ISC2 CC Access Controls Concepts Practice Test 7 — 15 Questions

Question 1

An organisation implements an account lockout policy that locks an account after 5 failed login attempts within 15 minutes. This control is designed to prevent:

Accepted Answer

Brute-force attacks. Account lockout after a small number of failed attempts within a short window is a classic brute-force mitigation: it throttles automated password-guessing by making repeated attempts impractical. Brute-force attacks rely on trying many passwords rapidly, so lockout thresholds and time windows directly disrupt that pattern. The control does not address DoS, MITM, or phishing, which operate through different mechanisms.

Answer

Denial-of-service attacks

Answer

Man-in-the-middle attacks

Answer

Phishing attacks

Question 2

A security architect is designing controls to protect a data center. Which TWO of the following are examples of physical access controls? (Select TWO.)

Accepted Answer

Biometric reader on server room door. Option A (biometric reader on server room door) is correct because a biometric reader is a physical authentication mechanism that verifies a person's fingerprint, iris, or other biological trait before granting entry to the server room, making it a classic physical access control. Option B (cable locks on laptops) is correct because a cable lock is a physical restraint that tethers a laptop to a fixed object, deterring theft and unauthorized physical removal of the device. Option C (session timeout settings) is incorrect because it is a logical/technical control that terminates idle sessions, not a physical barrier. Option D (password complexity policy) is incorrect because it is an administrative/logical control governing credential strength. Option E (role-based access control) is incorrect because RBAC is a logical access control model that grants permissions based on job roles, not physical access.

Answer

Session timeout settings

Answer

Password complexity policy

Answer

Role-based access control (RBAC)

Question 3

Which THREE of the following are best practices for privileged account management? (Select THREE.)

Accepted Answer

Use a Privileged Access Management (PAM) solution to monitor and control admin access. Option A is correct because a Privileged Access Management (PAM) solution provides vaulting, session monitoring, recording, and just-in-time elevation of administrative credentials, which are core best practices for controlling and auditing privileged access. Option C is correct because separating administrative accounts from everyday user accounts prevents credential theft from routine activities like email and web browsing from directly yielding privileged access, and it supports non-repudiation of admin actions. Option E is correct because applying the principle of least privilege ensures administrators receive only the rights required for their specific role, reducing the attack surface and limiting lateral movement if an admin account is compromised. Option B is not a best practice because reusing a single admin account for daily tasks exposes high-privilege credentials to phishing, malware, and credential-dumping attacks. Option D is not a best practice because granting permanent full access to all systems violates least privilege and removes accountability, making misuse or compromise far more damaging.

Answer

Use the same admin account for daily tasks to simplify management

Answer

Grant administrators full access to all systems at all times for convenience

Question 4

Which TWO of the following are components of the identification and authentication process? (Select TWO.)

Accepted Answer

Password. The identification and authentication process consists of two distinct steps: identification, where a subject claims an identity, and authentication, where that claim is verified. Option B (Username) is correct because the username is the identifier — the claim of identity presented during the identification step. Option A (Password) is correct because the password is the authenticator — the secret credential verified against the stored value during the authentication step. Option C (Group policy) is incorrect because it is a management mechanism for enforcing configuration and security settings, not a component of identification or authentication. Option D (Access control list, ACL) is incorrect because an ACL is an authorization mechanism that specifies which subjects may access which objects, operating after authentication completes. Option E (Role-based access control, RBAC) is incorrect because RBAC is an authorization model that grants permissions based on roles, not part of proving identity.

Answer

Group policy

Answer

Access control list (ACL)

Answer

Role-based access control (RBAC)

Question 5

A security administrator is configuring access rights for a new employee. Which principle ensures the employee is granted only the minimum permissions necessary to perform their job duties?

Accepted Answer

Least privilege. The principle of least privilege states that a user should be granted only the minimum permissions necessary to perform their job duties. This limits the potential damage from accidents, errors, or malicious activity by ensuring users cannot access resources beyond their scope of work. It is a foundational security principle applied across systems, including access rights for new employees.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 6

An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the principle that no single individual should have enough privileges to complete a sensitive transaction alone; it requires splitting critical tasks among multiple people. Here, one employee initiates and a different manager approves, which is the textbook definition of SoD. It prevents fraud and errors by ensuring collusion is needed to abuse the process.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 7

A system administrator has an account with full administrative privileges. To reduce risk, the organization implements a policy requiring the admin to use a separate, non-privileged account for daily tasks like email and web browsing. This practice aligns with which principle?

Accepted Answer

Least privilege. Using a separate non-privileged account for daily tasks like email and web browsing while reserving the admin account for administrative work is a direct application of least privilege. Least privilege means users should have only the minimum access necessary for their current task, and separating admin from daily use reduces the attack surface of privileged credentials. This practice limits exposure of administrative rights to routine activities that could be compromised.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 8

A company's physical security includes fencing, security guards, access badges, and biometric locks on server room doors. This layered approach is an example of which access control concept?

Accepted Answer

Defense in depth. Defense in depth is the practice of layering multiple independent security controls so that if one fails, others still protect the asset. Fencing, guards, badges, and biometric locks each represent a different layer (perimeter, personnel, logical/physical entry, and biometric), and together they create overlapping protection for the server room. This layered approach is the defining characteristic of defense in depth.

Answer

Least privilege

Answer

Need-to-know

Answer

Separation of duties

Question 9

In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?

Accepted Answer

Organizational Units (OUs). Organizational Units (OUs) are the container objects within Active Directory that provide the hierarchical structure used to organize users, groups, computers, and other objects. Because Group Policy can be linked directly to an OU, it is the primary mechanism for scoping policy application to a subset of the directory. This makes OUs the correct answer for organizing objects hierarchically for policy purposes.

Answer

Group Policy Objects (GPOs)

Answer

Domain controllers

Answer

LDAP

Question 10

An organization's password policy requires passwords to be at least 8 characters long and prohibits common passwords found in breach databases. This policy aligns with which guideline?

Accepted Answer

NIST SP 800-63. NIST SP 800-63 (Digital Identity Guidelines) explicitly addresses authenticator and memorized-secret requirements, including minimum length and screening against breached-password lists (e.g., in SP 800-63B, section 5.1.1.2). The described policy — 8-character minimum plus blocklist of common/breached passwords — mirrors NIST's guidance almost verbatim.

Answer

COBIT

Answer

ISO 27001

Answer

PCI DSS

Question 11

A security analyst notices repeated failed login attempts from a single IP address. The account is locked after 10 failed attempts. This is an example of which type of control?

Accepted Answer

Logical access control. Account lockout after repeated failed logins is enforced by software (the operating system or application authentication logic), making it a logical access control. Logical controls govern access to systems and data through technical means such as passwords, lockout policies, and permissions, as opposed to physical or administrative controls.

Answer

Compensating control

Answer

Physical access control

Answer

Administrative control

Question 12

An employee uses their username to claim an identity and then enters a password to prove it. What is the term for the process of proving the claimed identity?

Accepted Answer

Authentication. Authentication is the process of verifying a claimed identity, typically by validating one or more factors such as something you know (password), something you have (token), or something you are (biometric). When the employee enters a password to prove the username they claimed, that verification step is authentication. Identification is the act of claiming the identity; authentication proves it.

Answer

Authorization

Answer

Accounting

Answer

Identification

Question 13

A visitor enters a company building and is required to sign in, present identification, and wear a visitor badge. This is an example of which type of access control?

Accepted Answer

Physical access control. Physical access control governs access to tangible facilities, buildings, rooms, and equipment, and the scenario describes exactly that: a visitor signing in, showing ID, and wearing a badge to enter a company building. These are physical safeguards designed to control who can enter a physical space. Logical, administrative, and technical controls address different domains such as systems, policies, and technology enforcement.

Answer

Logical access control

Answer

Administrative control

Answer

Technical control

Question 14

In an LDAP directory, an entry is represented as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Accepted Answer

Common Name. In LDAP Distinguished Names (DNs), CN stands for Common Name, which identifies the specific object or entity within the directory hierarchy — in this case, the user 'John Smith'. LDAP DNs are read right-to-left, with the most specific attribute (CN) appearing first and the root domain components (DC) appearing last. CN is one of the most frequently used RDN (Relative Distinguished Name) attributes for naming users, groups, and other objects.

Answer

Container Name

Answer

Country Name

Answer

Context Name

Question 15

A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Fencing around the building. Fencing around the building (A) is a valid physical security layer because it establishes the outermost perimeter control, deterring and delaying unauthorized access before an attacker can reach the facility itself. A biometric reader on the server room door (E) is also correct because it enforces an authentication-based access control at the innermost physical layer, ensuring only authorized personnel can enter the room housing the servers. Together these represent defense-in-depth at the perimeter and at the asset boundary. The remaining options are logical/technical controls rather than physical layers: a complex password policy (B) governs authentication credentials, cable locks on individual servers (C) are a device-level physical tether but not a room/building security layer in this context, and session timeout settings (D) are logical access controls that terminate idle sessions.

Answer

Complex password policy

Answer

Cable locks on individual servers

Answer

Session timeout settings