ISC2 CC Access Controls Concepts Practice Test 1 — 15 Questions

Question 1

A company wants to implement account lockout to prevent brute-force attacks. Which lockout threshold is most appropriate according to common best practices?

Accepted Answer

5 failed attempts. A lockout threshold of 5 failed attempts is commonly recommended by best practices (e.g., NIST, CIS) to balance security and usability. It effectively mitigates brute-force attacks while minimizing the risk of locking out legitimate users due to typos.

Answer

1 failed attempt

Answer

No lockout, only logging

Answer

20 failed attempts

Question 2

A company implements a visitor management policy requiring all visitors to sign in, wear a badge, and be escorted. Which access control principle does this primarily support?

Accepted Answer

Defense in depth. Defense in depth is a layered security approach that uses multiple overlapping controls to protect assets. The visitor management policy—sign-in, badge, and escort—adds multiple layers of physical access control, which aligns with defense in depth.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 3

An organization wants to implement a physical access control that requires two different credentials to enter a high-security server room. Which concept does this best represent?

Accepted Answer

Defense in depth. The scenario describes implementing a physical access control that requires two different credentials to enter a high-security server room. This best represents defense in depth, which involves using multiple layers of security controls to protect assets. By requiring two different credentials (e.g., a badge and a biometric scan), the organization adds an extra layer of security, making it harder for an unauthorized person to gain access even if one credential is compromised.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 4

In a directory service such as Active Directory, which component is responsible for storing information about users, groups, and computers in a hierarchical structure?

Accepted Answer

Organizational Unit (OU). An Organizational Unit (OU) is a container within an Active Directory domain that is used to organize objects such as users, groups, computers, and other OUs into a hierarchical structure. This hierarchy mirrors the organizational structure and is used for delegation of administration and application of Group Policy. The OU is the actual directory partition component that stores these objects, making it the correct answer.

Answer

LDAP

Answer

Group Policy Object (GPO)

Answer

Domain controller

Question 5

Which of the following is an example of a logical access control?

Accepted Answer

Password policy requiring 8 characters. A password policy is a logical access control because it governs how subjects authenticate and what credentials they may use, operating at the data/identity layer rather than the physical layer. Logical controls include authentication, authorization, encryption, and account policies.

Answer

Biometric reader on a server room door

Answer

Fencing around a building

Answer

Security guards

Question 6

A security team is designing a visitor management policy. Which TWO of the following are essential components? (Select TWO.)

Accepted Answer

Requiring an escort for visitors. Option D is correct because requiring an escort for visitors ensures that unauthorized individuals are continuously monitored while inside the facility, which is a fundamental physical security control for preventing unauthorized access to sensitive areas. Option E is correct because signing visitors in and out creates an audit trail that records who is on-site, when they arrived, and when they departed, which is essential for accountability, emergency evacuation accounting, and post-incident investigations. Option A is not essential because biometric scans are a strong authentication mechanism but are typically reserved for employees or high-security areas, and visitor management can function effectively with photo ID verification and badge issuance. Option B is not essential because background checks on all visitors are impractical for most organizations and are usually limited to specific roles such as contractors or vendors with prolonged access. Option C is not marked correct because while temporary visitor badges are a common practice, the question asks for essential components, and the two marked answers represent the core control (escort) and the core record-keeping (sign in/out) that define a visitor management policy.

Answer

Requiring visitors to provide a biometric scan

Answer

Performing background checks on all visitors

Answer

Issuing temporary visitor badges

Question 7

Which of the following is an example of a logical access control?

Accepted Answer

Password policies. Logical access controls are software-based mechanisms that manage access to systems and data, such as password policies, access control lists, and encryption. Password policies are a logical control because they enforce rules on authentication credentials. The other options are physical controls.

Answer

Security guards

Answer

Perimeter fencing

Answer

Biometric reader on server room door

Question 8

An employee is assigned a user account with read-only access to the sales database. However, the employee's job requires viewing only customer contact information, not sales figures. Which access control principle is being violated?

Accepted Answer

Need-to-know. Need to know is violated because the employee can view sales figures that are not required for their job — they only need customer contact information. The principle states that access should be limited to the specific data necessary for the user's tasks, not just the minimum permission level.

Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties

Question 9

Which TWO of the following correctly describe components of a directory service distinguished name (DN) in LDAP? (Select two.)

Accepted Answer

OU=Sales. In LDAP, a distinguished name is built from relative distinguished names (RDNs) such as OU=Sales and CN=John Smith, which identify the entry's location and name within the directory hierarchy. OU=Sales (A) is correct because 'OU' stands for organizationalUnit, a standard DN attribute used to represent an organizational unit container in the directory tree. CN=John Smith (E) is correct because 'CN' stands for commonName, a standard DN attribute used to name an entry such as a user or group. UID=jsmith (B) is not a DN component in this context; 'UID' is a user ID attribute, not a standard RDN attribute for constructing a DN. SN=Smith (C) is the surname attribute and is not used as a DN RDN component. GID=1234 (D) is a group ID attribute and is not part of an LDAP DN.

Answer

UID=jsmith

Answer

SN=Smith

Answer

GID=1234

Question 10

Which of the following is an example of a logical access control?

Accepted Answer

Password complexity requirements. Logical access controls manage access to systems, data, and networks through software mechanisms such as passwords, encryption, and access control lists. Password complexity requirements are a logical control because they enforce rules on authentication credentials to prevent unauthorized access. They are not physical barriers but rather policies implemented in software.

Answer

Biometric reader on a door

Answer

Fencing around a building

Answer

Security guards

Question 11

According to NIST SP 800-63, which password policy is most effective for user authentication?

Accepted Answer

Require a minimum length of 15 characters and check against breached password lists, without requiring complexity or frequent changes. NIST SP 800-63B (Digital Identity Guidelines) explicitly recommends a minimum password length of 15 characters for memorized secrets when used as a single-factor authenticator, and mandates screening new passwords against lists of commonly used and breached passwords. It also advises against composition rules (mixed case, digits, symbols) and against forced periodic rotation, because these practices drive users toward predictable patterns (e.g., Password1!) and incremental changes that weaken security rather than strengthen it.

Answer

Require a mix of uppercase, lowercase, numbers, and symbols, and force password changes every 30 days

Answer

Require a minimum length of 6 characters with no other requirements

Answer

Require a minimum length of 8 characters and check against breached password lists

Question 12

A company implements a policy where users must swipe their access card and then enter a PIN to enter the data center. This is an example of:

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more independent authentication factors from different categories: something you have (the access card), something you know (the PIN), and something you are (biometrics). Here, the access card is a possession factor and the PIN is a knowledge factor, so together they satisfy MFA. This combination is stronger than either factor alone because an attacker would need both the physical card and the PIN to gain access.

Answer

Biometric authentication

Answer

Single sign-on

Answer

Single-factor authentication

Question 13

An organization implements a policy requiring employees to use a separate administrator account for privileged tasks and a different account for daily activities. Which principle does this support?

Accepted Answer

Least privilege. Using separate accounts for administrative tasks and daily activities enforces the principle of least privilege. The daily account has limited permissions, reducing risk, while the admin account is used only when necessary, minimizing exposure of privileged credentials.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 14

Which of the following is an example of a physical access control at the building entrance?

Accepted Answer

Access badges. Access badges are a physical access control mechanism — they are physical credentials presented at a building entrance to authenticate a person and grant or deny entry. Physical access controls govern who can physically enter a facility or room, and badges are the canonical example. The other options are all logical/technical controls that govern system or account access, not physical entry.

Answer

Password complexity requirements

Answer

Biometric reader on a server room door

Answer

Account lockout policy

Question 15

Which of the following is an example of a logical access control?

Accepted Answer

A password policy. A password policy is a logical access control because it governs how users authenticate to systems using non-physical means such as credentials, rules, and permissions. Logical controls focus on software, data, and authentication mechanisms rather than physical barriers. Password policies enforce complexity, rotation, and lockout rules that restrict system access at the logical layer.

Answer

A fence around a building

Answer

A security guard

Answer

A biometric reader on a door