ISC2 CC Access Controls Concepts Practice Test 2 — 15 Questions

Question 1

Which THREE are best practices for password management according to modern guidelines? (Select THREE.)

Accepted Answer

Enforce a minimum password length of 8 characters. Option A is correct because modern guidelines such as NIST SP 800-63B recommend enforcing a minimum password length (8 characters is the baseline minimum, with longer preferred) as length is the primary factor in resisting brute-force attacks. Option B is correct because password managers generate high-entropy, unique passwords for each account and store them securely, eliminating password reuse and weak human-chosen passwords. Option D is correct because checking new or changed passwords against lists of known compromised/breached passwords (blocklists) prevents users from selecting credentials already exposed in data breaches. Option C is not among the marked correct answers because modern guidance de-emphasizes mandatory composition rules (complexity requirements), which tend to produce predictable patterns like 'Password1!' and are no longer considered a best practice on their own. Option E is not among the marked correct answers because forced periodic rotation (e.g., every 30 days) is discouraged by modern guidelines, which recommend changing passwords only on evidence of compromise.

Answer

Require at least one uppercase, one lowercase, one digit, and one special character

Answer

Require passwords to be changed every 30 days

Question 2

A financial firm classifies data so that only employees in the Treasury department may view wire-transfer records, and only the Treasury manager may approve them. Access rights are attached directly to each record, and the system checks those rights whenever a user opens a file. Which access control model is described?

Accepted Answer

Mandatory Access Control (MAC), because the system enforces a central policy based on data classification and clearance.. Mandatory Access Control bases every decision on a central policy that compares a subject's clearance with an object's classification label, and ordinary users cannot change those labels or bypass the rules. The financial firm classifies records and restricts viewing and approval to specific cleared personnel, with the system enforcing the check on each access. That centralized, label-driven enforcement is the defining trait of MAC.

Answer

Attribute-Based Access Control (ABAC), because the decision uses department and managerial attributes.

Answer

Role-Based Access Control (RBAC), because Treasury staff share a department role.

Answer

Discretionary Access Control (DAC), because record owners set the permissions on their files.

Question 3

A cloud operations team must allow an automation service to read objects from a storage bucket without embedding long-lived credentials in scripts. The security architect recommends issuing the service a short-lived identity token that the cloud platform validates cryptographically on each request. Which access control concept does this approach primarily rely on?

Accepted Answer

Machine identity using short-lived tokens, which is a form of certificate-based authentication for workloads.. Issuing a workload a short-lived token that the platform validates cryptographically provides a machine identity without embedding reusable secrets. This is the modern alternative to static API keys and service accounts with permanent passwords. The token's brief lifetime and cryptographic proof reduce the blast radius if it is captured, and the storage platform can authorize each request based on that verified identity.

Answer

Federated identity with single sign-on, because the token is issued by a trusted identity provider.

Answer

Passwordless authentication, because no static password is stored in the script.

Answer

Rule-based access control, because the platform applies rules to each storage request.

Question 4

A systems administrator is asked to strengthen authentication for a set of privileged administrator accounts. Which TWO of the following changes directly improve authentication assurance for those accounts? (Choose two.)

Accepted Answer

Enforce a 15-minute idle session timeout on administrative consoles. Authentication assurance for privileged accounts improves when a second factor is required and when authenticated sessions do not linger unattended. A hardware security key adds possession to the password's knowledge factor, and an idle timeout ends sessions that could otherwise be hijacked. Length increases and lockout tuning reduce guessing risk but leave single-factor credential replay intact.

Answer

Configure the accounts to use a shared password stored in a team vault

Answer

Increase the minimum password length from 12 to 16 characters

Answer

Reduce the account lockout threshold from 10 to 5 failed attempts

Question 5

Which principle ensures that users are granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege states that users (and processes) should be granted only the minimum permissions necessary to perform their job functions, reducing the attack surface and limiting the blast radius of a compromised account. It is a foundational access-control principle in cybersecurity and is explicitly tested in the ISC2 CC exam. Defense in depth, separation of duties, and need-to-know are related but distinct concepts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know

Question 6

A security administrator is reviewing physical access controls. Which control is considered an external perimeter security measure?

Accepted Answer

Fencing around the property. Fencing around the property is an external perimeter security measure because it establishes the outermost physical boundary of the facility, deterring and delaying unauthorized entry before an attacker reaches the building. Perimeter controls focus on the site's outer edge, while the other options protect interior assets or personnel behavior. Fencing, bollards, lighting, and gates are classic examples of external perimeter defenses.

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Answer

Visitor badge policy

Question 7

An organization implements a policy where no single employee can approve a financial transaction over $10,000; a second manager must also approve. This is an example of which access control principle?

Accepted Answer

Separation of duties. Requiring two separate approvals for a high-value transaction is the classic definition of separation of duties: no single individual has enough authority to complete a sensitive action alone. This prevents fraud and error by distributing control across multiple people.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 8

Which of the following is an example of a logical access control?

Accepted Answer

Password complexity policy. A password complexity policy is a logical access control because it is enforced by software (the operating system or application) and governs how users authenticate. Logical controls include passwords, encryption, permissions, and session policies, all implemented in code rather than physical barriers or administrative procedures.

Answer

Security guard at entrance

Answer

Visitor logbook

Answer

Fence around building

Question 9

According to NIST SP 800-63, which password policy is most recommended?

Accepted Answer

Enforce a minimum length of 8 characters and check against breached password lists. NIST SP 800-63B recommends a minimum password length of 8 characters (with 15+ encouraged for memorized secrets) and screening new passwords against lists of commonly used and breached passwords. This approach prioritizes length and blocklist checks over forced complexity and rotation.

Answer

Allow short passwords but require numbers and symbols

Answer

Use complex passwords with special characters and minimal length

Answer

Require frequent password changes every 30 days

Question 10

What is the process of claiming an identity called?

Accepted Answer

Identification. Identification is the process of claiming an identity — a subject asserts who they are (e.g., by presenting a username, smart card, or biometric sample) before any verification occurs. Authentication then validates that claim, and authorization determines what the verified identity may do. In the ISC2 access control model, identification is the first step in the AAA/identity lifecycle.

Answer

Authentication

Answer

Authorization

Answer

Accountability

Question 11

An LDAP distinguished name (DN) is written as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' represent?

Accepted Answer

Common Name. In an LDAP distinguished name (DN), 'CN' stands for Common Name. It is used to represent the name of an object, such as a user or a group. In the example 'CN=John Smith,OU=Sales,DC=company,DC=com', 'CN=John Smith' indicates the common name of the entry, which is typically the user's full name.

Answer

Domain Component

Answer

Organizational Unit

Answer

Country Name

Question 12

A security analyst notices that a user is accessing files in a department they do not work in. Which principle is being violated?

Accepted Answer

Need-to-know. The need-to-know principle restricts access to information only to individuals who require it to perform their specific job duties. A user accessing files in a department they do not work in violates this principle because they have no legitimate need for that information.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 13

An organization uses a Privileged Access Management (PAM) solution. Which of the following is a primary benefit of PAM?

Accepted Answer

Controls and monitors privileged access. PAM solutions are designed to secure, control, and monitor privileged accounts — the accounts with elevated access such as root, domain admin, and service accounts. Core PAM capabilities include credential vaulting, session recording, just-in-time access, and approval workflows for privileged actions. The primary benefit is therefore controlling and monitoring privileged access to reduce the risk of misuse or compromise.

Answer

Provides a single sign-on for all users

Answer

Eliminates the need for passwords

Answer

Automates user provisioning for all accounts

Question 14

Which of the following is a recommended practice for administrative accounts?

Accepted Answer

Use a separate admin account distinct from daily use account. Using a separate administrative account distinct from a daily-use account enforces least privilege and separation of duties. If the daily account is compromised via phishing or malware, the attacker does not automatically gain administrative rights. This practice also ensures accountability, as administrative actions are logged under a dedicated identity.

Answer

Use the same account for daily work and admin tasks

Answer

Grant admin rights to all users for convenience

Answer

Disable all admin accounts to improve security

Question 15

A security administrator is configuring a session timeout policy. Which of the following are valid reasons for implementing session timeouts? (Choose TWO.)

Accepted Answer

Limit the window for session hijacking attacks. Option B is correct because a session timeout limits the amount of time an attacker has to reuse a stolen session token or cookie, shrinking the window during which a session hijacking attack can succeed. Option E is correct because automatically terminating idle sessions locks out anyone who approaches an unattended workstation after the legitimate user has walked away, reducing the risk of unauthorized access. Option A is incorrect because password complexity is enforced by password policy settings, not by session timeouts. Option C is incorrect because single sign-on is provided by authentication federation technologies such as SAML, OAuth, or Kerberos, not by session expiration. Option D is incorrect because brute-force protection comes from account lockout thresholds, rate limiting, or CAPTCHA mechanisms, not from session timeouts.

Answer

Enforce password complexity requirements

Answer

Provide single sign-on functionality

Answer

Prevent brute-force attacks on passwords