ISC2 CC Access Controls Concepts Practice Question
In Active Directory, a GPO is used to enforce a policy that automatically locks user sessions after 15 minutes of inactivity. This is an example of which type of access control?
⚠ Common exam trap
Many exam-takers confuse the policy document (administrative) with its technical enforcement (logical) — CC often tests whether candidates can distinguish administrative, logical/technical, and physical control categories.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Logical access control
A GPO-enforced session lock is a logical access control because it is implemented in software/OS policy and governs how users interact with system resources after authentication. Logical controls include passwords, permissions, encryption, and session policies, all enforced by the operating system or applications rather than physical barriers or administrative procedures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detective access control
Why it's wrong here
A session lock terminates the session, which is a preventive mechanism, not a detective one; detective controls log or alert after the event. It is tempting because inactivity timeouts generate audit events, and detective controls would be the right answer when the requirement is to identify, not stop, activity.
- ✗
Physical access control
Why it's wrong here
The GPO enforces a logical session timeout on user accounts, so it operates at the logical access layer rather than restricting entry to a building or room. Physical controls would be correct for door locks, turnstiles or CCTV guarding a data centre.
- ✗
Administrative access control
Why it's wrong here
Administrative controls are policy, procedure and training-based; a GPO-enforced timeout is a technical control applied by the system. It is tempting because administrators configure the policy, but administrative controls would be correct for things like acceptable-use policies or security awareness training.
- ✓
Logical access control
Why this is correct
Logical access controls govern how subjects interact with systems and data, including session timeouts and authentication settings. A GPO enforcing a 15-minute inactivity lock restricts access through software configuration rather than physical barriers, directly satisfying the stem's requirement for automated session termination within Active Directory.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.