ISC2 CC Access Controls Concepts Practice Test 9 — 15 Questions

Question 1

A financial services firm stores customer records in a database. A teller can read and update records for customers assigned to their branch but cannot view records belonging to other branches. A branch manager can view all records within their region. Which access control principle best explains why the teller's access is limited to their own branch's customers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Need to know. Need to know restricts access to only the information a user requires for their job, which is why the teller sees only their branch's customers. Least privilege limits the types of permissions granted, separation of duties splits tasks among users, and defense in depth layers controls. The record-level restriction described maps to need to know.

Answer

Separation of duties

Answer

Least privilege

Answer

Defense in depth

Question 2

A hospital's IT team wants to ensure that nurses can access patient records only during their assigned 12-hour shifts, even if their credentials are valid around the clock. Which access control model should the team implement to enforce this time-based restriction?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control evaluates environmental attributes such as current time and shift assignment alongside subject and object attributes. This allows the hospital to enforce a policy that grants patient-record access only during a nurse's scheduled shift, even when credentials remain valid. Role-Based Access Control, Mandatory Access Control, and Discretionary Access Control do not natively enforce time-of-day conditions, so they fail to meet the requirement.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 3

A defense contractor classifies documents as Public, Internal, Secret, and Top Secret. A user with Secret clearance attempts to open a Top Secret document and is denied, while a user with Top Secret clearance can open both Top Secret and Secret documents. Which access control model does this behavior describe?

Accepted Answer

Mandatory access control, because access is determined by comparing the subject's clearance to the object's classification label.. Mandatory access control relies on sensitivity labels attached to objects and clearances assigned to subjects, with the system enforcing the relationship. A subject may read an object only when their clearance dominates the object's classification, which is exactly why Secret cannot reach Top Secret and Top Secret can reach Secret. Users cannot alter these labels, making enforcement mandatory rather than discretionary.

Answer

Rule-based access control, because a fixed rule set decides every access request.

Answer

Role-based access control, because permissions follow the user's assigned job role.

Answer

Discretionary access control, because the document owner decides who may read each file.

Question 4

A new employee logs in to the corporate network for the first time by entering a username and password. The system checks the credentials against the directory and grants access. Which security concept does entering the username and password represent?

Accepted Answer

Authentication. When a user supplies a username and password and the system validates them against stored credentials, the system is verifying the claimed identity. That verification step is authentication. Identification alone is just the claim of an identity, and authorization and accounting happen after authentication succeeds, so authentication is the concept being exercised here.

Answer

Authorization

Answer

Accounting

Answer

Identification

Question 5

A hospital's IT team issues each nurse a unique smart card that is inserted into a workstation before the nurse types a password. The nurse then accesses patient records permitted for the assigned ward. Which combination of access control concepts is being demonstrated?

Accepted Answer

Identification by the smart card, authentication by the password, and authorization by the permitted records.. Identification is the act of claiming an identity, which the smart card performs by presenting a unique token. Authentication validates that claim, which the password accomplishes when it matches the stored credential. Authorization then determines which patient records the authenticated nurse may access. Keeping these three steps distinct is fundamental to the access control concepts domain.

Answer

Authentication by the smart card, authorization by the password, and identification by the permitted records.

Answer

Identification by the smart card, authorization by the password, and authentication by the permitted records.

Answer

Authorization by the smart card, identification by the password, and authentication by the permitted records.

Question 6

A financial services firm grants a contractor temporary access to a trading application for a 90-day engagement. The security team wants the access to expire automatically without manual intervention, and also wants the contractor's manager to periodically confirm the access is still required. Which combination of access control practices best satisfies both requirements?

Accepted Answer

Time-based account expiration combined with periodic access reviews. Temporary access should be bounded in time and periodically justified. An account expiration date guarantees the access ends automatically at the close of the engagement, while periodic access reviews force the manager to reconfirm that the contractor still needs the trading application. The other combinations improve authentication strength or permission structure but do not provide automatic expiry or ongoing attestation.

Answer

Role-based access control combined with discretionary access control

Answer

Account lockout thresholds combined with password complexity requirements

Answer

Single sign-on combined with multifactor authentication

Question 7

A software company wants to protect its source code repository. Developers may read and commit code, but only the release manager may create release tags, and the release manager cannot modify the protected branch directly. The company wants a model that enforces these rules consistently regardless of who owns the repository. Which access control model is most appropriate?

Accepted Answer

Role-based access control (RBAC), because permissions are tied to job functions like developer and release manager. Role-based access control defines permissions for roles and assigns users to those roles, so developers and the release manager receive exactly the rights their job functions require. Because the rules are centrally defined rather than owner-controlled, they are enforced consistently. Discretionary control would leave decisions to owners, mandatory control relies on labels, and rule-based control evaluates environmental conditions.

Answer

Discretionary access control (DAC), because repository owners can set permissions as they see fit

Answer

Mandatory access control (MAC), because labels and clearances prevent unauthorized modifications

Answer

Rule-based access control, because conditions such as branch protection rules can restrict actions

Question 8

A user logs into a corporate portal by entering a username and password. The system then prompts for a one-time code from a mobile authenticator app. Which two factors of authentication are being combined in this scenario?

Accepted Answer

Something you know and something you have. Multi-factor authentication requires combining factors from different categories. The password is a knowledge factor, and the one-time code from a registered mobile app is a possession factor. Together they form something you know plus something you have. The other pairings involve biometrics or location, neither of which appears in the described login sequence, so they do not accurately describe the factors in use.

Answer

Something you know and something you are

Answer

Something you have and something you are

Answer

Something you know and somewhere you are

Question 9

A data center manager wants to strengthen physical access control at the main entrance while keeping the process practical for employees arriving each morning. Which two measures BEST align with sound physical access control practices? (Choose two.)

Accepted Answer

Require employees to display a visible badge at all times while inside the facility.. Effective physical access control combines preventive enforcement with accountability. A mantrap ensures each entrant authenticates individually, eliminating tailgating, while mandatory visible badges let anyone on site verify that a person is authorized. Together they admit legitimate employees efficiently while making unauthorized entry difficult to conceal, which is exactly what a well-designed entrance control should achieve.

Answer

Place a sign on the door stating that the area is restricted to authorized personnel only.

Answer

Disable the door alarm and logging functions to speed up employee entry during peak hours.

Answer

Publish the entrance door code on the company intranet so employees can memorize it.

Question 10

A defense contractor classifies documents as Confidential, Secret, or Top Secret and requires that access decisions be based on these labels. Users receive clearances, and the system itself enforces that a user may read a document only if the user's clearance dominates the document's label. Users cannot change labels or grant access to others. Which access control model is being enforced?

Accepted Answer

Mandatory Access Control (MAC). The system bases every access decision on system-assigned classification labels and user clearances, and users cannot modify those labels or delegate access. That combination of non-discretionary, label-driven enforcement is Mandatory Access Control. The dominance rule described, where clearance must dominate the object label for read access, is a hallmark of mandatory models such as Bell-LaPadula.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 11

A security team is reviewing how access control is enforced across a corporate environment. Which two statements accurately describe the relationship between identification, authentication, and authorization? (Choose two.)

Accepted Answer

Authorization decisions are made after authentication succeeds, based on the verified identity's permissions.. Identification claims an identity, authentication verifies that claim, and authorization grants permissions based on the verified identity. The two correct statements capture these distinct roles and their proper sequence. The remaining statements incorrectly merge authentication with authorization, allow authorization without authentication, or treat identification as sufficient for access.

Answer

Identification alone is sufficient to grant access to protected resources in a secure system.

Answer

A user can be authorized for a resource without ever being authenticated to the system.

Answer

Authentication and authorization are the same process because both determine whether a user may access a resource.

Question 12

A retail company is designing its access control program and wants to rely on attributes such as the user's department, the sensitivity label of the data, and the current time of day to make access decisions. Which TWO of the following statements accurately describe attribute-based access control (ABAC)? (Choose two.)

Accepted Answer

ABAC can enforce rules such as permitting access only during business hours from a corporate network.. ABAC makes decisions by evaluating attributes of the subject, resource, action, and environment, which enables granular rules such as time-limited and location-aware access. It does not depend on a single job title, does not require one fixed role per user, and can absolutely incorporate data sensitivity labels as resource attributes. The two accurate statements describe multi-attribute evaluation and environmental conditions.

Answer

ABAC requires that every user be assigned exactly one static role that never changes.

Answer

ABAC policies cannot incorporate data sensitivity labels because labels are a form of mandatory access control.

Answer

ABAC decisions are made solely from the user's job title stored in the human resources system.

Question 13

A financial services firm must enforce access decisions based on data sensitivity labels assigned by a central authority, and users cannot change these labels or grant access to others. Which access control model is the firm implementing?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control relies on security labels assigned by a central authority and compares them with user clearances. Users cannot alter labels or delegate access, which matches the firm's requirement to enforce decisions based on data sensitivity. Discretionary Access Control and Role-Based Access Control allow owner or role-based discretion, and Attribute-Based Access Control is broader and policy-driven, so none of them captures the centralized, non-discretionary label enforcement described.

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Question 14

A financial services firm grants tellers access to the transaction system only between 8:00 a.m. and 6:00 p.m. on business days, regardless of the teller's role. Access requests outside that window are automatically denied, and the restriction is enforced by a centrally managed policy that tellers cannot modify. Which access control approach is being applied?

Accepted Answer

Rule-based access control, because access is granted or denied according to a defined condition rather than individual identity.. Rule-based access control makes decisions from objective, administrator-defined conditions rather than from individual identity or job role. Restricting transaction access to a fixed time window on business days is a textbook condition, and it applies to every teller identically while remaining outside user control. The uniformity and condition-driven nature distinguish it from role-based, discretionary, and mandatory approaches.

Answer

Mandatory access control, because the system enforces the restriction without user involvement.

Answer

Role-based access control, because tellers form a job role that shares the same permissions.

Answer

Discretionary access control, because a manager decides which tellers receive transaction access.

Question 15

A hospital IT team is reviewing how staff access patient records. A nurse logs in with a unique employee ID, then enters a password plus a one-time code from a hardware token. The team wants to document which access control category this login process represents. Which category BEST describes this approach?

Accepted Answer

Something you know combined with something you have. Authentication factors fall into categories such as knowledge, possession, inherence, and location. The nurse's password represents knowledge, while the hardware token one-time code represents possession. Pairing factors from two different categories achieves multi-factor authentication, which is stronger than using two factors from the same category. This combination directly matches the described login process.

Answer

Two separate instances of something you know

Answer

Something you are combined with something you have

Answer

Something you have combined with somewhere you are