ISC2 CC Access Controls Concepts Practice Test 4 — 15 Questions

Question 1

An organization uses a layered security approach: perimeter fencing, access badge readers at building entrances, biometric scanners in server rooms, and cable locks on laptops. This strategy best exemplifies which access control concept?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defense in depth. Defense in depth is the practice of layering multiple independent security controls so that if one fails, others continue to protect the asset. The scenario describes physical controls at progressively deeper levels — perimeter fencing, badge readers at entrances, biometric scanners in server rooms, and cable locks on laptops — each adding a distinct barrier. This layered approach is the textbook definition of defense in depth.

Answer

Need-to-know

Answer

Least privilege

Answer

Separation of duties

Question 2

According to modern password guidance from NIST SP 800-63, which of the following is the most important factor when setting password requirements?

Accepted Answer

Enforcing a minimum length of at least 8 characters. NIST SP 800-63B explicitly recommends enforcing a minimum password length of at least 8 characters (and encourages longer, up to 64) as the primary strength control, while deprecating composition rules and mandatory rotation. Length is the dominant factor in resisting brute-force and dictionary attacks because it exponentially increases the search space. The guidance prioritizes memorized secrets that are long and unique over complex-but-short passwords.

Answer

Requiring a mix of uppercase, lowercase, numbers, and special characters

Answer

Using randomly generated passwords

Answer

Changing passwords every 30 days

Question 3

An organization configures account lockout after 5 failed login attempts within 15 minutes. This control is designed to mitigate which type of attack?

Accepted Answer

Brute-force attack. Account lockout after 5 failed attempts within 15 minutes is a classic defense against brute-force attacks, which rely on rapidly submitting many password guesses until one succeeds. By locking the account after a small number of failures, the control drastically reduces the number of attempts an attacker can make in a given time window, making automated guessing impractical. This is a standard mitigation recommended by frameworks like NIST and CIS.

Answer

Phishing

Answer

Social engineering

Answer

Man-in-the-middle attack

Question 4

In the context of identification and authentication, which of the following is an example of authentication?

Accepted Answer

Providing a fingerprint scan. Authentication is the process of verifying a claimed identity, typically through something the user knows, has, or is. Providing a fingerprint scan is an example of authentication because it uses a biometric factor to verify the user's identity. The other options are related to identification, not authentication.

Answer

Entering a username

Answer

Being assigned a user ID

Answer

Swiping an access badge

Question 5

Which of the following best describes the purpose of a session timeout?

Accepted Answer

To automatically log out inactive users. A session timeout is a security control that automatically terminates a user's authenticated session after a defined period of inactivity. Its core purpose is to prevent unauthorized access when a user leaves a workstation unattended, reducing the window of opportunity for someone else to use the still-authenticated session. It does not enforce password rules, restrict data by need-to-know, or block brute-force attempts.

Answer

To enforce password complexity

Answer

To restrict access based on need-to-know

Answer

To prevent brute-force attacks

Question 6

A system administrator uses a separate administrative account with elevated privileges only when performing system maintenance, and uses a standard user account for daily activities like email. This practice aligns with which principle?

Accepted Answer

Least privilege. The scenario describes using a separate administrative account with elevated privileges only for system maintenance, while using a standard user account for daily activities like email. This aligns with the principle of least privilege, which dictates that users should be granted only the minimum access rights necessary to perform their job functions, and only for the duration needed. By not using the admin account for routine tasks, the administrator reduces the attack surface and potential damage from accidental or malicious actions.

Answer

Need-to-know

Answer

Defense in depth

Answer

Separation of duties

Question 7

An organization uses Active Directory to manage user accounts. Which protocol does Active Directory primarily use to query and modify directory services?

Accepted Answer

LDAP. Active Directory primarily uses LDAP (Lightweight Directory Access Protocol) to query and modify its directory services. LDAP defines the structure and operations for accessing directory information, and AD implements LDAP v3 as its core access protocol on port 389 (and 636 for LDAPS). Administrative tools and applications use LDAP queries to read and write user, group, and computer objects.

Answer

HTTP

Answer

FTP

Answer

SNMP

Question 8

A visitor signs in at a company's reception, receives a badge, and is escorted throughout the building. This process is part of which type of access control?

Accepted Answer

Physical access control. The scenario describes a visitor signing in, receiving a badge, and being escorted, which are all physical measures to control access to the building. Physical access control encompasses mechanisms like badges, locks, guards, and escorts that restrict physical entry to facilities. Therefore, this process is part of physical access control.

Answer

Technical access control

Answer

Administrative access control

Answer

Logical access control

Question 9

A security analyst is reviewing access control mechanisms. Which TWO of the following are examples of logical access controls? (Select two.)

Accepted Answer

Smart card authentication for system access. B is correct because smart card authentication is a logical (technical) access control that uses a credential and cryptographic verification to grant or deny access to systems and data. D is correct because a password policy enforcing complexity is a logical control that governs how users authenticate electronically, restricting access through technical rules. A is not correct because a security guard is a physical access control (personnel-based). C is not correct because bollards are physical barriers used to control vehicle access. E is not correct because a perimeter fence is a physical access control.

Answer

Security guard at entrance

Answer

Bollards at parking lot

Answer

Perimeter fence

Question 10

An organization is designing a privileged access management (PAM) solution. Which THREE of the following are best practices for managing privileged accounts? (Select three.)

Accepted Answer

Applying the principle of least privilege to admin accounts. Option C is correct because applying the principle of least privilege ensures administrators receive only the minimum rights needed to perform their duties, reducing the attack surface and limiting damage from compromised accounts. Option D is correct because using separate administrative accounts for daily tasks and privileged tasks prevents day-to-day activities such as email and web browsing from exposing highly privileged credentials to malware or phishing. Option E is correct because implementing session recording and monitoring of privileged activities provides accountability, deters insider misuse, and creates an audit trail for forensic investigation of privileged actions. Options A and B are not best practices: sharing the root password among all administrators destroys individual accountability and violates least privilege, while storing privileged passwords in an unencrypted text file exposes them to any user or process with file access and fails basic confidentiality controls.

Answer

Sharing the root password among all administrators for convenience

Answer

Storing privileged passwords in an unencrypted text file

Question 11

A security administrator is configuring user permissions and wants to ensure that each user has only the access rights necessary to perform their job. Which principle is being applied?

Accepted Answer

Least privilege. Least privilege means granting users only the minimum access rights required to perform their job functions, nothing more. This directly matches the scenario where the administrator wants each user to have only the access necessary for their role. It reduces the attack surface and limits potential damage from compromised accounts.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 12

An organization requires that financial transactions over $10,000 be approved by two different managers. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has complete control over a critical action, reducing the risk of fraud or error.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 13

A security engineer is designing a physical security plan. Which combination of controls best represents defense in depth for a data center?

Accepted Answer

Perimeter fencing, access badges at building entrance, biometric reader on server room, and cable locks on servers. Defense in depth involves implementing multiple layers of security controls so that if one layer fails, others still provide protection. The combination of perimeter fencing, access badges at the building entrance, biometric reader on the server room, and cable locks on servers represents multiple physical security layers, from the outer perimeter to the individual server level. This is a classic example of defense in depth.

Answer

Visitor sign-in and escort policy only

Answer

A single high-tech lock on the server room door

Answer

A strong password policy for all employees

Question 14

An account lockout policy is implemented to protect against which type of attack?

Accepted Answer

Brute force. An account lockout policy locks an account after a specified number of failed login attempts (e.g., 5 attempts), which directly thwarts brute-force attacks that rely on trying many password combinations. By locking the account, the attacker is prevented from continuing automated guessing, and the legitimate user or admin is alerted. This is the primary defensive purpose of account lockout.

Answer

Man-in-the-middle

Answer

Social engineering

Answer

Phishing

Question 15

In a directory service using LDAP, what is the distinguished name (DN) for a user named John Smith in the Sales organizational unit of the company domain company.com?

Accepted Answer

CN=John Smith, OU=Sales, DC=company, DC=com. An LDAP distinguished name is written from the most specific component (the leaf object) to the least specific (the root of the directory tree), separated by commas. For John Smith in the Sales OU of company.com, the correct order is CN=John Smith, OU=Sales, DC=company, DC=com. The CN identifies the user object, the OU identifies the organizational unit, and the DC components identify the domain.

Answer

DC=company, DC=com, OU=Sales, CN=John Smith

Answer

OU=Sales, CN=John Smith, DC=company, DC=com

Answer

CN=John Smith, DC=Sales, DC=company, DC=com