ISC2 CC Access Controls Concepts Practice Test 4 — 15 Questions

Question 1

A security administrator is configuring user permissions and wants to ensure that each user has only the access rights necessary to perform their job. Which principle is being applied?

Accepted Answer

Least privilege. Least privilege means granting only the minimum permissions needed for a user to perform their job, reducing the potential impact of a compromised account.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 2

An organization requires that financial transactions over $10,000 be approved by two different managers. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has complete control over a critical action, reducing the risk of fraud or error.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 3

A security engineer is designing a physical security plan. Which combination of controls best represents defense in depth for a data center?

Accepted Answer

Perimeter fencing, access badges at building entrance, biometric reader on server room, and cable locks on servers. Defense in depth uses multiple, overlapping controls. Perimeter fencing, access badges, biometric readers, and cable locks each address different layers, providing redundancy.

Answer

Visitor sign-in and escort policy only

Answer

A single high-tech lock on the server room door

Answer

A strong password policy for all employees

Question 4

Which of the following is an example of a logical access control?

Accepted Answer

Password complexity requirements. Logical access controls are software-based mechanisms that restrict access to systems and data. Passwords are a common logical control.

Answer

Biometric reader on a door

Answer

Fencing around a building

Answer

Security guards

Question 5

According to NIST SP 800-63, which password policy is most effective for user authentication?

Accepted Answer

Require a minimum length of 15 characters and check against breached password lists, without requiring complexity or frequent changes. NIST SP 800-63 recommends favoring longer passwords (15+ characters for high assurance) over complexity, and avoiding frequent forced changes unless compromised.

Answer

Require a mix of uppercase, lowercase, numbers, and symbols, and force password changes every 30 days

Answer

Require a minimum length of 6 characters with no other requirements

Answer

Require a minimum length of 8 characters and check against breached password lists

Question 6

An account lockout policy is implemented to protect against which type of attack?

Accepted Answer

Brute force. Account lockout detects and prevents brute-force attacks by disabling the account after a threshold of failed attempts.

Answer

Man-in-the-middle

Answer

Social engineering

Answer

Phishing

Question 7

In a directory service using LDAP, what is the distinguished name (DN) for a user named John Smith in the Sales organizational unit of the company domain company.com?

Accepted Answer

CN=John Smith, OU=Sales, DC=company, DC=com. The DN format includes CN (common name), OU (organizational unit), and DC (domain components) in order from specific to general.

Answer

DC=company, DC=com, OU=Sales, CN=John Smith

Answer

OU=Sales, CN=John Smith, DC=company, DC=com

Answer

CN=John Smith, DC=Sales, DC=company, DC=com

Question 8

Which process involves verifying the identity of a user who claims to be a specific person?

Accepted Answer

Authentication. Authentication is the process of proving a claimed identity, typically with passwords, biometrics, or tokens.

Answer

Authorization

Answer

Identification

Answer

Accounting

Question 9

A company implements a policy where users must swipe their access card and then enter a PIN to enter the data center. This is an example of:

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more factors: something you have (card) and something you know (PIN).

Answer

Biometric authentication

Answer

Single sign-on

Answer

Single-factor authentication

Question 10

An administrator configures a Group Policy Object (GPO) in Active Directory to enforce account lockout after 5 failed attempts within 15 minutes. Which type of control is this?

Accepted Answer

Logical access control. Logical access controls are software-based mechanisms that govern access to systems. Account lockout policies are logical controls.

Answer

Administrative access control

Answer

Compensating control

Answer

Physical access control

Question 11

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

To control and monitor privileged access to critical systems. PAM controls and monitors the use of privileged accounts (e.g., admin) to reduce risk of misuse or compromise.

Answer

To provide single sign-on for all applications

Answer

To manage visitor access to the building

Answer

To enforce password complexity for all users

Question 12

Which access control principle restricts access to data based on the user's job role and tasks?

Accepted Answer

Need to know. Need-to-know restricts access to data only when necessary for job tasks, separate from least privilege which focuses on permissions.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 13

A security analyst is reviewing physical security controls. Which TWO are examples of perimeter physical controls? (Select TWO.)

Accepted Answer

Fencing around the property. Perimeter controls secure the outer boundary. Fencing and lighting are common perimeter controls; badges and biometrics are interior or point-of-entry controls.

Answer

Access badges at building entrance

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Question 14

An organization is implementing a visitor management policy. Which THREE should be included? (Select THREE.)

Accepted Answer

Issuance of temporary visitor badges. Visitor management typically includes sign-in, escort policies, and visitor badges to track and control visitor access.

Answer

Background checks for all visitors

Answer

Biometric authentication for visitors

Question 15

According to NIST SP 800-63 recommendations for password policies, which THREE practices are recommended? (Select THREE.)

Accepted Answer

Allow users to paste passwords to facilitate password manager use. NIST SP 800-63 recommends checking passwords against breached lists, setting minimum length (8+ characters, 15+ for high assurance), and avoiding frequent forced changes unless compromised.

Answer

Require complex combinations of uppercase, lowercase, numbers, and symbols

Answer

Require frequent password changes every 30 days