ISC2 CC Access Controls Concepts Practice Question
A company wants to implement defense in depth for its data center. Which THREE of the following controls should be included? (Select THREE.)
⚠ Common exam trap
The trap is selecting convenient or familiar controls (SSO, a single firewall) that sound secure but actually reduce layering, while missing that defense in depth requires diverse physical and data-level controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Requiring access badges to enter the building
Option A is correct because requiring access badges to enter the building is a physical (premises) access control that restricts who can reach the data center, forming the outermost layer of defense in depth. Option D is correct because encrypting data at rest protects stored data (e.g., AES-256 on disks or databases) so that even if physical or logical access is gained, the data remains unreadable. Option E is correct because fencing around the building is a perimeter physical control that deters and delays intrusion, complementing badge access as an additional defensive layer. Option B does not belong because SSO centralizes authentication and can actually reduce the number of independent barriers, and it is an identity convenience/control rather than a distinct defense-in-depth layer. Option C does not belong because a single firewall for all network traffic is a single point of failure and contradicts defense in depth, which requires multiple, diverse, and redundant controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Requiring access badges to enter the building
Why this is correct
Access badges enforce authentication at the building entry point, verifying identity before anyone reaches the data centre. It satisfies the defense in depth constraint by adding a physical access control layer that complements network, encryption and administrative safeguards.
- ✗
Single sign-on (SSO) for all applications
Why it's wrong here
Single sign-on centralises authentication to reduce credential prompts; it adds no independent layer that stops an attacker who already holds valid credentials. It is tempting because it strengthens identity management, but defense in depth requires distinct, overlapping controls such as network segmentation and host hardening.
- ✗
Using a single firewall for all network traffic
Why it's wrong here
One firewall for all traffic creates a single point of failure and a single policy boundary, which is the opposite of layered defence. It is tempting because firewalls are foundational controls, but defense in depth requires multiple independent filtering layers, not consolidation onto one device.
- ✓
Encrypting data at rest
Why this is correct
Encrypting data at rest renders stored files unreadable without the correct keys, protecting confidentiality if media or backups are stolen. It satisfies the defense in depth constraint by adding a cryptographic layer independent of perimeter and physical controls.
- ✓
Fencing around the building
Why this is correct
Fencing around the building creates a physical barrier restricting approach to the facility, deterring and delaying intruders. It satisfies the defense in depth constraint by contributing an outer physical layer that complements badges, encryption and other controls.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
Physical control
Physical controls are tangible security measures like locks, fences, and biometric scanners used to protect buildings, hardware, and sensitive data from unauthorized physical access or harm.
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.