ISC2 CC Access Controls Concepts Practice Question
A small marketing firm wants to give each employee a single set of credentials that works for the corporate email system, the cloud CRM, and the internal file share. The IT manager proposes using a central identity store so users do not have to remember separate passwords. Which concept is the IT manager describing?
⚠ Common exam trap
A common mix-up: candidates confuse a login-convenience technology with an authorization model, so candidates pick role-based access control when the scenario is really about reducing the number of authentication events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Single sign-on (SSO)
The firm's goal is one credential set that unlocks several independent applications, which is the defining purpose of single sign-on. SSO relies on a central identity provider that authenticates the user once and then issues assertions or tokens to each connected application, removing repeated password prompts while still allowing each application to make its own authorization decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Multifactor authentication (MFA)
Why it's wrong here
MFA strengthens authentication by requiring two or more different factor types, such as a password plus a one-time code. It increases assurance that the person is who they claim, but it does not reduce the number of separate logins a user performs for email, CRM, and file access. The scenario asks about consolidating credentials, which is an SSO concern.
- ✓
Single sign-on (SSO)
Why this is correct
SSO lets a user authenticate once to a central identity provider and then access multiple independent applications without re-entering credentials for each one. In this scenario, the marketing firm wants one credential set to reach email, CRM, and file services, which is exactly the problem SSO solves through token or assertion exchange between the identity provider and each relying application.
- ✗
Federated identity management
Why it's wrong here
Federation links identities across separate security domains or organizations, such as trusting a partner's identity provider. Here all three applications belong to one small marketing firm inside a single domain, so no cross-domain trust relationship is needed. Federation is a broader concept that can enable SSO, but it is not the precise description of a single internal credential set.
- ✗
Role-based access control (RBAC)
Why it's wrong here
RBAC assigns permissions based on a user's job role rather than managing per-user rights. It governs what resources a user may reach after authentication, not how many times the user must log in. The scenario's problem is repeated credential entry across three systems, which RBAC does not address; it answers authorization, not the authentication convenience being requested.
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
Single sign-on
Single sign-on (SSO) is an authentication method that allows a user to log in once and gain access to multiple applications or systems without re-entering credentials.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.