ISC2 CC Access Controls Concepts Practice Test 2 — 15 Questions

Question 1

Which principle ensures that a user is granted only the permissions necessary to perform their job functions, thereby reducing the potential impact of a compromised account?

Accepted Answer

Least privilege. Least privilege limits permissions to the minimum required, reducing the blast radius if an account is compromised.

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth

Question 2

A security administrator is configuring a system to prevent unauthorized access after a user leaves their workstation unattended. Which access control mechanism should be implemented?

Accepted Answer

Session timeout. Session timeouts automatically log out idle users to prevent unauthorized access.

Answer

Password complexity

Answer

Biometric authentication

Answer

Account lockout

Question 3

An organization wants to implement a physical access control that requires two different credentials to enter a high-security server room. Which concept does this best represent?

Accepted Answer

Defense in depth. Defense in depth involves multiple overlapping controls, such as requiring both a badge and a biometric scan.

Answer

Separation of duties

Answer

Need-to-know

Answer

Least privilege

Question 4

A company requires that financial transactions be approved by two different managers before execution. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties ensures no single individual can complete a high-risk action alone.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 5

Which of the following is a recommended practice for password security according to NIST SP 800-63?

Accepted Answer

Use a minimum of 8 characters and check against breached password lists. NIST SP 800-63 recommends favoring password length over complexity and checking passwords against breached lists.

Answer

Require frequent password changes every 30 days

Answer

Set maximum password age to 90 days

Answer

Enforce complex passwords with special characters

Question 6

A security analyst notices multiple failed login attempts from a single IP address within a short period. Which control would best mitigate this brute force attack?

Accepted Answer

Account lockout. Account lockout disables an account after a threshold of failed attempts, thwarting brute force attacks.

Answer

Session timeout

Answer

Password complexity

Answer

Least privilege

Question 7

In a directory service such as Active Directory, which component is responsible for storing information about users, groups, and computers in a hierarchical structure?

Accepted Answer

Organizational Unit (OU). Organizational Units (OUs) are containers that organize objects like users and computers in a hierarchy.

Answer

LDAP

Answer

Group Policy Object (GPO)

Answer

Domain controller

Question 8

Which of the following is an example of a logical access control?

Accepted Answer

Password policy requiring 8 characters. A password is a logical (software-based) control that authenticates users.

Answer

Biometric reader on a server room door

Answer

Fencing around a building

Answer

Security guards

Question 9

What is the difference between identification and authentication?

Accepted Answer

Identification claims identity; authentication proves identity. Identification is claiming an identity; authentication is proving that identity.

Answer

Identification proves identity; authentication claims identity

Answer

They are the same thing

Answer

Identification uses passwords; authentication uses biometrics

Question 10

A system administrator has a regular user account for daily work and a separate account with elevated privileges. Which principle is being applied?

Accepted Answer

Least privilege. Least privilege for admins means using a separate account with only necessary privileges, reducing risk.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 11

An LDAP distinguished name is written as: CN=John Smith,OU=Sales,DC=company,DC=com. What do the 'OU' and 'DC' components represent?

Accepted Answer

OU = Organizational Unit; DC = Domain Component. OU = Organizational Unit, DC = Domain Component.

Answer

OU = Organizational Unit; DC = Domain Controller

Answer

OU = Organizational Unit; DC = Distinguished Component

Answer

OU = Object Unit; DC = Domain Component

Question 12

Which type of access control is implemented by a cable lock attached to a laptop?

Accepted Answer

Physical access control. Cable locks are physical security controls that prevent theft.

Answer

Administrative access control

Answer

Logical access control

Answer

Technical access control

Question 13

A security team is designing a visitor management policy. Which TWO of the following are essential components? (Select TWO.)

Accepted Answer

Requiring an escort for visitors. Visitor sign-in and escort policy are core to visitor management.

Answer

Requiring visitors to provide a biometric scan

Answer

Performing background checks on all visitors

Answer

Issuing temporary visitor badges

Question 14

A company wants to implement defense in depth for its data center. Which THREE of the following controls should be included? (Select THREE.)

Accepted Answer

Requiring access badges to enter the building. Defense in depth uses multiple layers: perimeter fencing (physical), access badges (physical/administrative), and encryption (logical).

Answer

Single sign-on (SSO) for all applications

Answer

Using a single firewall for all network traffic

Question 15

Which TWO of the following are recommended practices for managing privileged accounts? (Select TWO.)

Accepted Answer

Create a separate admin account for privileged tasks. Separating admin accounts from daily accounts and using PAM solutions are key practices.

Answer

Use the same account for daily work and administrative tasks

Answer

Disable logging for admin activities to reduce overhead

Answer

Share admin passwords among team members for convenience