hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` Policy Name: FinanceApp Access Subject: user role Resource: /finance/data Action: read, write Condition: time between 09:00 and 17:00 AND device.os == "Windows" Effect: Permit ```
Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?
⚠ Common exam trap
ISC2 often tests the nuance that a Deny rule with unmet conditions does not block access—candidates mistakenly assume a Deny rule always denies, but in policy engines, a rule only applies if all its conditions are true; otherwise, the engine falls through to the next rule or default action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's device attribute is incorrectly set to Windows.
The policy likely includes a condition such as 'Deny if device.os != "Windows"' to restrict write access to non-Windows devices. Since the user's device attribute is incorrectly set to 'Windows' (even though the actual device is macOS), the condition evaluates to false. Consequently, the Deny rule is not enforced, and the default Allow (or a broader Allow rule) permits write access. This misconfiguration results in unintended access from a macOS device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The condition is evaluated as OR instead of AND.
Why it's wrong here
If OR, the time condition alone would permit access; but the condition explicitly uses AND.
- ✗
The time condition is evaluated as BETWEEN 09:00 and 17:00 exclusive.
Why it's wrong here
10:00 is still inside 09:00-17:00 even if exclusive of endpoints.
- ✗
The policy is misconfigured with effect Deny.
Why it's wrong here
The effect is Permit, so it would allow access when conditions are met.
- ✓
The user's device attribute is incorrectly set to Windows.
Why this is correct
If the device OS attribute is wrong, the condition might be satisfied.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Misconfiguration
Misconfiguration is when a system, device, or software is set up incorrectly, leaving it vulnerable to attack or causing it to malfunction.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.