CCNA Access Controls Concepts Questions

Perimeter fencing establishes the outermost physical boundary, deterring and delaying intruders before they reach the building housing the server room. It forms the first layer of a defence-in-depth strategy, complementing interior controls such as locks and cameras.

A session timeout is a crucial security mechanism designed to automatically terminate a user's active session after a specified period of inactivity. This process invalidates the session token or cookie, forcing re-authentication and preventing unauthorised access to an unattended workstation or application. Its primary purpose, as the stem asks, is to enhance security by ensuring inactive users are logged out, mitigating risks of session hijacking or data exposure.

Entering a username asserts a claimed identity to the system, which is the identification phase. Authentication would then verify that claim via the password. The username alone is an identifier, not proof, so it maps to identification within the access control process.

MAC uses security labels assigned by a central authority and compares them against user clearances to make access decisions. Users cannot modify labels or pass access to others, which aligns exactly with the scenario. This centralized, non-discretionary enforcement is the hallmark of MAC and satisfies the firm's requirement to control access based on data sensitivity labels.

Least privilege grants each account only the permissions its role requires, so a compromised user account exposes a narrow slice of resources rather than the whole environment. Limiting standing access directly caps the blast radius an attacker can reach after credential theft.

CN=John Smith, OU=Sales, DC=company, DC=com satisfies LDAP's leaf-to-root ordering, placing the common name first, then the organizational unit, then each domain component separately. Splitting company.com into two DC attributes matches the stem's domain constraint, unlike a single DC=company.com entry.

Session timeout automatically locks or terminates an idle session after a defined inactivity period, so an unattended workstation cannot be used by an unauthorised person. It directly addresses the walk-away threat rather than authentication or authorisation at logon.

Need-to-know restricts access to information strictly required for a specific task, independent of seniority. Combined with least privilege, it satisfies the policy's minimum-permissions requirement by limiting data exposure, reducing impact if the account is compromised.

Least privilege grants each user only the minimum rights required for their job, exactly matching the stem's constraint. Unlike role-based or mandatory models, it limits permissions to necessity, reducing the attack surface and potential damage from compromised or misused accounts.

In an LDAP distinguished name, CN stands for Common Name, the leftmost relative distinguished name identifying the entry itself. Here it names the object "John Smith" within the Sales organisational unit, satisfying the stem's requirement to identify what the CN attribute represents in the DN hierarchy.

Least privilege grants each user only the access rights necessary for their job, nothing more. This satisfies the stem's requirement by restricting permissions to the minimum needed, reducing the blast radius of compromised accounts or insider misuse.

Fencing defines the outer physical boundary of a site, delaying or deterring intruders before they reach the building. It therefore operates as an external perimeter measure, satisfying the stem's requirement, whereas locks and badge readers sit at internal entry points.

PAM brokers privileged sessions through a controlled vault, enforcing approval workflows, credential checkout and full session recording. This satisfies the scenario's need to both restrict who reaches critical systems and retain auditable evidence of every administrative action performed.

The password represents something the user knows, while the one-time code generated by the mobile authenticator app represents something the user has, namely the registered device. Combining these two distinct factor types satisfies multi-factor authentication. This pairing is the most common MFA implementation and directly matches the scenario's username/password plus app-generated code.

Fencing establishes a physical barrier at the property boundary, delaying or deterring intruders before they reach the building. It satisfies the external perimeter constraint by providing the outermost layer of physical protection, which lighting and interior controls then reinforce.

Account lockout is enforced through Group Policy settings processed by the domain controller, restricting access via software configuration rather than physical barriers. This makes it a logical access control, satisfying the scenario's requirement to limit system entry after repeated failed authentication attempts.

Authentication verifies that the claimed identity matches the person presenting the credential. The badge scan supplies a factor that the system validates against the enrolled identity for that nurse, confirming the user is who the username claims. Only after this verification succeeds can the system decide authorization, so the scan is the authentication step in this scenario.

One employee both initiating and approving payments removes the independent check, letting fraudulent transactions pass unchallenged. Separation of duties requires these functions be split across different people, so the violation creates a direct fraud risk.

Smart card authentication is a logical access control because it governs access through technical means — credentials and certificates validated by a system — rather than physical barriers. It satisfies the stem's requirement by restricting system access based on logical identity verification.

PAM brokers privileged accounts through vaulting, session isolation and credential checkout, so administrative actions are both restricted and recorded. This controls and monitors privileged access, satisfying the stem's requirement for a primary benefit rather than general authentication or endpoint protection.

Authentication is the process of verifying that a subject's claimed identity is genuine, typically by validating something the subject knows, has, or is. Entering a username and password and having the directory confirm them is the classic example of authentication. The system is proving the employee is who they claim to be before any access decision is made.

Authentication verifies a claimed identity by validating credentials such as passwords, tokens or biometrics against stored data. This directly satisfies the stem's requirement, distinguishing it from authorisation, which determines what an already-identified user may access.

Least privilege restricts user access rights to the minimum set of permissions required to complete assigned job functions, directly satisfying the stem’s requirement to reduce the impact of a compromised account. By enforcing granular permission boundaries—such as read-only access to specific Microsoft Entra ID resources rather than full administrative roles—this principle limits lateral movement and data exposure if credentials are stolen.

Brute force attacks repeatedly submit password guesses until one succeeds. Locking the account after five failures within 15 minutes halts that iterative guessing, because further attempts are refused regardless of correctness, directly mitigating the attack's core mechanism.

A mantrap uses two sets of doors with interlocking controls so that only one authenticated individual can pass at a time, preventing tailgating into the server hall. Combined with authentication, it restricts who enters and can be integrated with logging. This directly addresses the goal of controlling physical entry to the protected space.

When an employee leaves, all access rights should be revoked as part of offboarding. Disabling the account is not sufficient if permissions remain on resources, because the account could be re-enabled or the permissions could be inherited by another account. The scenario shows that read and write permissions persisted, so the offboarding process failed to remove access properly.

A password is the credential a subject supplies to prove claimed identity, making it the authentication component of the process. Identification occurs when the user presents a username or similar identifier, which the password then verifies against stored data.

Separating a standard account from an elevated one limits privileged access to tasks that genuinely require it, applying least privilege. This satisfies the stem's scenario by preventing daily activities, such as browsing email, from running with administrative rights.

RBAC assigns permissions to roles such as Tax Preparer or Auditor, and users receive access by being placed in the appropriate role. The firm wants access determined by department membership, which maps directly to role assignment, so permissions stay consistent as individuals move. This satisfies the requirement without per-user permission management.

Checking passwords against breached-password lists blocks credentials already exposed in known data breaches, directly satisfying the guideline to screen for compromised passwords. Microsoft Entra ID implements this natively through its banned-password list, which is populated from breach data and automatically rejects matching entries during password set or reset.

Account expiration enforces a hard stop date, so the contractor's credentials stop working when the 90-day engagement ends without anyone needing to remember to disable them. Periodic access reviews require the manager to reconfirm that the access remains justified, catching situations where the engagement is extended unnecessarily or where the scope has drifted. Together they address both automatic termination and ongoing validation of need.

MAC enforces access decisions from system-controlled labels rather than from user discretion. Subjects receive clearances and objects receive classifications, and the system permits access only when the clearance dominates the label. Because users cannot alter labels or extend access to others, this precisely matches the described enforcement, including the dominance rule for reading.

Each layer compensates if an earlier one fails: fencing delays intrusion, badges filter entrants, biometrics restrict the server room, and cable locks stop physical theft. This satisfies the defence-in-depth requirement by combining deterrence, detection and delay across independent boundaries.

LDAP is the directory access protocol Active Directory natively speaks, providing the query and modify operations the stem requires. Clients bind to the directory and issue search, add, modify, and delete requests over TCP port 389 or 636. Kerberos handles authentication, but LDAP performs the directory read and write operations.

Admin and root accounts hold unrestricted control over systems and data, so their compromise yields immediate full impact. Separate daily-use accounts ensure routine browsing and email never expose these credentials, satisfying the strict-control requirement for the highest-risk account type.

RBAC grants permissions to roles rather than to individual users, and users receive permissions by being assigned to a role. Creating a 'Pediatric Nurse' role and assigning nurses to it directly solves the rotation and administration problem described. When a nurse moves departments, only the role assignment changes, and permissions follow automatically, reducing errors.

NIST SP 800-63 recommends an eight-character minimum and screening new passwords against breached-password lists, blocking compromised credentials. This satisfies the stem's requirement by reflecting current guidance that favours length and breach checking over forced periodic rotation and composition rules.

Accessing another department's files breaches need-to-know, which restricts data to individuals whose specific duties require it. Least privilege governs permission scope, not data relevance, so it does not fit this scenario. Need-to-know satisfies the stem's constraint: a user reaching files outside their own department.

Rule-based access control decides access by evaluating conditions at request time. A rule can require that the current time fall within contracted hours and that the connecting device be enrolled and compliant in the management system. Both constraints in the scenario are conditions, making rule-based access control the appropriate model to enforce them dynamically.

RBAC grants permissions to roles rather than individuals, and users receive access through role assignment. When the employee moves from accounting to marketing, the role changes and permissions follow automatically. This matches the scenario precisely, where HR role data drives access updates without per-user permission edits.

Separation of duties splits a critical transaction across multiple people so no single employee controls it end to end. Requiring one person to raise a payment and another to approve it directly satisfies the stem's constraint: preventing one employee from both approving and disbursing funds.

Need to know limits access to only the specific information a user requires to perform their duties. The teller needs records for their own branch's customers to serve them, but has no legitimate need to view customers at other branches. Restricting the teller's visibility to only the records necessary for their work is the essence of the need-to-know principle.

Least privilege grants each user only the minimum permissions their job requires, limiting blast radius if credentials are compromised. It directly satisfies the stem's constraint of minimum necessary access, unlike broader models such as role-based or discretionary access.

Something you have is a possession factor, and the smart card is a physical token the employee holds and inserts into a reader. The card performs cryptographic operations with a private key that never leaves it, proving possession. This is the classic example of a possession factor used in multifactor authentication, distinct from memorized secrets or biometric traits.

Access badges enforce authentication at the building entry point, verifying identity before anyone reaches the data centre. It satisfies the defense in depth constraint by adding a physical access control layer that complements network, encryption and administrative safeguards.

Least privilege grants only the rights needed for the current task, so the administrator uses a standard account daily and elevates only for maintenance. This limits exposure from compromised sessions, matching the stem's separate-account practise.

A PAM solution vaults credentials, brokers sessions and logs administrative activity, directly satisfying the monitoring and control requirement for privileged account management. It removes standing access by checking out credentials per session, giving accountability and auditability that shared or unmanaged admin accounts lack.

Separation of duties splits a critical transaction across two distinct individuals so no single person controls the whole process. Requiring one employee to initiate and a manager to approve enforces this split, preventing fraud or undetected error.

Separation of duties splits a sensitive transaction across two people so no single employee holds end-to-end authority. Requiring two managers to jointly approve orders above $10,000 enforces exactly this: the approval capability is divided, preventing one person from committing fraud or error unchecked.

Physical access control governs entry to premises and movement within them, matching the reception sign-in, badge issue and escort described. The badge acts as the credential enforcing that control, while the escort constrains where the visitor may go. Logical controls such as Microsoft Entra ID govern systems, not building entry.

RBAC assigns permissions to roles and users to roles, so developers receive read and commit rights while the release manager receives tag creation rights. Because the rules are defined centrally by role rather than by repository ownership, they apply consistently to everyone. This matches the company's requirement that the separation be enforced regardless of who owns the repository.

Separation of duties splits a sensitive transaction across two distinct identities so no single employee can complete it alone. The stem's constraint — one employee initiates, a different employee approves transfers over $10,000 — is satisfied precisely because authorisation is divided between separate people, preventing unilateral fraud.

Signing in, presenting identification and wearing a visitor badge are tangible measures regulating who enters the building. They restrict human movement through the facility, which defines physical access control rather than logical or administrative control.

NIST guidance favours longer passphrases over forced complexity and drops mandatory periodic rotation, since length resists cracking while frequent changes push users toward predictable patterns. A 15-character minimum with no complexity rules and no expiry matches this modern approach.

Mandatory access control bases every decision on labels assigned to subjects and objects, and the operating system enforces those labels regardless of user intent. Clearance must dominate classification for read access, which explains why Secret cannot read Top Secret while Top Secret can read Secret. This label-driven dominance rule is the hallmark of mandatory access control.

Identification presents a claimed identity, such as a username, while authentication verifies that claim through credentials or factors, proving the subject genuinely owns that identity. This distinction satisfies the stem's requirement to separate the assertion of identity from its cryptographic or knowledge-based validation, matching how Microsoft Entra ID processes sign-ins.

Authentication verifies that a claimed identity is genuine. Inserting the smart card supplies something the doctor has, and validating its embedded certificate against the hospital's internal certificate authority proves the credential is trusted. This process confirms the doctor is who the card claims, which is precisely the definition of authentication in the access control lifecycle.

ABAC evaluates attributes of the subject, object, action, and environment, including time-of-day and shift schedule. By defining a policy that permits access only when the current time falls within the nurse's assigned shift, ABAC directly enforces the temporal restriction. This makes it the appropriate model for dynamic, context-aware conditions such as shift-based access.

Need-to-know restricts access to information strictly required to perform a role. The employee's job role did not require the confidential document, yet their account held read access to its folder, so access was granted beyond job necessity, violating this principle.

Fencing around the property is a perimeter physical control because it establishes the outermost boundary of the site, deterring and delaying unauthorised access before an intruder reaches the building. It satisfies the scenario's requirement for controls operating at the external perimeter, unlike interior measures such as locks on server-room doors.

Role-based access control grants permissions to roles, and users receive permissions by being assigned to a role. In this scenario the job title acts as the role, and changing the title automatically changes access. This central administration of permissions through roles, rather than per-user grants, is the defining characteristic of RBAC.

Separation of duties splits a sensitive task across multiple people so no single individual holds end-to-end authority. Requiring a second manager's approval for transactions above $10,000 enforces this by preventing one employee from both initiating and authorising payment, directly satisfying the stem's dual-approval constraint.

NIST SP 800-63 prioritises length as the primary strength factor, since each added character multiplies guessing resistance far more than complexity rules. An 8-character minimum satisfies this by raising the search space, though verifiers should also screen against breached-password lists and rate-limit failed attempts.

Account lockout after repeated failed logins is a logical access control: a software-enforced restriction on authentication attempts. It mitigates brute-force or password-guessing attacks from a single source by temporarily denying access, unlike physical or administrative controls.

Privilege creep occurs when a user accumulates access rights over time as roles change and old entitlements are never revoked. The clerk's finance permissions should have been removed when the transfer occurred. The residual rights create unnecessary exposure and violate least privilege, making this the accurate description of the weakness.

OU=Sales identifies the organizational unit, since the OU attribute type in a distinguished name denotes a container within the directory hierarchy. The stem asks specifically which component represents the organizational unit, and this value directly satisfies that constraint, distinguishing it from CN (common name) and DC (domain component) elements.

The user states who they claim to be by entering a username, which is identification. The system then verifies that claim through the smart card (something you have) and the password (something you know), which constitute authentication. This two-factor validation matches the classic definition of authentication as proving a claimed identity before authorization is evaluated.

Authorization occurs after authentication and defines the resources and actions available to an identity. Restricting voids above a threshold and limiting inventory adjustments are authorization decisions applied to an authenticated cashier. This statement correctly describes authorization as the mechanism enforcing these granular permissions in the point-of-sale design.

Cable locks physically tether laptops to a fixed anchor, preventing opportunistic theft of endpoint devices. This satisfies the layered strategy by extending physical protection beyond the data centre perimeter to the assets themselves, complementing door, fence and bollard controls.

The lockout threshold defines how many consecutive failed authentication attempts trigger the lockout, directly throttling brute-force guessing. Setting it low, such as five, limits an attacker's attempts per account before the account is disabled, satisfying the requirement to mitigate brute-force attacks.

Separation of duties splits sensitive tasks among different people, and constrained RBAC enforces it by defining mutually exclusive roles so one account cannot hold both the initiating and approving permissions. This directly prevents a manager from approving their own refund while still allowing them to approve transactions created by others.