ISC2 CC Access Controls Concepts Practice Test 3 — 15 Questions

Question 1

A security administrator is configuring user permissions and ensures that each user has only the minimum rights needed to perform their job. Which access control principle is the administrator applying?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Least privilege. Least privilege grants users only the permissions necessary to perform their tasks, reducing the potential impact of account compromise.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 2

A bank implements a policy that requires two different employees to approve any wire transfer over $10,000. One employee initiates the transfer, and another approves it. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties prevents any single individual from having complete control over a high-risk action, reducing the risk of fraud.

Answer

Need-to-know

Answer

Least privilege

Answer

Defense in depth

Question 3

An organization uses a layered security approach: perimeter fencing, access badge readers at building entrances, biometric scanners in server rooms, and cable locks on laptops. This strategy best exemplifies which access control concept?

Accepted Answer

Defense in depth. Defense in depth employs multiple, overlapping layers of security controls to protect assets; if one layer fails, others still provide protection.

Answer

Need-to-know

Answer

Least privilege

Answer

Separation of duties

Question 4

Which of the following is an example of a logical access control?

Accepted Answer

Password policies. Logical access controls are technology-based mechanisms that restrict access to systems and data, such as passwords.

Answer

Security guards

Answer

Perimeter fencing

Answer

Biometric reader on server room door

Question 5

According to modern password guidance from NIST SP 800-63, which of the following is the most important factor when setting password requirements?

Accepted Answer

Enforcing a minimum length of at least 8 characters. NIST SP 800-63 recommends favoring password length over complexity, with a minimum of 8 characters (or 15+ for high assurance) and avoiding frequent forced changes unless compromised.

Answer

Requiring a mix of uppercase, lowercase, numbers, and special characters

Answer

Using randomly generated passwords

Answer

Changing passwords every 30 days

Question 6

An organization configures account lockout after 5 failed login attempts within 15 minutes. This control is designed to mitigate which type of attack?

Accepted Answer

Brute-force attack. Account lockout thresholds (typically 3-10 attempts) help prevent brute-force attacks by temporarily disabling the account after repeated failures.

Answer

Phishing

Answer

Social engineering

Answer

Man-in-the-middle attack

Question 7

An employee is assigned a user account with read-only access to the sales database. However, the employee's job requires viewing only customer contact information, not sales figures. Which access control principle is being violated?

Accepted Answer

Need-to-know. Need-to-know restricts access to only the data necessary for job functions, separate from the permissions level (least privilege). Here, the employee has permissions to read data they do not need.

Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties

Question 8

In the context of identification and authentication, which of the following is an example of authentication?

Accepted Answer

Providing a fingerprint scan. Authentication is the process of proving a claimed identity. Providing a fingerprint matches the user's biometric data, verifying identity.

Answer

Entering a username

Answer

Being assigned a user ID

Answer

Swiping an access badge

Question 9

Which of the following best describes the purpose of a session timeout?

Accepted Answer

To automatically log out inactive users. Session timeouts automatically log out idle users after a period of inactivity, reducing the risk of unauthorized access if a user leaves a session open.

Answer

To enforce password complexity

Answer

To restrict access based on need-to-know

Answer

To prevent brute-force attacks

Question 10

A system administrator uses a separate administrative account with elevated privileges only when performing system maintenance, and uses a standard user account for daily activities like email. This practice aligns with which principle?

Accepted Answer

Least privilege. Least privilege for administrators: using separate admin accounts minimizes the risk of accidental changes or compromise, as the admin account is only used when needed.

Answer

Need-to-know

Answer

Defense in depth

Answer

Separation of duties

Question 11

An organization uses Active Directory to manage user accounts. Which protocol does Active Directory primarily use to query and modify directory services?

Accepted Answer

LDAP. Active Directory uses LDAP (Lightweight Directory Access Protocol) as the underlying protocol for directory queries and modifications.

Answer

HTTP

Answer

FTP

Answer

SNMP

Question 12

A visitor signs in at a company's reception, receives a badge, and is escorted throughout the building. This process is part of which type of access control?

Accepted Answer

Physical access control. Visitor management includes sign-in, badge issuance, and escort policies, all of which are physical access controls to secure the premises.

Answer

Technical access control

Answer

Administrative access control

Answer

Logical access control

Question 13

A security analyst is reviewing access control mechanisms. Which TWO of the following are examples of logical access controls? (Select two.)

Accepted Answer

Smart card authentication for system access. Logical access controls are technology-based mechanisms. Passwords and smart cards are logical; fences and guards are physical.

Answer

Security guard at entrance

Answer

Bollards at parking lot

Answer

Perimeter fence

Question 14

An organization is designing a privileged access management (PAM) solution. Which THREE of the following are best practices for managing privileged accounts? (Select three.)

Accepted Answer

Applying the principle of least privilege to admin accounts. PAM best practices include using separate admin accounts, monitoring privileged sessions, and applying least privilege. Sharing passwords and storing them in plaintext are security risks.

Answer

Sharing the root password among all administrators for convenience

Answer

Storing privileged passwords in an unencrypted text file

Question 15

Which TWO of the following correctly describe components of a directory service distinguished name (DN) in LDAP? (Select two.)

Accepted Answer

OU=Sales. In LDAP, a distinguished name uses CN (Common Name), OU (Organizational Unit), and DC (Domain Component). CN=John Smith and OU=Sales are valid components.

Answer

UID=jsmith

Answer

SN=Smith

Answer

GID=1234