mandates screening new passwords against lists of commonly used and breached passwords. It also advises against composition rules (mixed case, digits, symbols) and against forced periodic rotation, because these practices drive users toward predictable patterns (e.g., Password1!) and incremental changes that weaken security rather than strengthen it.

Answer

Require a mix of uppercase, lowercase, numbers, and symbols, and force password changes every 30 days

Answer

Require a minimum length of 6 characters with no other requirements

Answer

Require a minimum length of 8 characters and check against breached password lists

Question 12

A company implements a policy where users must swipe their access card and then enter a PIN to enter the data center. This is an example of:

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more independent authentication factors from different categories: something you have (the access card), something you know (the PIN), and something you are (biometrics). Here, the access card is a possession factor and the PIN is a knowledge factor, so together they satisfy MFA. This combination is stronger than either factor alone because an attacker would need both the physical card and the PIN to gain access.

Answer

Biometric authentication

Answer

Single sign-on

Answer

Single-factor authentication

Question 13

An organization implements a policy requiring employees to use a separate administrator account for privileged tasks and a different account for daily activities. Which principle does this support?

Accepted Answer

Least privilege. Using separate accounts for administrative tasks and daily activities enforces the principle of least privilege. The daily account has limited permissions, reducing risk, while the admin account is used only when necessary, minimizing exposure of privileged credentials.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 14

Which of the following is an example of a physical access control at the building entrance?

Accepted Answer

Access badges. Access badges are a physical access control mechanism — they are physical credentials presented at a building entrance to authenticate a person and grant or deny entry. Physical access controls govern who can physically enter a facility or room, and badges are the canonical example. The other options are all logical/technical controls that govern system or account access, not physical entry.

Answer

Password complexity requirements

Answer

Biometric reader on a server room door

Answer

Account lockout policy

Question 15

Which of the following is an example of a logical access control?

Accepted Answer

A password policy. A password policy is a logical access control because it governs how users authenticate to systems using non-physical means such as credentials, rules, and permissions. Logical controls focus on software, data, and authentication mechanisms rather than physical barriers. Password policies enforce complexity, rotation, and lockout rules that restrict system access at the logical layer.

Answer

A fence around a building

Answer

A security guard

Answer

A biometric reader on a door

Question 16

Which THREE are best practices for password management according to modern guidelines? (Select THREE.)

Accepted Answer

Enforce a minimum password length of 8 characters. Option A is correct because modern guidelines such as NIST SP 800-63B recommend enforcing a minimum password length (8 characters is the baseline minimum, with longer preferred) as length is the primary factor in resisting brute-force attacks. Option B is correct because password managers generate high-entropy, unique passwords for each account and store them securely, eliminating password reuse and weak human-chosen passwords. Option D is correct because checking new or changed passwords against lists of known compromised/breached passwords (blocklists) prevents users from selecting credentials already exposed in data breaches. Option C is not among the marked correct answers because modern guidance de-emphasizes mandatory composition rules (complexity requirements), which tend to produce predictable patterns like 'Password1!' and are no longer considered a best practice on their own. Option E is not among the marked correct answers because forced periodic rotation (e.g., every 30 days) is discouraged by modern guidelines, which recommend changing passwords only on evidence of compromise.

Answer

Require at least one uppercase, one lowercase, one digit, and one special character

Answer

Require passwords to be changed every 30 days

Question 17

A financial firm classifies data so that only employees in the Treasury department may view wire-transfer records, and only the Treasury manager may approve them. Access rights are attached directly to each record, and the system checks those rights whenever a user opens a file. Which access control model is described?

Accepted Answer

Mandatory Access Control (MAC), because the system enforces a central policy based on data classification and clearance.. Mandatory Access Control bases every decision on a central policy that compares a subject's clearance with an object's classification label, and ordinary users cannot change those labels or bypass the rules. The financial firm classifies records and restricts viewing and approval to specific cleared personnel, with the system enforcing the check on each access. That centralized, label-driven enforcement is the defining trait of MAC.

Answer

Attribute-Based Access Control (ABAC), because the decision uses department and managerial attributes.

Answer

Role-Based Access Control (RBAC), because Treasury staff share a department role.

Answer

Discretionary Access Control (DAC), because record owners set the permissions on their files.

Question 18

A cloud operations team must allow an automation service to read objects from a storage bucket without embedding long-lived credentials in scripts. The security architect recommends issuing the service a short-lived identity token that the cloud platform validates cryptographically on each request. Which access control concept does this approach primarily rely on?

Accepted Answer

Machine identity using short-lived tokens, which is a form of certificate-based authentication for workloads.. Issuing a workload a short-lived token that the platform validates cryptographically provides a machine identity without embedding reusable secrets. This is the modern alternative to static API keys and service accounts with permanent passwords. The token's brief lifetime and cryptographic proof reduce the blast radius if it is captured, and the storage platform can authorize each request based on that verified identity.

Answer

Federated identity with single sign-on, because the token is issued by a trusted identity provider.

Answer

Passwordless authentication, because no static password is stored in the script.

Answer

Rule-based access control, because the platform applies rules to each storage request.

Question 19

A systems administrator is asked to strengthen authentication for a set of privileged administrator accounts. Which TWO of the following changes directly improve authentication assurance for those accounts? (Choose two.)

Accepted Answer

Enforce a 15-minute idle session timeout on administrative consoles. Authentication assurance for privileged accounts improves when a second factor is required and when authenticated sessions do not linger unattended. A hardware security key adds possession to the password's knowledge factor, and an idle timeout ends sessions that could otherwise be hijacked. Length increases and lockout tuning reduce guessing risk but leave single-factor credential replay intact.

Answer

Configure the accounts to use a shared password stored in a team vault

Answer

Increase the minimum password length from 12 to 16 characters

Answer

Reduce the account lockout threshold from 10 to 5 failed attempts

Question 20

Which principle ensures that users are granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege states that users (and processes) should be granted only the minimum permissions necessary to perform their job functions, reducing the attack surface and limiting the blast radius of a compromised account. It is a foundational access-control principle in cybersecurity and is explicitly tested in the ISC2 CC exam. Defense in depth, separation of duties, and need-to-know are related but distinct concepts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know