ISC2 CC Access Controls Concepts Practice Test 5 — 15 Questions

Question 1

Which process involves verifying the identity of a user who claims to be a specific person?

Accepted Answer

Authentication. Authentication is the process of verifying that a user's claimed identity is genuine, typically by validating credentials such as a password, token, or biometric factor against stored data. It answers the question 'Are you really who you say you are?' and occurs after identification but before authorization. This is the core definition tested in the CIA triad's access control model.

Answer

Authorization

Answer

Identification

Answer

Accounting

Question 2

An administrator configures a Group Policy Object (GPO) in Active Directory to enforce account lockout after 5 failed attempts within 15 minutes. Which type of control is this?

Accepted Answer

Logical access control. Logical access controls are software-based mechanisms that govern access to systems. Account lockout policies are logical controls.

Answer

Administrative access control

Answer

Compensating control

Answer

Physical access control

Question 3

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

To control and monitor privileged access to critical systems. A Privileged Access Management (PAM) solution is specifically designed to secure, control, and monitor the use of privileged accounts—such as root, administrator, or service accounts—that have elevated access to critical systems. It typically provides features like credential vaulting, session recording, just-in-time access, and approval workflows to prevent misuse and detect malicious activity. Unlike general IAM or SSO tools, PAM focuses on the highest-risk accounts and enforces least privilege for administrative actions. Thus, option D accurately captures its primary purpose.

Answer

To provide single sign-on for all applications

Answer

To manage visitor access to the building

Answer

To enforce password complexity for all users

Question 4

Which access control principle restricts access to data based on the user's job role and tasks?

Accepted Answer

Need to know. Need to know restricts access based on the specific data a user requires to perform their job tasks, which is exactly what the question describes. It is narrower than least privilege: least privilege limits the level of access (e.g., read vs. write), while need to know limits which specific data the user can see.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 5

A security analyst is reviewing physical security controls. Which TWO are examples of perimeter physical controls? (Select TWO.)

Accepted Answer

Fencing around the property. Option D (fencing around the property) is correct because fencing is a classic perimeter control that establishes a physical boundary and deters or delays unauthorized entry to the site. Option E (lighting in the parking lot) is correct because exterior lighting is a perimeter control that illuminates the outer grounds, deterring intruders and enabling surveillance of approaches to the facility. Option A (access badges at building entrance) is not a perimeter control but an access control at a building entry point, which is a more interior layer of defense. Option B (biometric reader on server room door) is an interior access control protecting a high-value asset, not the site perimeter. Option C (cable locks on laptops) is an asset-level physical control for portable devices, not a perimeter control.

Answer

Access badges at building entrance

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Question 6

An organization is implementing a visitor management policy. Which THREE should be included? (Select THREE.)

Accepted Answer

Issuance of temporary visitor badges. Option B (issuance of temporary visitor badges) is correct because a visitor management policy must provide a means of visually identifying non-employees, and temporary badges with expiration dates or distinct colors let staff distinguish visitors from employees and enforce access limits. Option C (visitor sign-in with host notification) is correct because logging each visitor's identity, time of entry, and purpose, then alerting the internal host, creates an audit trail and ensures visitors are expected and accounted for. Option D (escort policy requiring visitors to be accompanied) is correct because requiring visitors to remain with an authorized employee prevents unescorted access to sensitive areas and is a standard physical security control. Option A is not appropriate because background checks for all visitors are disproportionate and operationally impractical for routine guests such as delivery personnel or interview candidates. Option E is not appropriate because biometric authentication for visitors is costly, raises privacy and consent concerns, and is unnecessary when badges, sign-in, and escorts already provide adequate control.

Answer

Background checks for all visitors

Answer

Biometric authentication for visitors

Question 7

According to NIST SP 800-63 recommendations for password policies, which THREE practices are recommended? (Select THREE.)

Accepted Answer

Allow users to paste passwords to facilitate password manager use. Option A is correct because NIST SP 800-63B explicitly recommends permitting "paste" functionality in password fields so that users can employ password managers, which generate and store strong, unique credentials. Option B is correct because the guideline requires verifiers to compare prospective passwords against lists of commonly used, expected, or compromised passwords (e.g., breach corpora) and reject matches. Option E is correct because NIST sets a minimum password length of 8 characters for user-chosen secrets, while encouraging longer passphrases (up to at least 64 characters). Option C is not recommended because NIST advises against composition rules mandating mixed uppercase, lowercase, digits, and symbols, since they push users toward predictable patterns. Option D is not recommended because NIST discourages forced periodic rotation (e.g., every 30 days) absent evidence of compromise, as it weakens password quality.

Answer

Require complex combinations of uppercase, lowercase, numbers, and symbols

Answer

Require frequent password changes every 30 days

Question 8

Which access control principle ensures that a user is granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege dictates that users are granted only the minimum permissions necessary to perform their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions.

Answer

Need-to-know

Answer

Defense in depth

Answer

Separation of duties

Question 9

A security administrator is implementing controls to prevent a single employee from approving and disbursing payments. Which principle is being applied?

Accepted Answer

Separation of duties. Separation of duties is the principle that no single individual should have control over all aspects of a critical process. By preventing one employee from both approving and disbursing payments, the company ensures that multiple people are involved, reducing the risk of fraud or error.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 10

A company requires all visitors to sign in, wear a visible badge, and be escorted while on premises. This is an example of:

Accepted Answer

Visitor management. Visitor management encompasses the administrative and physical controls used to register, badge, and escort non-employees on premises — exactly the sign-in, badge, and escort requirements described. It is a physical security control category focused on controlling and tracking visitors.

Answer

Separation of duties

Answer

Logical access control

Answer

Defense in depth

Question 11

According to NIST SP 800-63, which password policy is recommended to enhance security?

Accepted Answer

Favor length over complexity and check against breached password lists. NIST SP 800-63B recommends favoring password length over complexity and screening new passwords against lists of commonly used and breached passwords. Length increases entropy far more effectively than forcing special characters, and breach-list checks block credentials attackers already possess. The same guidance also discourages forced periodic rotation absent evidence of compromise.

Answer

Allow passwords as short as 4 characters

Answer

Enforce maximum complexity with special characters and numbers

Answer

Require frequent password changes every 30 days

Question 12

An account lockout policy is designed to mitigate which type of attack?

Accepted Answer

Brute force. An account lockout policy locks a user account after a specified number of failed login attempts, which mitigates brute force attacks by preventing attackers from making unlimited password guesses. Brute force attacks rely on trying many combinations; lockout stops this after a few attempts.

Answer

SQL injection

Answer

Man-in-the-middle

Answer

Phishing

Question 13

A session timeout automatically logs out a user after a period of inactivity. This control primarily protects against:

Accepted Answer

Unauthorized access from an unattended workstation. A session timeout logs a user out after inactivity, so if they walk away from an unattended workstation, an attacker cannot continue using the already-authenticated session. This directly mitigates the risk of unauthorized physical access to a logged-in session on an unattended device.

Answer

Password cracking

Answer

Brute force attacks

Answer

Shoulder surfing

Question 14

In the identification and authentication process, which step occurs first?

Accepted Answer

Identification. Identification is the first step because the user must claim an identity (e.g., username) before the system can authenticate it. Authentication verifies that claim, authorization determines what the user can do, and accounting logs the activity — all of which depend on identification occurring first.

Answer

Accounting

Answer

Authentication

Answer

Authorization

Question 15

An LDAP distinguished name (DN) is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. Which component represents the organizational unit?

Accepted Answer

OU=Sales. In an LDAP distinguished name (DN), each component is identified by its attribute type. The organizational unit (OU) is represented by the 'OU=' attribute. In the given DN, 'OU=Sales' explicitly designates the organizational unit named 'Sales'.

Answer

DC=com

Answer

CN=John Smith

Answer

DC=company