ISC2 CC Access Controls Concepts Practice Test 3 — 15 Questions

Question 1

An organization is designing a defense-in-depth strategy for physical security. Which of the following are examples of layered physical controls? (Choose THREE.)

Accepted Answer

Fencing and bollards around the property. Option A (fencing and bollards around the property) is correct because these are perimeter physical controls that create the outermost defensive layer, deterring or blocking vehicles and intruders before they reach the building. Option B (biometric reader on server room door) is correct because it is an interior physical access control that authenticates a person's unique biological trait, adding a stronger layer protecting the high-value server room beyond the building entrance. Option E (access badge system at building entrance) is correct because it is a physical access control at the facility boundary, verifying authorized personnel and forming a layer between the perimeter and the server room. Option C (encryption of data at rest) is not a physical control but a logical/cryptographic control protecting data confidentiality. Option D (intrusion detection system on the network) is a logical/technical monitoring control, not a physical security layer.

Answer

Encryption of data at rest

Answer

Intrusion detection system on the network

Question 2

A company is implementing separation of duties for financial transactions. Which of the following are examples of this principle? (Choose TWO.)

Accepted Answer

One employee creates a purchase order, another approves it. Option A is correct because separation of duties requires that no single person controls an entire transaction; having one employee create a purchase order while a different employee approves it splits the critical functions of initiation and authorization. Option B is correct because requiring two managers to approve any payment over $5,000 enforces dual control (two-person integrity), ensuring that high-value transactions cannot be executed by one individual acting alone. Option C is incorrect because allowing a manager to both initiate and approve a wire transfer concentrates incompatible duties in one person, which is the exact opposite of separation of duties. Option D is incorrect because sharing the same password for the accounting system destroys individual accountability and non-repudiation, and it is a poor authentication practice rather than a separation-of-duties control. Option E is incorrect because read-only access to financial reports is an example of least privilege, not separation of duties, since it does not divide transaction responsibilities among multiple people.

Answer

A manager can both initiate and approve a wire transfer

Answer

All employees use the same password for the accounting system

Answer

A user has read-only access to financial reports

Question 3

Which principle ensures that a user is granted only the permissions necessary to perform their job functions, thereby reducing the potential impact of a compromised account?

Accepted Answer

Least privilege. Least privilege is the principle that users, processes, and systems should be granted only the minimum access rights required to perform their legitimate tasks, and no more. This limits the blast radius if an account is compromised, because the attacker inherits only the narrow permissions of that account. It is a foundational concept in access control and is explicitly required by standards like NIST SP 800-53 (AC-6).

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth

Question 4

A security administrator is configuring a system to prevent unauthorized access after a user leaves their workstation unattended. Which access control mechanism should be implemented?

Accepted Answer

Session timeout. A session timeout automatically locks or logs out a user after a period of inactivity, directly addressing the risk of an unattended workstation being used by an unauthorized person. It is the standard control for this scenario because it terminates the authenticated session without requiring the user to manually log off. Password complexity, biometrics, and account lockout address different threats.

Answer

Password complexity

Answer

Biometric authentication

Answer

Account lockout

Question 5

A company requires that financial transactions be approved by two different managers before execution. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties (SoD) requires that critical tasks be divided among multiple people so that no single individual can complete a sensitive transaction alone. Requiring two managers to approve financial transactions is the textbook example: it prevents fraud and errors by ensuring collusion is needed to bypass the control. SoD is a foundational principle in ISC2's access control domain.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 6

Which of the following is a recommended practice for password security according to NIST SP 800-63?

Accepted Answer

Use a minimum of 8 characters and check against breached password lists. NIST SP 800-63B recommends a minimum of 8 characters and checking new passwords against lists of commonly used or breached passwords. It also advises against arbitrary complexity rules and frequent expiration, focusing instead on length and breach checks. This approach balances usability with security by preventing weak, compromised passwords.

Answer

Require frequent password changes every 30 days

Answer

Set maximum password age to 90 days

Answer

Enforce complex passwords with special characters

Question 7

A security analyst notices multiple failed login attempts from a single IP address within a short period. Which control would best mitigate this brute force attack?

Accepted Answer

Account lockout. Account lockout is the most direct mitigation because it disables the account after a defined number of failed attempts, breaking the brute-force loop before the attacker can guess the password. It is a preventive control that directly targets the repeated-failure pattern described in the scenario.

Answer

Session timeout

Answer

Password complexity

Answer

Least privilege

Question 8

What is the difference between identification and authentication?

Accepted Answer

Identification claims identity; authentication proves identity. Identification is the process of claiming an identity, such as providing a username. Authentication is the process of proving that claimed identity, typically by providing a password, token, or biometric. Therefore, identification claims identity, and authentication proves it.

Answer

Identification proves identity; authentication claims identity

Answer

They are the same thing

Answer

Identification uses passwords; authentication uses biometrics

Question 9

A system administrator has a regular user account for daily work and a separate account with elevated privileges. Which principle is being applied?

Accepted Answer

Least privilege. The principle of least privilege states that users should be granted only the minimum levels of access—or permissions—necessary to perform their job functions. By using a regular account for daily work and a separate elevated account only when needed, the administrator is limiting the exposure of privileged access, thus applying least privilege.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 10

An LDAP distinguished name is written as: CN=John Smith,OU=Sales,DC=company,DC=com. What do the 'OU' and 'DC' components represent?

Accepted Answer

OU = Organizational Unit; DC = Domain Component. In LDAP distinguished names, OU stands for Organizational Unit and DC stands for Domain Component. These are the standard RDN attribute types defined in RFC 4519 and used to build hierarchical directory paths, so option A is the correct expansion.

Answer

OU = Organizational Unit; DC = Domain Controller

Answer

OU = Organizational Unit; DC = Distinguished Component

Answer

OU = Object Unit; DC = Domain Component

Question 11

Which type of access control is implemented by a cable lock attached to a laptop?

Accepted Answer

Physical access control. A cable lock physically tethers the laptop to a fixed object, preventing theft or physical removal of the device. Because it restricts physical contact with and movement of the asset rather than controlling logical system access, it is classified as a physical access control. Physical controls are one of the three main categories (alongside administrative and technical/logical) in the (ISC)² access control taxonomy.

Answer

Administrative access control

Answer

Logical access control

Answer

Technical access control

Question 12

A company wants to implement defense in depth for its data center. Which THREE of the following controls should be included? (Select THREE.)

Accepted Answer

Requiring access badges to enter the building. Option A is correct because requiring access badges to enter the building is a physical (premises) access control that restricts who can reach the data center, forming the outermost layer of defense in depth. Option D is correct because encrypting data at rest protects stored data (e.g., AES-256 on disks or databases) so that even if physical or logical access is gained, the data remains unreadable. Option E is correct because fencing around the building is a perimeter physical control that deters and delays intrusion, complementing badge access as an additional defensive layer. Option B does not belong because SSO centralizes authentication and can actually reduce the number of independent barriers, and it is an identity convenience/control rather than a distinct defense-in-depth layer. Option C does not belong because a single firewall for all network traffic is a single point of failure and contradicts defense in depth, which requires multiple, diverse, and redundant controls.

Answer

Single sign-on (SSO) for all applications

Answer

Using a single firewall for all network traffic

Question 13

Which TWO of the following are recommended practices for managing privileged accounts? (Select TWO.)

Accepted Answer

Create a separate admin account for privileged tasks. Option A is correct because creating a separate admin account for privileged tasks enforces separation between a user's standard daily-use account and their elevated account, so routine activities like email and web browsing cannot be leveraged to compromise administrative rights, and it enables auditing of privileged actions to a distinct identity. Option D is correct because a Privileged Access Management (PAM) solution provides vaulting, credential rotation, session brokering, just-in-time elevation, and monitoring of privileged sessions, which are core controls for reducing standing administrative access and detecting misuse. Option B is not recommended because using one account for both daily work and administrative tasks grants excessive standing privilege and exposes admin credentials to everyday attack surfaces such as phishing and malicious websites. Option C is wrong because disabling logging for admin activities destroys the audit trail needed for accountability, incident response, and compliance, and the overhead is not a valid reason to eliminate it. Option E is wrong because sharing admin passwords among team members eliminates individual accountability, prevents effective credential rotation, and violates the principle of least privilege and non-repudiation.

Answer

Use the same account for daily work and administrative tasks

Answer

Disable logging for admin activities to reduce overhead

Answer

Share admin passwords among team members for convenience

Question 14

A security administrator is configuring user permissions and ensures that each user has only the minimum rights needed to perform their job. Which access control principle is the administrator applying?

Accepted Answer

Least privilege. Least privilege means granting users only the minimum permissions required to perform their job functions — nothing more. The administrator is explicitly ensuring each user has only the rights needed, which is the textbook definition of least privilege. This principle limits the blast radius of compromised accounts and reduces accidental or malicious misuse of permissions.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 15

A bank implements a policy that requires two different employees to approve any wire transfer over $10,000. One employee initiates the transfer, and another approves it. This is an example of which access control principle?

Accepted Answer

Separation of duties. The policy requires two different employees to approve wire transfers over $10,000, with one initiating and another approving. This is a classic example of separation of duties, which ensures that no single individual has the authority to complete a critical task alone, thereby reducing the risk of fraud or error. By splitting the task between two people, the organization enforces a system of checks and balances.

Answer

Need-to-know

Answer

Least privilege

Answer

Defense in depth