CCNA Access Controls Concepts Questions

A visitor log creates an auditable record of who entered, when and whom they visited, while escort requirements ensure visitors remain supervised and cannot wander into restricted areas. Together these satisfy the physical-security need for accountability and containment of unvetted individuals on site.

Least privilege grants each user only the permissions their role requires, nothing more. It satisfies the scenario's constraint by minimising the new employee's access rights, thereby limiting the damage any compromised or misused account could cause across systems.

JIT privileged access grants elevated rights only for a limited period after an approved request, then automatically removes them. The scenario shows exactly this: manager approval, a ticket number, a defined change window, and automatic revocation when the window closes. This minimizes standing privileged access, reducing the attack surface compared with permanently assigned administrator rights.

Identification is the act of claiming an identity to a system, and the smart card presents a unique credential that tells the workstation who the nurse claims to be. Because the card by itself does not grant access and a password must still follow, it functions as the identification step that precedes authentication in the access control process.

Impossible-travel logins from two distant locations within minutes strongly suggest the credentials were captured and reused by an attacker. A long complex password offers no protection once it is stolen, but requiring a second factor such as a hardware token or authenticator app would have blocked the external session. The absence of MFA is the weakness that allows credential replay.

Allowing paste supports password managers, which NIST SP 800-63B explicitly endorses to reduce reuse and enable longer, higher-entropy secrets. Blocking paste forces weaker, memorable passwords and encourages poor workarounds. This satisfies the stem's recommendation for verifier practices that accommodate credential managers rather than impede them.

NIST SP 800-63B advises against composition and rotation rules, favouring length and blocklist screening. An eight-character minimum combined with checking against breached password lists directly satisfies that guidance, blocking compromised credentials without imposing complexity or expiry requirements.

MAC enforces access based on sensitivity labels assigned to objects and clearances held by subjects, with the system, not users, controlling label changes. The scenario's classification labels, clearances, and inability to bypass checks are defining traits of MAC, making this the correct model.

Logical access controls govern how subjects interact with systems and data, including session timeouts and authentication settings. A GPO enforcing a 15-minute inactivity lock restricts access through software configuration rather than physical barriers, directly satisfying the stem's requirement for automated session termination within Active Directory.

Account lockout mitigates brute force by disabling an account after a set number of failed attempts, directly blocking continued password guessing from the single IP address. It satisfies the scenario's constraint of repeated authentication failures within a short period, though attackers could still target other accounts.

Physical tamper protection for the servers themselves, satisfying the defense-in-depth requirement for layered physical safeguards. Cable locks deter and delay removal or theft of server hardware, complementing perimeter, door and surveillance controls rather than duplicating them.

Need to know restricts data access to what a user's role and tasks actually require, rather than granting broad access by seniority or department. This matches the stem's requirement to limit access based on job role and duties.

The smart card supplies a claimed identity, which is the identification step. Typing a password verifies that claim, which is authentication. The patient records the nurse is allowed to view reflect authorization, the process of determining permitted resources after the identity has been proven. This scenario cleanly separates all three concepts and matches the standard CC access control model.

Locking an account after five failed attempts within fifteen minutes throttles repeated authentication guesses, directly disrupting automated brute-force attacks. The threshold and time window constrain the rate at which an attacker can try passwords, satisfying the stem's stated control design.

MAC enforces access through system-assigned labels on objects and clearances on subjects, and users cannot modify those labels. The contractor's rule that clearance must meet or exceed the document classification is exactly the label-based comparison MAC performs. Because the labels are fixed by policy rather than owner choice, this scenario describes MAC.

The password represents something the manager knows, while the hardware token represents something the manager has. Combining factors from two different categories is multi-factor authentication, and it means an attacker who only obtains the password still cannot produce the current one-time code. This directly explains the added protection that longer passwords alone cannot provide.

Applying least privilege limits each admin account to only the permissions its role requires, shrinking the blast radius if credentials are compromised. For a PAM design, this directly satisfies the stem's constraint by removing standing excess rights, so privileged accounts cannot perform actions beyond their defined duties.

Password complexity policies are logical controls because they govern how a subject authenticates to a system, rather than physically restricting entry. They satisfy the stem's requirement for a logical access control by enforcing rules on credentials within Microsoft Entra ID, unlike fences, locks or guards, which are physical controls.

Identification precedes authentication because the system must first receive a claimed identity, such as a username or email address, before it can verify that claim. Authentication then validates the credential against that identity. This ordering satisfies the stem's requirement that identification occurs first in the process.

ABAC evaluates attributes of the subject, resource, action, and environment, so a policy can allow access only when the nurse's department attribute matches the record's department and a treatment relationship exists. This precisely fits the hospital's requirement to combine department assignment with the specific clinician-patient relationship, producing dynamic decisions that static roles cannot express.

Identification is the act of a subject presenting a claimed identity, such as a username, before any proof is offered. Authentication then verifies that claim, and authorisation grants access. The question asks specifically about claiming, so identification is the process named.

Authorization determines what a verified identity may do, and it depends on knowing who the user is, which requires successful authentication first. Granting permissions before verifying identity would allow impersonation. This statement correctly reflects that authorization follows authentication and relies on the resulting identity context.

Discretionary access control places the decision with the resource owner, who may grant or revoke access at their discretion. Because each designer owns the project folder and personally decides which colleagues can open it by assigning permissions to individual accounts, the model matches discretionary access control exactly. The owner's judgment, not a central policy, determines who gets in.

Least privilege means granting only the access needed for a task, so routine email and browsing run without administrative rights. Separating the privileged account limits exposure: compromise of the daily-use account cannot yield administrative control over the system.

Least privilege grants users only the minimum permissions required for their job functions, directly satisfying the stem's constraint. Unlike role-based access control, which assigns permissions by role, least privilege limits each user's access to precisely what their tasks demand, reducing the attack surface and preventing unnecessary privilege accumulation.

An access review, also called recertification, periodically examines existing accounts and entitlements to confirm they are still required and to revoke those that are not. Reviewing all active accounts each quarter to remove unneeded ones is precisely this practice. It complements the automatic expiration of temporary accounts by catching access that outlives its business need.

NIST SP 800-63 mandates an eight-character minimum and screens new passwords against breach corpora, directly satisfying both the length floor and the ban on compromised credentials. Its guidance also favours length over forced complexity and rotation, matching the policy's emphasis on breached-password blocking rather than composition rules.

SSO lets a user authenticate once to a central identity provider and then access multiple independent applications without re-entering credentials for each one. In this scenario, the marketing firm wants one credential set to reach email, CRM, and file services, which is exactly the problem SSO solves through token or assertion exchange between the identity provider and each relying application.

Temporary visitor badges give each visitor a visible, time-bound credential that distinguishes them from staff and supports accountability. This satisfies the visitor management policy's need to identify and track non-employees on site, complementing sign-in and escort controls.

In LDAP distinguished names, OU stands for Organizational Unit — a container object used to group directory entries, typically by department or function. Here OU=Sales places John Smith within the Sales organisational unit beneath the company's domain components.

Visible badges let staff and security personnel quickly distinguish authorized individuals from visitors or intruders, which reinforces the effectiveness of the entrance control. Badge display supports accountability and makes unauthorized presence easier to challenge. It is a widely accepted physical control that complements authentication at the door without impeding normal employee movement.

Separating administrative credentials from daily-use accounts enforces least privilege and limits blast radius: routine browsing, email and phishing exposure cannot compromise privileged access. This directly satisfies the recommended practise of isolating elevated permissions from everyday activity.

NIST SP 800-63 favours password length over composition rules, since complexity encourages predictable patterns and reuse. Breached-list screening blocks credentials already exposed in leaks, directly satisfying the guidance's requirement to reject compromised secrets rather than merely enforcing character classes.

Separation of duties splits a critical task across multiple identities so no single person controls it end to end. Requiring two distinct managers to approve each financial transaction enforces this by preventing one individual from both initiating and authorising payment, directly satisfying the stem's dual-approval constraint.

RBAC grants permissions to roles, and users receive rights by being assigned to a role. When the employee moves from the Teller role to the Loan Officer role, the old role's permissions drop away and the new role's permissions apply, exactly as described. This role-to-permission mapping with automatic reassignment is the defining behavior of role-based access control.

Fencing and bollards form the outermost deterrent layer, delaying or preventing physical approach to the facility. They satisfy defence in depth by forcing attackers through successive boundaries before reaching internal controls such as locks or biometrics.

A technical constraint that blocks one account from performing both steps enforces separation of duties automatically rather than relying on policy alone. It removes the possibility of a single user completing the whole transaction, which is exactly what the firm needs. This makes the control reliable and auditable in the payment system.

Separation of duties splits a sensitive transaction across more than one person so no single individual controls the entire process. Because the clerk processes reimbursements, letting her also approve her own claim would give her unchecked control over a payment to herself. Requiring a different approver for her own reimbursement prevents that conflict and is the textbook application of separation of duties.

A retina scanner analyzes the unique pattern of blood vessels in the eye, which is a biological characteristic. This makes it a biometric control that verifies identity based on inherence. It is well suited for high-security environments like data centers because the trait is difficult to replicate, and it directly matches the requirement for biological verification.

Data classification labels tag information by sensitivity, enabling need-to-know enforcement because access decisions can be tied to clearance and label matching. Without labels, administrators cannot determine who legitimately requires specific data, so this practice directly supports least-privilege need-to-know access.

In LDAP distinguished names, OU identifies the Organizational Unit container holding the object, while DC marks each Domain Component of the DNS-based directory namespace. Reading right to left, DC=com and DC=company define the domain hierarchy, and OU=Sales places John Smith within the Sales organisational unit.

ABAC supports compound policy conditions that must all evaluate true before access is granted. Expressing the department match, classification allowance, approved hours, and managed-device requirement as a combined policy directly implements the auditors' four conditions. This is a correct description of how attribute-driven rules translate business requirements into enforceable access decisions.

Granting full financial database access to a user who only views quarterly reports exceeds their job requirements. Least privilege requires granting only the minimum access needed for assigned duties, so this excessive entitlement violates that principle most directly.

PAM brokers access to privileged credentials, vaulting them and injecting sessions through a controlled jump host. This delivers both control (least privilege, approval workflows, credential rotation) and monitoring (keystroke and command logging), satisfying the requirement to govern administrative accounts rather than ordinary user identities.

Layering fencing, badge readers, biometrics and cable locks creates successive independent barriers, so defeating one control still leaves others. This matches defence in depth, which the stem's layered approach exemplifies, rather than single-mechanism concepts such as least privilege or separation of duties.

Separation of duties splits a sensitive transaction across two distinct approvers, so no single manager can authorise a payment alone. Requiring two different managers for transactions above $10,000 directly enforces this principle by preventing unilateral action and creating mutual oversight.

A mantrap uses interlocked doors so the second door cannot open until the first is secured, and typically only one person fits in the vestibule. This physically separates individuals, defeating the common practice of an unauthorized person following an authorized badge holder through a single door. That is precisely the anti-tailgating function the scenario describes.

Password complexity requirements are a logical access control because they govern authentication through software-enforced rules on the credential itself, restricting who can gain system access. No physical barrier is involved, satisfying the question's requirement for a logical, rather than physical, control.

Default-deny firewall rules permit only explicitly required services, embodying least privilege by granting the minimum access necessary. This satisfies the stem's constraint of blocking all inbound traffic except specific necessary services, rather than relying on implicit trust.

Lockout thresholds directly throttle repeated authentication failures, so an attacker cannot iterate passwords indefinitely. The 5-attempts-in-15-minutes constraint caps the guessing rate, defeating brute-force attempts while allowing legitimate users to retry after the lockout window expires.

A fingerprint scan supplies a biometric credential that the system matches against a stored template, verifying the claimed identity. Authentication confirms who you are, whereas identification merely claims an identity. The scan therefore satisfies the stem's requirement for an authentication example, unlike identifiers such as a username, which only assert identity.

Mandatory access control bases every access decision on system-assigned labels compared against the subject's clearance, and users are not permitted to modify those values. Because the Restricted classification and the user clearance levels are centrally controlled and immutable to users, this arrangement is a textbook mandatory access control implementation.

Visitor management enforces sign-in, badge issuance and escort rules for non-employees, directly satisfying the stem's three on-premises controls. Unlike physical access systems that merely log entry, it governs the full visitor lifecycle from registration through check-out, matching the requirement that all visitors be authenticated, identifiable and supervised.

A cable lock physically restrains the laptop, preventing removal of the asset itself. This satisfies the stem's requirement for a control that operates on direct physical contact with the device, rather than on logical authentication or network permissions. Physical access controls therefore mitigate theft and unauthorised hardware access, distinct from technical or administrative categories.

Fencing, guards, badges and biometric locks each block a different attack path, so an intruder must defeat several independent controls. This layering satisfies the stem's requirement for overlapping physical barriers, which is precisely what defence in depth means.

Inactivity timeout terminates the session after a set idle period, so an unattended workstation cannot be abused by someone walking up and using the logged-in account. It directly satisfies the scenario's constraint of limiting exposure from a session left open without the user present.

Authentication is the process of verifying a claimed identity, satisfying the stem's requirement to prove the username. The password is validated against stored credentials, confirming the user is who they claim to be before any authorisation decision occurs.

Splitting the purchase order creation from its approval across two employees enforces separation of duties: no single person controls the whole transaction. This directly satisfies the stem's requirement by preventing one individual from both initiating and authorising financial payments, reducing fraud risk.

Session timeouts terminate idle authenticated sessions after a set period, shrinking the interval during which a stolen session token or cookie remains usable. This directly limits the window for session hijacking attacks, satisfying the stated security objective.

Users are a core Active Directory object class, representing identities that authenticate against a domain controller and receive access tokens. In this scenario, they satisfy the requirement for a key component, since every directory deployment stores user accounts as security principals that can be assigned permissions and group memberships.

Environmental attributes such as time of day and network location are first-class inputs in ABAC policy evaluation. A rule that grants access only between 08:00 and 18:00 when the request originates from the corporate network is a classic environmental condition. This illustrates how ABAC extends beyond identity alone to consider the context in which the access request occurs.

Identification is the act of claiming an identity, typically by entering a username, employee ID, or similar identifier that the system can recognize. The employee ID is asserted first and then verified by the token and badge. Because the ID by itself only names who the person claims to be, it is the identification step in this access control sequence.

Fencing, bollards, lighting, guards, and biometric readers are distinct control layers, each imposing a separate obstacle before the next. An attacker must defeat all layers sequentially, which is precisely the layered, delay-and-detect approach defence in depth describes.

Separating administrative duties from everyday user activity prevents routine browsing, email and document handling from exposing highly privileged credentials to phishing or credential theft. This directly satisfies the least-privilege and separation-of-duties requirements for privileged account management, limiting the blast radius if a standard account is compromised.

Rule-based access control evaluates administrator-defined conditions, and the time-of-day and day-of-week window is precisely such a condition. The policy applies uniformly regardless of who the teller is, and users cannot alter it. This matches the defining characteristic of rule-based control, where objective criteria govern the decision.

The root cause is that permissions were never re-evaluated when the employee changed roles, a failure of the access control lifecycle. A periodic access review, sometimes called recertification, compares current entitlements against what the job now requires and removes the excess. Revoking the stale Finance rights directly corrects the excessive privilege and prevents similar drift for other transfers.

The employee ID identifies the user, the password is something the nurse knows, and the one-time code from a hardware token is something the nurse has. Combining two different factors from separate categories satisfies multi-factor authentication. This accurately describes the hospital's login process and is the correct categorization.

CN is the attribute naming the entry itself within its container, holding the object's common name — here "John Smith". The stem's DN places CN as the leftmost, most specific relative distinguished name, with OU and DC components locating it hierarchically, so CN satisfies the question's request for the abbreviation's meaning.

Fingerprint recognition measures a physiological trait, which classifies it as a biometric control. Because the scan is matched against an enrolled template to confirm the person's claimed identity, it functions as an authentication mechanism at the lab entrance, satisfying the requirement that a biometric verifies something the individual is.

A biometric reader authenticates identity through fingerprint or iris traits before granting entry, directly controlling who physically passes through the server room door. It is a preventive physical control restricting human access to the facility.

An account lockout policy locks an account after a set number of failed authentication attempts, directly thwarting brute force attacks that rely on repeated password guessing. It satisfies the stem by halting the automated trial-and-error process before credentials are discovered.

Kerberos supports mutual authentication because the service ticket is encrypted with the service's secret key, proving the ticket came from the Key Distribution Center, while the authenticator proves the client holds the session key. This lets both parties verify each other, which is valuable in domain environments where clients must be sure they are contacting a legitimate service and not an impostor.

SAML is an XML-based federation standard where an identity provider sends signed assertions to service providers, enabling single sign-on. The scenario's central identity provider asserting identity to email, code repository, and expense applications matches SAML's identity provider and service provider model, making this the correct technology.

Organizational Units are containers within Active Directory that hold users, groups and computers hierarchically, letting administrators link Group Policy Objects at specific levels. This hierarchical structure satisfies the stem's requirement for organising directory objects so policies apply appropriately.

Accountability requires that every action can be attributed to a specific identity through unique credentials and audit logs. When several engineers share one privileged account, the logs record only the shared identity, so no one can be held responsible for a given change, which is exactly the control failure the audit identified.