ISC2 CC Access Controls Concepts Practice Question
A hospital's IT department issues every nurse a unique smart card that must be inserted into a workstation before the nurse types a password. The smart card alone does not grant access to patient records. Which access control concept does the smart card insertion represent?
⚠ Common exam trap
The trap here is assuming that possessing a physical token automatically verifies identity, when presenting it only claims an identity that still requires separate verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identification
The smart card presents a unique token that asserts who the nurse claims to be, which is the definition of identification. Because the card alone does not grant access and a password must still be supplied, verification of that claim is handled separately by authentication. Authorization and accounting occur only after identity is established and verified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identification
Why this is correct
Identification is the act of claiming an identity to a system, and the smart card presents a unique credential that tells the workstation who the nurse claims to be. Because the card by itself does not grant access and a password must still follow, it functions as the identification step that precedes authentication in the access control process.
- ✗
Authentication
Why it's wrong here
Authentication verifies that a claimed identity is genuine, which in this scenario is accomplished by the password the nurse types after inserting the card. The card alone merely asserts an identity and does not prove it, so treating the insertion as authentication misstates the role the smart card plays in the login sequence.
- ✗
Accounting
Why it's wrong here
Accounting is the logging and tracking of user activity, such as recording which records were viewed and when. Inserting the card generates no audit trail of resource use by itself, so it does not represent the accounting function that supports later review and nonrepudiation in this hospital.
- ✗
Authorization
Why it's wrong here
Authorization determines what resources an already-verified identity may use, such as which patient record folders a nurse can open. The smart card insertion happens before the nurse's identity is verified, so it cannot be the step that grants or denies permissions to specific resources in this scenario.
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
Common Access Card
A Common Access Card (CAC) is a smart card issued by the U.S. Department of Defense that serves as a single identification, authentication, and access credential for military personnel and contractors.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.