ISC2 CC Access Controls Concepts Practice Test 6 — 15 Questions

Question 1

A Privileged Access Management (PAM) solution is used to:

Accepted Answer

Control and monitor privileged accounts and sessions. PAM solutions control, monitor, and audit privileged access to critical systems.

Answer

Encrypt data at rest

Answer

Manage user passwords and enforce complexity

Answer

Provide single sign-on for all applications

Question 2

An organization wants to ensure that even if an attacker compromises a user's account, the damage is limited. Which principle is most directly applied?

Accepted Answer

Least privilege. Least privilege is the principle of granting users only the minimum access rights necessary to perform their job functions. If an attacker compromises a user's account, the damage is limited because the account has restricted permissions. This directly addresses limiting damage from a compromised account.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 3

A security analyst is reviewing physical security controls. Which TWO are considered layered physical security measures for external perimeter protection?

Accepted Answer

Fencing around the property. Fencing around the property (A) is a correct answer because it is a perimeter-layer physical control that establishes a physical boundary and delays or deters intruders before they reach the facility. Lighting in parking lots (B) is also correct because exterior lighting is a classic layered perimeter control that deters intruders, removes concealment, and supports CCTV or guard surveillance. Together, fencing and lighting represent complementary external perimeter defenses that support defense in depth. The unmarked options do not belong because a biometric reader on a server room door (C) is an interior access control for a specific high-security room, not an external perimeter measure, while cable locks on laptops (D) and chassis locks on servers (E) are asset-level physical controls that protect individual devices rather than the external perimeter.

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Answer

Chassis locks on servers

Question 4

Which THREE are recommended practices for password policies according to current guidelines?

Accepted Answer

Check passwords against lists of known breached passwords. Option A is correct because current NIST SP 800-63B guidance requires screening new passwords against lists of known compromised or breached passwords (such as those from Have I Been Pwned) and rejecting any that match. Option B is correct because NIST sets the minimum password length at 8 characters when a password is used as a single-factor authenticator. Option D is correct because NIST recommends permitting passwords up to at least 64 characters, allowing the use of long passphrases and password managers. Option C is not recommended because composition rules (mixing uppercase, numbers, and special characters) are now discouraged as they push users toward predictable patterns. Option E is not recommended because arbitrary periodic rotation (for example, every 30 days) is discouraged; changes should only be forced when there is evidence of compromise.

Answer

Require at least one uppercase letter, one number, and one special character

Answer

Force password changes every 30 days

Question 5

An organization wants to implement defense in depth for its server room. Which THREE controls should be included?

Accepted Answer

Cable locks on all servers. A is correct because cable locks are a physical (environmental) control that deters and prevents theft or removal of server hardware, directly supporting defense in depth at the server-room layer. D is correct because CCTV monitoring provides detective and deterrent physical security, recording activity inside the server room so incidents can be identified and investigated. E is correct because biometric access control on the server room door enforces strong, identity-based physical access control (something you are), restricting entry to authorized personnel. B does not belong because Group Policy password complexity is a logical/technical control for user authentication, not a server-room physical control. C does not belong because a visitor sign-in log at the front desk is an administrative control for the building entrance, not a control protecting the server room itself.

Answer

Group Policy to enforce password complexity

Answer

Visitor sign-in log at the front desk

Question 6

A company implements a policy where no single employee can approve a purchase order over $10,000. Instead, two managers must jointly approve it. Which security principle does this practice exemplify?

Accepted Answer

Separation of duties. Separation of duties is a security principle that prevents a single individual from having control over all aspects of a critical transaction. By requiring two managers to jointly approve a purchase order over $10,000, the company ensures that no single person can commit fraud or error without detection. This is a classic example of separation of duties, also known as segregation of duties.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 7

An organization uses fencing, bollards, and lighting around the perimeter, guards at the main entrance, and biometric readers on server room doors. This approach is an example of:

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple overlapping controls are deployed so that if one fails, others still protect the asset. The scenario shows physical perimeter controls (fencing, bollards, lighting), personnel controls (guards), and logical/physical access controls (biometric readers) — clearly multiple layers. This matches the core definition of defense in depth.

Answer

Separation of duties

Answer

Least privilege

Answer

Need-to-know

Question 8

A security auditor discovers that a user's account has been granted full access to all financial databases, even though the user only needs to view quarterly reports. Which access control principle has been violated most directly?

Accepted Answer

Least privilege. Least privilege requires granting only the minimum permissions necessary to perform job functions.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 9

A company configures its firewall to block all inbound traffic except for specific necessary services. This approach aligns with which access control principle?

Accepted Answer

Least privilege. Blocking all inbound traffic except explicitly required services is the definition of least privilege applied to network access control — granting only the minimum access necessary for business function. The firewall default-deny with specific allow rules embodies this principle by minimizing the attack surface.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 10

Which of the following is the primary purpose of a visitor log and escort policy?

Accepted Answer

To provide a record of visitor access and ensure they are supervised. The primary purpose of a visitor log and escort policy is to maintain a record of who enters a facility and when, and to ensure that visitors are supervised by authorized personnel while on-site. This supports physical security by preventing unauthorized access, enabling accountability, and ensuring that visitors do not wander into restricted areas without an escort.

Answer

To enforce least privilege for employees

Answer

To authenticate visitors using biometrics

Answer

To prevent visitors from accessing the internet

Question 11

An organization enforces a password policy requiring a minimum of 15 characters with no complexity requirements, and does not force periodic changes. This policy aligns with which current best practice?

Accepted Answer

Length over complexity and no periodic changes. Current NIST SP 800-63B guidance recommends favoring password length over complexity and eliminating forced periodic rotation, because long passphrases resist brute-force and dictionary attacks better than short complex strings, and frequent changes lead users to predictable patterns (e.g., Password1!, Password2!). A 15-character minimum with no complexity rules and no forced expiration aligns with this modern best practice.

Answer

Passwords should be exactly 8 characters with at least one special character

Answer

Passwords should be changed every 30 days

Answer

Complexity requirements are more important than length

Question 12

In Active Directory, a GPO is used to enforce a policy that automatically locks user sessions after 15 minutes of inactivity. This is an example of which type of access control?

Accepted Answer

Logical access control. A GPO-enforced session lock is a logical access control because it is implemented in software/OS policy and governs how users interact with system resources after authentication. Logical controls include passwords, permissions, encryption, and session policies, all enforced by the operating system or applications rather than physical barriers or administrative procedures.

Answer

Detective access control

Answer

Physical access control

Answer

Administrative access control

Question 13

A user enters a username and password to access a system. Which phase of the access control process does entering the username represent?

Accepted Answer

Identification. Entering a username is the act of claiming an identity to the system, which is the identification phase. Authentication is the subsequent step where the password is verified to prove that claimed identity.

Answer

Accounting

Answer

Authentication

Answer

Authorisation

Question 14

An LDAP distinguished name is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. What does OU represent?

Accepted Answer

Organizational Unit. In LDAP distinguished names, OU stands for 'Organizational Unit'. An OU is a container object within a directory that is used to organize entries such as users, groups, and computers. In the DN 'CN=John Smith,OU=Sales,DC=company,DC=com', the OU=Sales indicates that John Smith resides in the Sales organizational unit within the company.com domain.

Answer

Organization Unit

Answer

Object Unit

Answer

Operating Unit

Question 15

Which account type is considered highest risk and should be protected with strict controls, including separate daily use accounts?

Accepted Answer

Admin/root account. Admin/root accounts have unrestricted privileges over systems, data, and configurations, making them the highest-value target for attackers — compromise grants full control. Best practice is to protect them with strict controls (MFA, privileged access workstations, just-in-time elevation) and use separate, non-privileged accounts for daily tasks like email and browsing.

Answer

Standard user account

Answer

Service account

Answer

Guest account