ISC2 CC Access Controls Concepts Practice Test 6 — 15 Questions

Question 1

A company implements a policy where no single employee can approve a purchase order over $10,000. Instead, two managers must jointly approve it. Which security principle does this practice exemplify?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 2

An organization uses fencing, bollards, and lighting around the perimeter, guards at the main entrance, and biometric readers on server room doors. This approach is an example of:

Accepted Answer

Defense in depth. Defense in depth employs multiple layers of security to protect assets.

Answer

Separation of duties

Answer

Least privilege

Answer

Need-to-know

Question 3

A security auditor discovers that a user's account has been granted full access to all financial databases, even though the user only needs to view quarterly reports. Which access control principle has been violated most directly?

Accepted Answer

Least privilege. Least privilege requires granting only the minimum permissions necessary to perform job functions.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 4

A company configures its firewall to block all inbound traffic except for specific necessary services. This approach aligns with which access control principle?

Accepted Answer

Least privilege. Least privilege in network security means denying all traffic except explicitly allowed.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 5

Which of the following is the primary purpose of a visitor log and escort policy?

Accepted Answer

To provide a record of visitor access and ensure they are supervised. Visitor management controls physical access and ensures visitors are monitored.

Answer

To enforce least privilege for employees

Answer

To authenticate visitors using biometrics

Answer

To prevent visitors from accessing the internet

Question 6

An organization enforces a password policy requiring a minimum of 15 characters with no complexity requirements, and does not force periodic changes. This policy aligns with which current best practice?

Accepted Answer

Length over complexity and no periodic changes. NIST SP 800-63 recommends favoring length over complexity and avoiding frequent forced changes unless compromised.

Answer

Passwords should be exactly 8 characters with at least one special character

Answer

Passwords should be changed every 30 days

Answer

Complexity requirements are more important than length

Question 7

Which of the following is an example of a logical access control?

Accepted Answer

A password policy. Logical access controls are software-based mechanisms that regulate access to systems or data.

Answer

A fence around a building

Answer

A security guard

Answer

A biometric reader on a door

Question 8

In Active Directory, a GPO is used to enforce a policy that automatically locks user sessions after 15 minutes of inactivity. This is an example of which type of access control?

Accepted Answer

Logical access control. Session timeouts are logical access controls that reduce risk of unauthorized access from unattended workstations.

Answer

Detective access control

Answer

Physical access control

Answer

Administrative access control

Question 9

A user enters a username and password to access a system. Which phase of the access control process does entering the username represent?

Accepted Answer

Identification. Identification is the act of claiming an identity (e.g., username).

Answer

Accounting

Answer

Authentication

Answer

Authorisation

Question 10

An LDAP distinguished name is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. What does OU represent?

Accepted Answer

Organizational Unit. OU stands for Organizational Unit, a container within a directory tree.

Answer

Organization Unit

Answer

Object Unit

Answer

Operating Unit

Question 11

Which account type is considered highest risk and should be protected with strict controls, including separate daily use accounts?

Accepted Answer

Admin/root account. Admin/root accounts have elevated privileges and are high-risk targets.

Answer

Standard user account

Answer

Service account

Answer

Guest account

Question 12

An organisation implements an account lockout policy that locks an account after 5 failed login attempts within 15 minutes. This control is designed to prevent:

Accepted Answer

Brute-force attacks. Account lockout mitigates brute-force password guessing attacks.

Answer

Denial-of-service attacks

Answer

Man-in-the-middle attacks

Answer

Phishing attacks

Question 13

A security architect is designing controls to protect a data center. Which TWO of the following are examples of physical access controls? (Select TWO.)

Accepted Answer

Biometric reader on server room door. Physical access controls include barriers and objects that physically restrict entry.

Answer

Session timeout settings

Answer

Password complexity policy

Answer

Role-based access control (RBAC)

Question 14

Which THREE of the following are best practices for privileged account management? (Select THREE.)

Accepted Answer

Use a Privileged Access Management (PAM) solution to monitor and control admin access. Privileged accounts require special controls like separate accounts, PAM, and least privilege.

Answer

Use the same admin account for daily tasks to simplify management

Answer

Grant administrators full access to all systems at all times for convenience

Question 15

Which TWO of the following are components of the identification and authentication process? (Select TWO.)

Accepted Answer

Password. Identification claims an identity; authentication proves it.

Answer

Group policy

Answer

Access control list (ACL)

Answer

Role-based access control (RBAC)