mediumMultiple Choice
ISC2 CC Practice Question: A system administrator needs to grant a…
A system administrator needs to grant a contractor temporary access to a server for patching. The contractor should only have access during the patching window. Which access control implementation method is most appropriate?
⚠ Common exam trap
ISC2 often tests the distinction between rule-based access control (RBAC) with time-based ACLs and group-based permissions, where candidates mistakenly choose group-based permissions because they think 'recurring schedule' implies time control, but group-based permissions lack the precise time-range enforcement at the network layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time-based ACL (rule-based access control)
Time-based ACLs (rule-based access control) allow the administrator to define a specific time range during which the contractor's access is permitted. This directly matches the requirement for temporary access only during the patching window, as the ACL can be configured with a time-range object that automatically enables and disables the permit statement without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Time-based ACL (rule-based access control)
Why this is correct
A time-based ACL enforces access windows directly on the server, so the contractor's permissions activate only during the patching period and lapse automatically afterwards. This satisfies the stem's constraint that access be limited to the patching window, without relying on manual revocation or account lifecycle management.
- ✗
Group-based permissions with a recurring schedule
Why it's wrong here
Group membership grants standing access; a recurring schedule merely re-triggers it, so the contractor retains rights between windows unless separately removed. It is tempting because scheduled group membership is genuinely useful for repeating, predictable access periods such as weekly maintenance rotations with permanent staff.
- ✗
Discretionary access control (DAC)
Why it's wrong here
DAC ties permissions to owner-assigned ACLs, which persist until manually revoked, so nothing enforces expiry at the patching window's end. It is tempting because DAC is the default file-permission model on most servers, and it would suit granting a permanent contractor account ongoing access to specific resources.
- ✗
Mandatory access control (MAC)
Why it's wrong here
MAC enforces access via system-wide labels and clearances, not time-bound contractor grants, so it cannot express 'only during the patching window'. It is tempting because MAC provides the strongest isolation for classified or multilevel data, and would be correct where labels must override all user discretion.
Visual reference
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.