ISC2 CC Access Controls Concepts Practice Test 8 — 15 Questions

Question 1

Which TWO are examples of logical access controls? (Select TWO.)

Accepted Answer

Password complexity requirements. Password complexity requirements (B) are a logical access control because they are enforced in software by the operating system or directory service (e.g., via Group Policy password policy or /etc/security/pwquality.conf) to govern how a user authenticates, not to physically restrict movement. Account lockout policy (E) is likewise logical: it is a software-enforced setting that disables an account after a defined number of failed logon attempts within a set window, mitigating brute-force attacks against the authentication process. Both operate on the logical layer of identity and authentication rather than on physical barriers. By contrast, fencing around the property (A), a guard at the building entrance (C), and a biometric door lock (D) are physical access controls, since they restrict who can physically enter a location or structure.

Answer

Fencing around the property

Answer

Guard at building entrance

Answer

Biometric door lock

Question 2

Which THREE are key components of Active Directory? (Select THREE.)

Accepted Answer

Users. Users (A) are a core Active Directory object class representing security principals that authenticate and receive permissions, so they are a key component. Groups (C) are also essential AD objects used to aggregate users and other principals for efficient permission assignment and role-based access control. Organizational Units (E) are container objects that provide the hierarchical structure for organizing users, groups, computers, and other objects, and for delegating administration and applying Group Policy. Firewalls (B) are network security devices, not AD components, and LDAP (D) is a directory access protocol that AD supports and uses, but it is not itself a component of Active Directory.

Answer

Firewalls

Answer

LDAP

Question 3

A security architect is designing an access control policy based on the principle of need-to-know. Which TWO practices support this principle? (Select TWO.)

Accepted Answer

Implementing data classification labels. Option A is correct because implementing data classification labels (e.g., Public, Internal, Confidential, Restricted) tags information with its sensitivity level, which is the foundation for need-to-know decisions—users are only granted access to data whose classification matches their role and clearance. Option E is correct because restricting customer data access to only customer support staff is a direct application of need-to-know: access is limited to those whose job function requires that data, excluding other employees. Option B (single sign-on) is an authentication convenience that centralizes login but does not by itself limit access to only what a user needs. Option C (two-factor authentication) strengthens identity verification but addresses authentication assurance, not authorization scope. Option D (granting all employees access to the company directory) violates need-to-know by giving broad access regardless of job requirement.

Answer

Using a single sign-on solution

Answer

Requiring two-factor authentication

Answer

Granting all employees access to the company directory

Question 4

A security auditor is reviewing access controls at a financial institution. The auditor identifies a scenario where one employee can initiate a payment transaction, and the same employee can also approve it. Which access control principle is being violated, and what is the primary risk?

Accepted Answer

Separation of duties; risk of fraud. Separation of duties requires that critical tasks be split among multiple people so no single individual can complete a sensitive transaction end-to-end. Here, one employee can both initiate and approve a payment, violating that principle and creating a direct fraud risk since they could authorize unauthorized payments. This is a classic internal-controls failure in financial environments.

Answer

Defense in depth; risk of single point of failure

Answer

Need-to-know; risk of data exposure

Answer

Least privilege; risk of excessive permissions

Answer

Privileged access management; risk of account compromise

Question 5

A company's security policy requires that employees use only the minimum permissions needed to perform their job functions. This practice reduces the potential impact if an account is compromised. Which TWO access control principles are being applied?

Accepted Answer

Need-to-know. Option E, least privilege, is correct because the policy explicitly states that employees should be granted only the minimum permissions required to perform their job functions, which is the exact definition of the least privilege principle. Option D, need-to-know, is correct because it restricts access to information and resources only to those who require them for their job duties, complementing least privilege by limiting data exposure. Together, these principles reduce the attack surface and potential impact if an account is compromised. Option A, defense in depth, is not correct because it refers to layering multiple security controls rather than limiting permissions. Option B, separation of duties, is not correct because it involves dividing tasks among different individuals to prevent fraud or error, not minimizing permissions. Option C, privileged access management, is not correct because it focuses on managing and monitoring elevated accounts, not on the general principle of minimum permissions for all employees.

Answer

Defense in depth

Answer

Separation of duties

Answer

Privileged access management

Question 6

An organization wants to implement layered physical security for its data center. Which THREE of the following controls would be considered part of a defense-in-depth physical security strategy?

Accepted Answer

Cable locks on laptop computers. Option A (cable locks on laptop computers) is correct because a cable lock is a physical deterrent that secures a portable asset to a fixed object, adding a layer of physical defense against theft. Option D (biometric reader at the server room door) is correct because it is a physical access control that authenticates identity via a biological characteristic before granting entry to a restricted area. Option E (fencing and bollards around the building) is correct because perimeter barriers such as fences and bollards are classic physical controls that deter, delay, and prevent unauthorized access or vehicle-borne threats. Option B (password complexity requirements) is not a physical control but a logical/administrative authentication control, and Option C (visitor sign-in log) is an administrative control that records entry rather than physically preventing or deterring access.

Answer

Password complexity requirements

Answer

Visitor sign-in log

Question 7

A system administrator is configuring account lockout policies to mitigate brute-force attacks. Which TWO settings are most critical for this purpose?

Accepted Answer

Account lockout threshold (e.g., 5 failed attempts). Option B, the account lockout threshold (e.g., 5 failed attempts), is correct because it directly limits how many incorrect password guesses an attacker can make before the account is disabled, which is the core mechanism that stops brute-force attempts. Option C, lockout duration (e.g., 30 minutes) or administrator unlock, is correct because it determines how long the account stays locked; without a duration or manual unlock requirement, the lockout either never ends or can be trivially bypassed, so it works together with the threshold to make brute-forcing impractical. The unmarked options do not belong because A (90-day password changes), D (password history of 10), and E (minimum length of 8) are password policy settings that improve password strength and prevent reuse, but they do not detect or block repeated failed authentication attempts, which is what account lockout specifically addresses.

Answer

Requiring password changes every 90 days

Answer

Password history of 10 remembered passwords

Answer

Password minimum length of 8 characters

Question 8

An employee claims to have accessed a confidential document that is not related to their job role. The security team investigates and finds that the employee's account had read access to the folder containing the document. Which TWO access control concepts were likely violated?

Accepted Answer

Need-to-know. The scenario describes an employee who could read a confidential document unrelated to their job role, which directly violates the need-to-know principle (B) because access to information should be granted only to those who require it to perform their duties. It also violates the principle of least privilege (D), since the account was granted read access to a folder beyond the minimum permissions necessary for the employee's role. Identification and authentication (A) is not violated because the employee's account was properly identified and authenticated; the issue is authorization, not proving identity. Separation of duties (C) is not implicated because no single individual was given control over multiple conflicting tasks or stages of a critical process. Defense in depth (E) is not violated because the scenario does not describe a failure of layered controls; it describes excessive permissions granted to an account.

Answer

Identification and authentication

Answer

Separation of duties

Answer

Defense in depth

Question 9

A new employee at a marketing firm receives a company laptop, a proximity badge, and a one-time password token on their first day. Before being allowed to log in, the employee must enter their employee ID, then a code from the token, then scan the badge. Which access control concept does the employee ID represent in this sequence?

Accepted Answer

Identification. Identification is the claim of an identity, such as typing a username or employee ID, while authentication verifies that claim with credentials. In this scenario the employee ID is asserted before the token code and badge scan, so it functions as the identification step. Authorization and accounting occur only after identity is verified.

Answer

Accounting

Answer

Authorization

Answer

Authentication

Question 10

A hospital's radiology department issues each technologist a smart card that must be inserted into a workstation reader before the technologist types a username and password. The smart card stores a digital certificate that the workstation validates. Which statement best describes how this arrangement maps to the identity and access control concepts?

Accepted Answer

The username provides identification, while the smart card and password together provide authentication.. Identification is the act of claiming an identity, and authentication is the act of proving that claim. Typing a username claims an identity, while the smart card and password independently verify it using possession and knowledge factors. Because two distinct factor types are required, the workflow is multi-factor authentication, and authorization would only follow once verification succeeds.

Answer

The entire sequence is authorization, because the workstation validates a digital certificate.

Answer

The smart card performs identification, while the username and password perform authentication.

Answer

The smart card and password together perform identification, while the username performs authentication.

Question 11

A hospital's IT team assigns each doctor a unique smart card that must be inserted before the workstation unlocks, and the card's embedded certificate is validated against the hospital's internal certificate authority. Which access control process does the smart card insertion and certificate validation represent?

Accepted Answer

Authentication. The smart card provides a possession factor, and the certificate authority validates that the credential is genuine and trusted. This verification of a claimed identity is the definition of authentication. Authorization and accounting occur later in the process, while identification is only the initial claim of an identity without proof.

Answer

Accounting

Answer

Authorization

Answer

Identification

Question 12

A payroll clerk changes roles within the same company, moving from the finance department to the human resources department. The security team discovers months later that the clerk still retains all the finance application permissions from the previous position in addition to the new HR permissions. Which access control weakness does this situation illustrate?

Accepted Answer

Privilege creep caused by failing to remove access rights when job responsibilities change.. When employees change roles, their previous entitlements must be revoked so that access always matches current duties. Retaining finance permissions after moving to HR creates privilege creep, a gradual accumulation of rights that violates least privilege and expands the attack surface. Periodic access reviews and prompt deprovisioning during transfers are the standard controls that prevent this situation.

Answer

A brute-force vulnerability, because the clerk's account retained credentials that could be attacked repeatedly.

Answer

An implicit deny failure, because the access control system did not block the finance permissions by default.

Answer

A separation of duties conflict, because one person now holds finance and HR access simultaneously.

Question 13

A hospital's billing application assigns permissions based on each employee's job title, such as nurse, billing clerk, or department manager. When an employee changes roles, the administrator updates the job title and the application automatically adjusts the employee's access. Which access control model is being used?

Accepted Answer

Role-based access control (RBAC). Role-based access control assigns permissions to roles and then assigns users to those roles, so access changes automatically when a user's role changes. The hospital's job-title-driven permissions match this model. Discretionary control lets owners set permissions, mandatory control uses labels and clearances, and rule-based control evaluates conditions rather than job functions.

Answer

Mandatory access control (MAC)

Answer

Rule-based access control

Answer

Discretionary access control (DAC)

Question 14

A hospital's IT team is reviewing its access control model. Administrators currently assign permissions to each nurse individually, which has caused errors and delays when staff rotate between departments. The team wants to simplify administration by assigning permissions to a role such as 'Pediatric Nurse' and then assigning nurses to that role. Which access control model should they implement?

Accepted Answer

Role-Based Access Control (RBAC). The hospital needs permissions tied to job functions rather than to individual accounts. Role-Based Access Control creates roles, assigns permissions to those roles, and then assigns users to roles, so rotating staff only requires changing the role assignment. This reduces administrative errors, supports least privilege at the role level, and scales cleanly as departments and duties change.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Rule-Based Access Control

Question 15

A payroll clerk can view and edit employee salary records but cannot approve her own expense reimbursements, even though she processes reimbursements for other staff. Which access control principle does the restriction on approving her own reimbursements best illustrate?

Accepted Answer

Separation of duties. Separation of duties ensures that a single person cannot complete a sensitive transaction alone, reducing the risk of fraud or undetected error. Since the clerk can process reimbursements but is barred from approving her own, the organization has split control of the payment process across multiple people, which is exactly what separation of duties accomplishes.

Answer

Least privilege

Answer

Mandatory access control

Answer

Need to know