ISC2 CC Access Controls Concepts Practice Test 11 — 15 Questions

Question 1

A financial services company issues every employee a smart card that must be inserted into a reader before the employee can log in to a workstation. The card stores a private key that never leaves the card. Which authentication factor category does the smart card represent in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Something you have. A smart card is a possession factor because the employee must physically hold and present the token, and the embedded private key enables cryptographic proof that the token is present. It is commonly combined with a PIN or password to achieve multifactor authentication, pairing what the user has with what the user knows.

Answer

Something you know

Answer

Something you are

Answer

Somewhere you are

Question 2

A security analyst reviews server logs and sees that a single service account performed a login from an office workstation at 09:00 and then, two minutes later, executed administrative commands from an external IP address in another country. The account's password is long and complex. Which access control weakness does this pattern most likely indicate?

Accepted Answer

The account lacks multifactor authentication, so stolen credentials can be reused from anywhere. Two successful logins from geographically impossible locations within minutes indicate the credentials were stolen and reused. A long complex password cannot help once it is captured, but adding multifactor authentication means the attacker also needs the second factor, which blocks simple credential replay and is the control missing from this account.

Answer

The account lockout threshold is set too high, allowing unlimited authentication attempts

Answer

The password policy permits weak passwords that are easily guessed

Answer

The account is not subject to least privilege, so it holds excessive administrative rights

Question 3

A small accounting firm wants to grant access to its tax software based on the department a user belongs to, rather than assigning permissions to each person individually. Which access control model should the firm implement to meet this requirement?

Accepted Answer

Role-based access control (RBAC). Role-based access control grants permissions to roles and then assigns users to those roles, so access follows a person's function rather than being set individually. Because the firm wants tax software access determined by department membership, defining roles and assigning users to them delivers the required consistency and reduces administrative effort when staff change positions.

Answer

Rule-based access control

Answer

Mandatory access control (MAC)

Answer

Discretionary access control (DAC)

Question 4

A government contractor stores documents with classification labels, and users receive clearances that determine which labels they may access. No user, including administrators, can change a document's label or bypass the label checks. Which access control model does this describe?

Accepted Answer

Mandatory access control (MAC). Mandatory access control bases decisions on labels attached to objects and clearances assigned to subjects, with enforcement handled by the system rather than by user discretion. The scenario's classification labels, clearance levels, and prohibition on bypassing checks all align with MAC. This model is typical in government and military settings where data sensitivity demands strict, non-discretionary control.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Question 5

A security analyst notices that an employee who transferred from Finance to Marketing still has full access to financial reporting systems six months later. The analyst wants to correct this through the access control lifecycle. Which action best addresses the root cause?

Accepted Answer

Perform a periodic access review and revoke entitlements that are no longer required for the employee's current role.. Excessive access after a role change is a lifecycle failure: provisioning added Finance rights, but deprovisioning or modification never removed them when the employee moved to Marketing. A periodic access review compares entitlements with current job needs and revokes what is no longer required. Authentication hardening such as complexity, lockout, or multifactor authentication protects the login but leaves the stale authorization untouched, so it cannot fix the root cause.

Answer

Require multifactor authentication for anyone accessing financial reporting systems.

Answer

Increase the password complexity requirement for all Finance systems.

Answer

Enable account lockout after three failed login attempts on the financial reporting systems.

Question 6

A retail chain wants store managers to approve refunds above $500, but the managers should not be able to approve their own refund transactions. The security team must enforce this separation in the point-of-sale system. Which access control model best fits this requirement?

Accepted Answer

Separation of duties enforced through constrained RBAC. The requirement is that one person must not both create and approve a refund, which is the principle of separation of duties. Constrained RBAC enforces it by making the refund initiation and refund approval roles mutually exclusive, so no single account can hold both. Label-based, role-only, and global rule models cannot express that interpersonal conflict.

Answer

Rule-based access control

Answer

Mandatory access control (MAC)

Answer

Role-based access control (RBAC)

Question 7

A software company allows developers to access production servers only during an approved change window, and only after a manager approves a request that includes a ticket number and expiration time. Access is automatically revoked when the window closes. Which access control approach is being used?

Accepted Answer

Just-in-time (JIT) privileged access. The company grants elevated production access only after approval and only for a defined window, then revokes it automatically. That is just-in-time privileged access, which eliminates standing administrator rights and limits exposure to the change window. Time restrictions and approvals are components of the model, but the defining characteristic is temporary, request-driven elevation with automatic expiry.

Answer

Rule-based access control

Answer

Separation of duties

Answer

Time-of-day restriction

Question 8

A defense contractor classifies documents as Confidential, Secret, or Top Secret and assigns each employee a clearance level. Access is permitted only when the employee's clearance meets or exceeds the document's classification, and users cannot change these labels. Which access control model is in use?

Accepted Answer

Mandatory access control (MAC). Mandatory access control enforces access decisions using labels assigned to objects and clearances assigned to subjects, with the labels controlled by policy rather than by users. The requirement that a clearance meet or exceed a document's classification, combined with users being unable to change labels, is the defining behavior of MAC, making it the correct model for this defense contractor.

Answer

Discretionary access control (DAC)

Answer

Role-based access control (RBAC)

Answer

Rule-based access control

Question 9

A security analyst is reviewing how a centralized authentication protocol validates user credentials before granting access to network resources. Which two characteristics correctly describe Kerberos authentication as used in a Windows domain environment? (Choose two.)

Accepted Answer

It provides mutual authentication, allowing both the client and the service to verify each other's identity.. Kerberos uses a trusted Key Distribution Center to issue ticket-granting and service tickets, and it supports mutual authentication because the service ticket is encrypted with the service key while the client's authenticator proves possession of the session key. Passwords are never sent to services or embedded in tickets, which is why the two selected characteristics accurately describe the protocol.

Answer

It requires every service to maintain a local copy of all domain user passwords.

Answer

It stores user passwords in a reversible encrypted format inside each service ticket.

Answer

It transmits the user's password to each service in plaintext during authentication.

Question 10

A financial services firm classifies documents as Public, Internal, Confidential, and Restricted. Access to Restricted documents is determined solely by the document's classification label and the user's clearance level, and users cannot change either value. Which statement best describes this arrangement?

Accepted Answer

It is mandatory access control because labels and clearances are enforced by the system and cannot be changed by users.. Access decisions driven by immutable system labels compared against a subject's clearance define mandatory access control. Because users cannot alter the classification of a document or their own clearance, the system, not the owner, dictates access. Role-based and rule-based models instead key on job function or global conditions, and discretionary models allow owner control.

Answer

It is role-based access control because clearance levels map to job roles.

Answer

It is rule-based access control because classification follows written policy.

Answer

It is discretionary access control because document owners set the labels.

Question 11

A retail company issues contract workers temporary accounts that automatically expire after 30 days, and it reviews all active accounts each quarter to remove those no longer needed. Which access control administration practice does the quarterly review represent?

Accepted Answer

Access review or recertification. Periodically reviewing active accounts to confirm each is still needed and removing those that are not is an access review, also known as recertification. It works alongside automated expiration of temporary accounts by catching entitlements that persist beyond their business justification, helping the company keep access aligned with current needs and supporting least privilege over time.

Answer

User provisioning

Answer

Separation of duties

Answer

Least privilege

Question 12

A defense contractor runs a facility where entry to the secure lab requires a fingerprint scan, and entry to the adjacent server cage additionally requires a retina scan. A security analyst is documenting the access control design for an audit. Which two statements accurately describe these controls? (Choose two.)

Accepted Answer

The fingerprint scan at the lab door is a biometric control that verifies a physiological characteristic of the individual.. Fingerprint and retina scans both measure physical characteristics of a person, so each is a biometric and an inherence factor. Pairing them strengthens verification but does not create multifactor authentication, because multifactor requires factors from separate categories such as knowledge, possession, and inherence. Least privilege concerns granted permissions, not the credentials presented at a door.

Answer

The fingerprint and retina scans together demonstrate the principle of least privilege.

Answer

Requiring both the fingerprint and retina scans for the server cage is an example of multifactor authentication.

Answer

Because both doors use biometrics, the facility has satisfied the requirement for two-factor authentication.

Question 13

A software company wants contractors to access an internal code repository only during their contracted hours and only from company-managed laptops. The repository administrator should implement which type of access control to meet these conditions?

Accepted Answer

Rule-based access control, by evaluating time-of-day and managed-device conditions. The requirements are conditions evaluated when access is requested: the clock must be inside contracted hours, and the device must be company-managed. Rule-based access control inspects exactly such attributes at decision time, enforcing both constraints together. Role, discretionary, and mandatory models govern who may access what, but none of them natively evaluate time-of-day or device posture.

Answer

Discretionary access control, by letting the repository owner approve each contractor

Answer

Role-based access control, by creating a Contractor role with read access

Answer

Mandatory access control, by labeling the repository as confidential and requiring clearance

Question 14

A financial services firm is designing controls to enforce separation of duties in its payment approval process. Which two practices support this goal? (Choose two.)

Accepted Answer

Applying a system constraint that prevents the same user account from both entering and approving a payment. Separation of duties ensures no single person can complete a sensitive transaction end to end. Requiring different employees to initiate and approve payments, and enforcing that split with a system constraint that blocks one account from doing both, both create an independent check. The other practices concentrate or allow circumvention of those duties, which undermines the control.

Answer

Granting one senior manager both the ability to create vendors and the ability to approve payments to those vendors

Answer

Allowing any employee with payment approval rights to also modify the approval limits assigned to their own account

Answer

Assigning all payment-related duties to a single trusted administrator to simplify the process

Question 15

A cloud administrator notices that several engineers share one privileged account with a single set of credentials for managing production databases. An audit finds no way to attribute a specific change to a specific engineer. Which access control weakness does this represent?

Accepted Answer

Lack of accountability because shared credentials prevent tracing actions to an individual. Accountability depends on unique identities so that logs can tie each action to one person. Sharing a single privileged credential collapses multiple engineers into one identity, making attribution impossible and undermining nonrepudiation. The remedy is individual named accounts with privileged access management, not merely stronger authentication or additional approvals.

Answer

Excessive privilege because engineers can manage production databases

Answer

Missing authorization because the account was never formally approved

Answer

Weak authentication because the shared account uses only a single password