Domain 2 of the ISC2 Certified in Cybersecurity exam focuses on access controls. Logical access controls are the invisible gatekeepers that decide who gets into your computer, network, or cloud account — and what they can do once inside. For someone studying CC, understanding them is crucial because the exam will test how these controls work together to prevent unauthorised access.
Jump to a section
A simple way to picture Logical Access Controls
Why does the bouncer at a nightclub check your ID, scan a ticket, and then glance at a list on their phone before letting you in?
Because the club has three layers of logical access controls, and each one serves a different purpose. First, your ticket is like a password — something you have that proves you were allowed in. But anyone could steal that ticket. So the bouncer also checks your photo ID — that is a token (something you physically possess). Finally, the bouncer consults a high-tech list: the access control list. This list says exactly who is allowed on the VIP floor, who can use the side entrance, and who gets turned away after midnight.
In the IT world, the club is a computer system. The bouncer is the operating system's security monitor. The ticket is your password, the photo ID is a hardware token or certificate, and the list is the access control list (ACL). You have to present all three — or at least some combination — to get through. And the bouncer never trusts anyone just because they have a friendly face. That is the principle of "never trust, always verify."
Logical access controls are the digital rules and mechanisms that decide who can access a resource (like a file, a server, or a network) and what they can do with it. They are called "logical" because they are implemented in software and operating systems, not in physical locks or guards. They are the brains behind the computer's security.
Let's break down the main types you need to know for the CC exam.
Passwords are the most common logical access control. A password is a secret string of characters that you provide to prove you are who you claim to be. The problem with passwords is that they can be guessed, stolen, or forgotten. That is why modern systems enforce password policies: minimum length, complexity (mixing letters, numbers, and symbols), and expiry. The CC exam will ask you to identify best practices for password management, such as never sharing passwords and using different passwords for different accounts.
Tokens are physical devices or software applications that generate a one-time code. A token is something you have. The classic example is a key fob that displays a six-digit number that changes every 30 seconds. You enter this number along with your password to log in. This is called multi-factor authentication (MFA). Tokens are harder to steal than passwords because they are physical objects. However, they can be lost or stolen. The exam will test that tokens provide "something you have" factor in authentication.
Certificates are digital files that work like an electronic passport. A certificate proves the identity of a user, computer, or device. It contains a public key and information about the owner. Certificates are issued by a trusted authority called a Certificate Authority (CA). When you visit a secure website (HTTPS), the website sends a certificate to your browser, which checks it against a list of trusted CAs. If it matches, your browser trusts the site. In the CC exam, you need to know that certificates are used for authentication and encryption, and that they rely on a chain of trust.
Access Control Lists (ACLs) are rules that define what each user or group can do with a resource. Think of an ACL as a spreadsheet with columns: username, resource, and permission (read, write, execute, delete). For example, an ACL on a file might say: "Alice can read and write; Bob can only read; Carol has no access." Operating systems like Windows and Linux use ACLs to enforce file permissions. Network routers also use ACLs to control which traffic is allowed through. The CC exam will test that ACLs are a method of implementing the principle of least privilege (giving users only the minimum permissions they need to do their job).
Together, these four methods form the core of logical access control. The goal is to protect confidentiality (keeping data secret), integrity (preventing unauthorised changes), and availability (ensuring authorised users can access resources when needed). The CC exam will expect you to recognise each method, understand how they differ, and know when to use each one.
A key concept tied to logical access controls is the AAA framework: Authentication, Authorisation, and Accounting. Authentication is proving who you are (e.g., with a password). Authorisation is determining what you are allowed to do (e.g., with an ACL). Accounting is logging what you did (e.g., audit trails). The CC exam often asks which control belongs to which step of AAA.
Finally, remember that no single control is perfect. Security experts use a layered approach called "defence in depth," combining passwords, tokens, certificates, and ACLs to create multiple barriers. The CC exam will present scenarios where a single control has failed, and you must choose the best additional control to add.
Identify the Resource
First, you determine exactly what you are protecting. It could be a file, a network share, a database, a cloud storage bucket, or a physical server. The resource type influences which logical access control is appropriate. For example, a file on a server typically uses an access control list (ACL), while a cloud API might use a certificate. This step is crucial because different resources have different security models.
Select an Authentication Method
You choose how the user will prove their identity. This could be a password (knowledge factor), a hardware token (possession factor), or a biometric scan (inherence factor). Often you combine two methods for multi-factor authentication. The CC exam tests that authentication is the first step in the AAA framework. Without proper authentication, authorisation and accounting are meaningless.
Issue or Configure the Credential
Now you set up the actual credential. For a password, you create the account and set an initial password. For a token, you register the device serial number in the system. For a certificate, you generate a key pair and get it signed by a Certificate Authority. This step ensures the credential is bound to the correct user and stored securely. Misconfiguration here leads to vulnerabilities like weak passwords or expired certificates.
Define Permissions via an Access Control List
You create or update the ACL for the resource. You specify which users or groups get what level of access: read, write, execute, or delete. For example, for a financial document, you might give the finance team read-write access and auditors read-only access. This step enforces the principle of least privilege. The CC exam often asks about the relationship between ACLs and permissions.
Enforce and Monitor Access
Finally, the system enforces the rules you set. When the user attempts to access the resource, the system checks the ACL and the authentication status. All successful and failed attempts are logged (accounting). An IT admin would regularly review these logs for anomalies, such as repeated failed password attempts, which might indicate a brute-force attack. This step closes the loop in the AAA framework.
Review and Revoke Access Periodically
Logical access controls are not set-and-forget. Employees change roles or leave the company. Certificates expire. Tokens get lost. You must periodically review who has access and remove unnecessary permissions. For example, if a developer moves to a marketing role, you remove their write access to the code repository. This step is critical for maintaining security over time and is often tested in scenario questions.
Imagine you are an IT support technician at a medium-sized company. A new employee, Priya, starts today. She needs access to the company's financial software, shared drive, and email. What do you do, step by step?
Step 1: Create an account with a strong password. You open the user administration tool. You create a username (priya.sharma) and generate a temporary complex password (e.g., P@ssw0rd!23). The system enforces a policy: minimum 12 characters, must include uppercase, lowercase, number, and special character. You also enable password expiry — she will need to change it on first login. The CC exam would test that passwords are the first line of defence but are vulnerable to brute-force attacks.
Step 2: Issue a hardware token for MFA. The company uses a physical token fob for the financial application. You give Priya the fob and register its serial number in the system. Now, to access the financial software, she must enter her password plus the current six-digit code from the fob. This is "something you know" (password) plus "something you have" (token). The exam might ask: what type of attack does this prevent? Answer: credential theft (even if her password is stolen, the attacker needs the physical token).
Step 3: Assign a digital certificate for device authentication. Priya's laptop needs to connect to the internal network. You install a digital certificate on her laptop, issued by the company's internal Certificate Authority. This certificate proves that her laptop is a trusted company device, not a personal one. When she connects to Wi-Fi, the network checks the certificate before granting access. The CC exam tests that certificates establish identity and trust, and that they are used in protocols like TLS/SSL.
Step 4: Configure access control lists (ACLs). The finance folder on the server has an ACL. You add Priya's username to the ACL with "read" and "write" permissions. The shared drive has a different ACL — she gets "read" only to the marketing folder and "read/write" to the project folder. The HR folder is not in her ACL at all, so she cannot see it. The exam loves to ask: what principle does this enforce? Answer: the principle of least privilege.
Step 5: Log and monitor. The system logs every time Priya logs in, accesses a file, or changes a password. This is the "Accounting" part of AAA. You as the IT admin can later review these logs if a security incident occurs. The CC exam might present a scenario where an unauthorised access attempt is detected via logs, and ask what control should be strengthened.
In practice, an IT professional would also schedule periodic reviews of ACLs — revoking access for employees who leave or change roles. They would also renew certificates before they expire and reset passwords when users forget them. The entire process is about balancing security with usability: too many controls frustrate users; too few invite breaches.
For the CC exam, remember that real-world implementations often combine all four methods. A question might list a scenario and ask which additional control is most appropriate. For example: "A company uses passwords only. What should they add?" The answer is a token for MFA.
The ISC2 CC exam test domain 2.3 specifically on logical access controls. Here is exactly what you need to know.
Exam Question Types: - Multiple-choice questions asking you to identify which control matches a description. - Scenario-based questions: you are given a real-world situation (e.g., a company wants to allow read-only access to a file for a group of users) and you must pick the correct control (in this case, an ACL). - Definition questions: "Which term describes something you have?" Answer: token. - Comparison questions: "What is the difference between a certificate and a token?"
Trap Patterns to Watch For: - The exam might describe a control that sounds like a password but actually refers to a token. For example: "A user enters a code from a key fob." This is a token, not a password. - They might ask about an ACL in a networking context. If they mention a router filtering traffic based on IP addresses, that is an ACL. - They may confuse certificates with encryption. Remember: certificates are primarily for identity proof, not encryption itself (though they enable encryption). - A common trap: they describe multi-factor authentication and list two passwords as the factors. That is wrong — two passwords are still just one factor (something you know). The factors must be from different categories: something you know, something you have, something you are.
Concepts the CC Exam Loves to Test: - The three factors of authentication: knowledge (password), possession (token), inherence (biometrics). Know them. - The principle of least privilege: always grant the minimum access needed. - Defence in depth: multiple layers of controls. - AAA: Authentication, Authorisation, Accounting. You must be able to map each control to the correct A. - ACL versus capability list: ACL lists who can access a resource; capability list lists what resources a user can access. The CC exam may ask you to distinguish them. - Certificate chain of trust: certificates are issued by a Certificate Authority (CA). The browser trusts the CA, so it trusts the certificate. - Password policies: length, complexity, expiry, history (preventing reuse).
Key Definitions to Memorise for the Exam: - Password: a secret string of characters (knowledge factor). - Token: a physical or software device that generates a one-time code (possession factor). - Certificate: a digital file issued by a CA that proves identity (used for authentication and encryption). - Access Control List (ACL): a list of permissions attached to an object that specifies which users or groups have what type of access.
The exam will also test your ability to apply these concepts in a security incident scenario. For instance, if a user's token is stolen, what should be done? Answer: revoke the token and issue a new one. If a certificate expires, what happens? Access is denied until it is renewed.
Finally, the exam might ask about the difference between logical and physical access controls. Logical controls are software-based (passwords, ACLs). Physical controls are tangible (locks, guards, biometric readers). Do not mix them up.
Logical access controls are software-based mechanisms that determine who can access a resource and what they can do with it.
The four main types of logical access controls are passwords, tokens, certificates, and access control lists (ACLs).
Passwords are something you know; tokens are something you have; biometrics are something you are — these three categories form the factors of authentication.
Multi-factor authentication (MFA) requires at least two different factors, such as a password and a token.
An access control list (ACL) is a set of rules that grants or denies permissions to users or groups for a specific resource.
Certificates are digital documents issued by a Certificate Authority (CA) that bind an identity to a public key, used for authentication and encryption.
The principle of least privilege means giving users only the minimum access they need to perform their job, often enforced via ACLs.
In the AAA framework, authentication verifies identity, authorisation determines permissions, and accounting logs actions for review.
Defence in depth uses multiple layers of logical access controls so that if one fails, others still protect the system.
The CC exam will test your ability to identify which control to apply in a given scenario and to distinguish between different factors of authentication.
These come up on the exam all the time. Here's how to tell them apart.
Password
Something you know
Can be guessed or stolen easily
Does not require physical hardware
Token
Something you have
Harder to steal (physical device)
Requires a physical token or app
Certificate
Digital file proving identity
Issued by a Certificate Authority
Used for both authentication and encryption
Token
Physical or software device generating codes
Does not require a CA
Used only for authentication, not encryption
Access Control List (ACL)
Defines permissions for users/groups on a resource
Can be applied to files, folders, or network devices
Focuses on who can access what
Firewall Rule
Filters network traffic based on IP/port
Applied only on network devices (routers, firewalls)
Focuses on which traffic is allowed/blocked
Multi-Factor Authentication (MFA)
Uses two or more different factor categories
Provides stronger security
Requires more effort to bypass
Single-Factor Authentication
Uses only one factor (e.g., password)
Easier for users
More vulnerable to theft or guessing
Authentication
Verifies who you are
Happens first in the AAA framework
Examples: entering a password, swiping a token
Authorisation
Determines what you can do
Happens after authentication
Examples: ACL checking permissions
Mistake
Passwords and tokens do the same thing — they both prove who you are.
Correct
Passwords are something you know; tokens are something you have. They are different factors of authentication. Using both together provides stronger security than using either alone.
Beginners often lump all authentication methods together because they all involve entering something. The exam tests the distinct categories.
Mistake
An access control list (ACL) is the same as a firewall.
Correct
An ACL is a set of rules that defines permissions for users or network traffic. A firewall is a device that filters traffic based on ACLs, but an ACL can also be used in operating systems to control file access. They are not interchangeable.
The terms are often used loosely in everyday IT, but the CC exam expects precise definitions.
Mistake
Certificates are only used for websites (HTTPS).
Correct
Certificates are used for many purposes, including securing email, authenticating devices on a network, signing software, and encrypting data in transit. HTTPS is just one common application.
Beginners typically encounter certificates only in their browser's address bar, so they assume that is the only use case.
Mistake
Multi-factor authentication (MFA) means using two passwords.
Correct
MFA requires factors from different categories. Using two passwords is still just one factor (knowledge). True MFA combines, for example, a password and a token (knowledge + possession) or a password and a fingerprint (knowledge + inherence).
The word 'multi' can confuse people into thinking any two things count. The CC exam specifically tests the factor categories.
Mistake
An ACL can only be applied to files and folders.
Correct
ACLs can be applied to many resources, including network devices (routers, switches), printers, databases, and cloud storage buckets. Any resource that needs access control can have an ACL.
New learners first see ACLs in file permission settings, so they assume that is the limit.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A password is something you know (a secret string of characters). A token is something you have (a physical device or app that generates a code). They are different authentication factors.
Yes. HTTPS (secure web browsing) requires a TLS/SSL certificate, which is issued by a Certificate Authority. Without a certificate, the connection is not encrypted and users will see a security warning.
Yes. Network routers use ACLs to control which traffic is allowed or denied based on IP addresses, ports, and protocols. It is called a Network ACL (NACL).
It means giving users only the minimum permissions they need to do their job. For example, a receptionist should not have access to salary data. ACLs are often used to implement this principle.
A certificate is issued by a trusted Certificate Authority (CA). When a user or device presents a certificate, the system checks if it was signed by a known CA. If the signature is valid, the system trusts the identity. Without the private key that matches the certificate, no one can forge it.
The token should be immediately revoked by an administrator so it cannot be used. A new token is issued to the user, and its serial number is registered in the system.
No, it is not always required, but it is strongly recommended for sensitive systems. The CC exam expects you to know that MFA significantly reduces the risk of credential theft.
You've finished Logical Access Controls. Continue through the CC study guide to build a complete picture of the exam.
Done with this chapter?