ISC2 CC Access Controls Concepts Practice Test 7 — 15 Questions

Question 1

A security administrator is configuring access rights for a new employee. Which principle ensures the employee is granted only the minimum permissions necessary to perform their job duties?

Accepted Answer

Least privilege. Least privilege means granting only the minimum permissions needed, reducing the blast radius of account compromise.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 2

An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties ensures no single individual can complete a high-risk action alone, reducing fraud risk.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 3

A system administrator has an account with full administrative privileges. To reduce risk, the organization implements a policy requiring the admin to use a separate, non-privileged account for daily tasks like email and web browsing. This practice aligns with which principle?

Accepted Answer

Least privilege. Least privilege for administrators means using a separate admin account only when needed, limiting exposure of high-privilege credentials.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 4

A company's physical security includes fencing, security guards, access badges, and biometric locks on server room doors. This layered approach is an example of which access control concept?

Accepted Answer

Defense in depth. Defense in depth uses multiple overlapping physical and logical controls to protect assets.

Answer

Least privilege

Answer

Need-to-know

Answer

Separation of duties

Question 5

In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?

Accepted Answer

Organizational Units (OUs). Organizational Units (OUs) are containers in Active Directory that allow hierarchical organization and Group Policy application.

Answer

Group Policy Objects (GPOs)

Answer

Domain controllers

Answer

LDAP

Question 6

An organization's password policy requires passwords to be at least 8 characters long and prohibits common passwords found in breach databases. This policy aligns with which guideline?

Accepted Answer

NIST SP 800-63. NIST SP 800-63 recommends favoring length over complexity, minimum 8 characters, and checking passwords against known breached lists.

Answer

COBIT

Answer

ISO 27001

Answer

PCI DSS

Question 7

A security analyst notices repeated failed login attempts from a single IP address. The account is locked after 10 failed attempts. This is an example of which type of control?

Accepted Answer

Logical access control. Account lockout is a logical access control that detects and mitigates brute-force attacks.

Answer

Compensating control

Answer

Physical access control

Answer

Administrative control

Question 8

An employee uses their username to claim an identity and then enters a password to prove it. What is the term for the process of proving the claimed identity?

Accepted Answer

Authentication. Authentication is the process of proving a claimed identity (e.g., via password, biometric).

Answer

Authorization

Answer

Accounting

Answer

Identification

Question 9

A visitor enters a company building and is required to sign in, present identification, and wear a visitor badge. This is an example of which type of access control?

Accepted Answer

Physical access control. Visitor management procedures are part of physical access controls to monitor and restrict entry.

Answer

Logical access control

Answer

Administrative control

Answer

Technical control

Question 10

In an LDAP directory, an entry is represented as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Accepted Answer

Common Name. In LDAP, CN stands for Common Name, which is a component of the distinguished name.

Answer

Container Name

Answer

Country Name

Answer

Context Name

Question 11

A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Fencing around the building. Defense in depth uses multiple layers. External perimeter (fencing) and internal server room (biometric) are distinct layers.

Answer

Complex password policy

Answer

Cable locks on individual servers

Answer

Session timeout settings

Question 12

Which TWO are examples of logical access controls? (Select TWO.)

Accepted Answer

Password complexity requirements. Logical controls are software-based. Passwords and account lockout are logical.

Answer

Fencing around the property

Answer

Guard at building entrance

Answer

Biometric door lock

Question 13

Which THREE are key components of Active Directory? (Select THREE.)

Accepted Answer

Users. Active Directory includes users, groups, and organizational units (OUs). LDAP is a protocol, not a component.

Answer

Firewalls

Answer

LDAP

Question 14

A security architect is designing an access control policy based on the principle of need-to-know. Which TWO practices support this principle? (Select TWO.)

Accepted Answer

Implementing data classification labels. Need-to-know means only accessing data necessary for job functions. Data classification and role-based access help enforce this.

Answer

Using a single sign-on solution

Answer

Requiring two-factor authentication

Answer

Granting all employees access to the company directory

Question 15

Which THREE are best practices for password management according to modern guidelines? (Select THREE.)

Accepted Answer

Enforce a minimum password length of 8 characters. Modern guidelines (NIST SP 800-63) recommend length over complexity, no frequent changes, and checking against breach lists.

Answer

Require at least one uppercase, one lowercase, one digit, and one special character

Answer

Require passwords to be changed every 30 days