ISC2 CC Access Controls Concepts Practice Test 10 — 15 Questions

Question 1

A financial services firm is deploying a new customer portal. Auditors have required that access decisions consider the user's department, the data classification of the record, the time of day, and whether the request originates from a managed corporate device. The security architect proposes Attribute-Based Access Control (ABAC). Which two statements correctly describe how ABAC satisfies these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ABAC policies can be expressed so that access is granted only when the department matches the record's owning business unit, the classification is permitted for that department, the request occurs during approved hours, and the device is managed.. ABAC makes decisions by evaluating policies over attributes of the subject, object, action, and environment, which allows department, data classification, time, and device posture to be combined into a single enforceable rule. The two correct statements capture that multi-attribute evaluation and the ability to express compound conditions that must all hold before access is granted.

Answer

ABAC decisions are made by comparing the user's security clearance against the classification label of the object, with no other inputs considered.

Answer

ABAC removes the need for authentication because attribute values alone are sufficient to prove a user's identity.

Answer

ABAC requires that each user be assigned exactly one static role, and all access is then determined solely by that role membership.

Question 2

A security analyst is reviewing an access control list on a file server and notices that a former employee's account still has read and write permissions, even though the account was disabled three months ago. Which access control practice failed in this situation?

Accepted Answer

Access revocation during offboarding. Offboarding should include disabling the account and removing or transferring all associated permissions. The scenario shows that the account was disabled but its read and write permissions on the file server remained, indicating that access revocation was incomplete. Least privilege, separation of duties, and account recertification are valuable controls, but they do not directly describe the failure to strip permissions when the employee departed.

Answer

Account recertification

Answer

Least privilege

Answer

Separation of duties

Question 3

A small design studio stores client files on a shared server. Each project folder is owned by the designer who created it, and that designer decides which colleagues may open the folder by granting permissions directly to individual accounts. Which access control model is the studio using?

Accepted Answer

Discretionary access control. Discretionary access control is defined by owner discretion: the person who owns a resource decides who else may use it. Each designer owns their project folder and personally grants permissions to individual colleagues, so the access decision rests with the owner rather than with central labels, roles, or global rules.

Answer

Role-based access control

Answer

Rule-based access control

Answer

Mandatory access control

Question 4

A financial services firm assigns permissions based on each employee's role in the HR system. When an employee transfers from accounting to marketing, the HR record changes and the employee's access is automatically updated to match the marketing role. Which access control model is the firm using?

Accepted Answer

Role-based access control (RBAC). Role-based access control centralizes permissions in roles and assigns users to those roles. When an employee's job function changes, updating the role assignment automatically adjusts access, which reduces administrative overhead and errors. The scenario's automatic permission change driven by HR role data is the defining characteristic of RBAC in enterprise environments.

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Answer

Rule-based access control

Question 5

A hospital's data center uses a mantrap at its main entrance. A nurse badges in at the outer door, steps into a small glass vestibule, and the outer door locks before the inner door unlocks. What security goal does this design primarily achieve?

Accepted Answer

Preventing tailgating by allowing only one person to pass at a time. The interlocked-door vestibule is a classic anti-tailgating control: it forces a one-person-at-a-time transition between security zones so an unauthorized individual cannot slip in behind an authorized badge holder. The nurse's badge handles identification and authentication; the mantrap's distinct contribution is preventing piggybacking through the doorway.

Answer

Establishing identification of the nurse to the access control system

Answer

Providing non-repudiation of the nurse's badge transaction

Answer

Enforcing least privilege for staff entering the data center

Question 6

A retail company issues managers a hardware token that generates a one-time code, which they enter after their password when signing in to the payroll system. A help desk technician asks why the company does not simply require longer passwords instead. Which statement best explains the security benefit of the token?

Accepted Answer

The token combines something the manager knows with something the manager has, so a stolen password alone is insufficient to sign in.. The hardware token supplies a second authentication factor from a different category than the password. A password is something the manager knows, and the token is something the manager has. Requiring both means a compromised password by itself is not enough to reach the payroll system, which is a stronger defense than increasing password length alone.

Answer

The token encrypts the password while it travels across the network, preventing interception.

Answer

The token replaces the need for authorization checks in the payroll system once the manager signs in.

Answer

The token ensures that the manager's password meets complexity requirements imposed by policy.

Question 7

A small marketing firm wants to give each employee a single set of credentials that works for the corporate email system, the cloud CRM, and the internal file share. The IT manager proposes using a central identity store so users do not have to remember separate passwords. Which concept is the IT manager describing?

Accepted Answer

Single sign-on (SSO). The firm's goal is one credential set that unlocks several independent applications, which is the defining purpose of single sign-on. SSO relies on a central identity provider that authenticates the user once and then issues assertions or tokens to each connected application, removing repeated password prompts while still allowing each application to make its own authorization decisions.

Answer

Multifactor authentication (MFA)

Answer

Federated identity management

Answer

Role-based access control (RBAC)

Question 8

A security team is designing a physical access control system for a data center. They want to implement controls that verify a person's identity based on unique biological characteristics. Which two of the following are examples of biometric access controls? (Choose two.)

Accepted Answer

Retina scanner. Biometric access controls verify identity using unique biological traits. Retina scanners and fingerprint scanners both measure inherent physical characteristics, making them valid biometric controls for the data center. Smart cards, PIN pads, and proximity badges rely on possession or knowledge factors instead, so they do not satisfy the requirement for biological verification even though they may be used alongside biometrics in a layered design.

Answer

Smart card reader

Answer

Proximity badge

Answer

Personal identification number (PIN) pad

Question 9

A software company uses a central identity provider so employees can sign in once and access email, the code repository, and the expense system without entering credentials again during the workday. The security team wants to describe the mechanism that lets the identity provider assert the user's identity to each application. Which technology is being used?

Accepted Answer

Security Assertion Markup Language (SAML). Federation allows one trusted identity provider to authenticate a user and send signed assertions to multiple service providers, delivering single sign-on across separate systems. SAML is the standard that defines these assertions and the request-response flow. The described environment, where one login grants access to email, code repository, and expense applications, is a textbook SAML federation deployment.

Answer

Kerberos ticket granting

Answer

Remote Authentication Dial-In User Service (RADIUS)

Answer

Lightweight Directory Access Protocol (LDAP) bind

Question 10

A financial services firm assigns permissions based on the department a user belongs to, such as 'Teller', 'Loan Officer', or 'Auditor'. When an employee transfers from Teller to Loan Officer, their Teller permissions are removed and Loan Officer permissions are added automatically. Which access control model is being used?

Accepted Answer

Role-based access control (RBAC). Assigning rights to roles and then placing users into those roles is the essence of role-based access control. The transfer scenario shows the key benefit: permissions follow the job function, so moving an employee between departments automatically strips old rights and applies new ones without editing each user's individual access list.

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Answer

Rule-based access control

Question 11

A hospital's IT security team reviews how nurses access patient records. They find that a nurse who works in the cardiology unit can also open records for the oncology unit, even though the nurse never treats those patients. The team wants access decisions to be based on the department a nurse is assigned to plus the specific treatment relationship. Which access control model should they implement?

Accepted Answer

Attribute-based access control (ABAC). Attribute-based access control evaluates multiple characteristics at decision time, allowing the hospital to combine the nurse's department attribute with the treatment relationship between clinician and patient. That dynamic evaluation restricts cardiology nurses to records they are genuinely involved with, which neither static roles nor owner-discretion models can express without excessive role proliferation or inconsistent enforcement.

Answer

Discretionary access control (DAC)

Answer

Role-based access control (RBAC)

Answer

Mandatory access control (MAC)

Question 12

A hospital issues each nurse a unique username and a badge that is scanned at a workstation to prove the nurse's identity before any patient records can be opened. Which access control concept does scanning the badge to prove identity represent?

Accepted Answer

Authentication. Authentication is the verification of a claimed identity, and the badge scan validates that the nurse is the person associated with the enrolled credential. Identification only asserts who someone claims to be, while authorization decides what that verified identity may do. Because the scenario emphasizes proving identity before opening records, the scan is the authentication step.

Answer

Identification

Answer

Authorization

Answer

Accounting

Question 13

A retail company is designing access controls for its point-of-sale systems. The security architect proposes controls that restrict what authenticated cashiers can do after they log in, such as preventing voids above a threshold and limiting access to inventory adjustments. Which TWO statements correctly describe access control concepts relevant to this design? (Choose two.)

Accepted Answer

Authorization determines what an authenticated cashier is permitted to do within the point-of-sale application.. Authorization defines what an authenticated identity may do, and least privilege limits that access to what the job requires. Together they support the proposed point-of-sale restrictions on voids and inventory adjustments. Authentication merely establishes identity, while role-based access control assigns permissions through roles rather than individual assignments, and password complexity addresses authentication strength only.

Answer

Authentication alone ensures that a cashier cannot perform unauthorized transactions.

Answer

Access control decisions should be based solely on the cashier's password complexity.

Answer

Role-based access control requires each cashier to be assigned permissions individually rather than through a shared role.

Question 14

A hospital's IT department issues every nurse a unique smart card that must be inserted into a workstation before the nurse types a password. The smart card alone does not grant access to patient records. Which access control concept does the smart card insertion represent?

Accepted Answer

Identification. The smart card presents a unique token that asserts who the nurse claims to be, which is the definition of identification. Because the card alone does not grant access and a password must still be supplied, verification of that claim is handled separately by authentication. Authorization and accounting occur only after identity is established and verified.

Answer

Authentication

Answer

Accounting

Answer

Authorization

Question 15

A retail company is reviewing physical access controls at its data center. Management wants to document measures that restrict who can enter the server hall and record when entries occur. Which TWO of the following are physical access controls that meet these goals? (Choose two.)

Accepted Answer

A mantrap with interlocking doors that admits one authenticated person at a time into the server hall.. Physical access controls govern movement into protected spaces and often produce an audit trail. A badge reader authenticates the person and logs the entry, while a mantrap enforces one-person-at-a-time passage and prevents tailgating. Together they restrict who reaches the servers and create records of when entry occurred. Firewalls, locked media cabinets, and monitor privacy filters protect other assets or confidentiality but do not control doorway access.

Answer

A firewall rule that blocks inbound traffic to the server subnet from the corporate network.

Answer

A locked cabinet that houses backup tapes and requires a key held by the storage administrator.

Answer

A privacy filter applied to the administrator's monitor so bystanders cannot read displayed data.