How should I use these Access Controls Concepts practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Access Controls Concepts questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Access Controls Concepts domain.

CC · topic practice

Access Controls Concepts practice questions

Practise ISC2 Certified in Cybersecurity CC Access Controls Concepts practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Access Controls Concepts

Practice 10 questions Browse domain →

What the exam tests

What to know about Access Controls Concepts

Access Controls Concepts questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Access Controls Concepts exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Access Controls Concepts questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Access Controls Concepts explanation →

An organization wants to implement the principle of least privilege for its database administrators. Which approach best achieves this goal?

Trap 1: Implement mandatory access control (MAC) with labels for all data.

MAC is more about classification than granular role-based permissions.

Trap 2: Allow administrators to self-assign permissions as needed.

Self-assignment undermines control and least privilege.

Trap 3: Assign each administrator full database admin rights for simplicity.

Full admin rights violate least privilege.

Study all Access Controls Concepts common traps →

A
Implement mandatory access control (MAC) with labels for all data.
Why wrong: MAC is more about classification than granular role-based permissions.
B
Use role-based access control (RBAC) to grant permissions specific to each administrator's duties.
RBAC aligns with least privilege by scoping permissions to roles.
C
Allow administrators to self-assign permissions as needed.
Why wrong: Self-assignment undermines control and least privilege.
D
Assign each administrator full database admin rights for simplicity.
Why wrong: Full admin rights violate least privilege.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Access Controls Concepts explanation →

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Trap 1: Job rotation

Job rotation is a security practice to rotate roles, not directly related to permission levels.

Trap 2: Need-to-know

Need-to-know is about data access based on necessity, but here the issue is unnecessary write ability.

Trap 3: Separation of duties

Separation of duties divides tasks among multiple people, not about permission levels.

Study all Access Controls Concepts common traps →

A
Job rotation
Why wrong: Job rotation is a security practice to rotate roles, not directly related to permission levels.
B
Need-to-know
Why wrong: Need-to-know is about data access based on necessity, but here the issue is unnecessary write ability.
C
Separation of duties
Why wrong: Separation of duties divides tasks among multiple people, not about permission levels.
D
Least privilege
Least privilege requires minimal permissions; write access is excessive.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Access Controls Concepts explanation →

Which access control model uses subject and object labels to enforce access based on a security policy?

Trap 1: Discretionary Access Control (DAC)

DAC allows owners to set permissions, not label-based.

Trap 2: Attribute-Based Access Control (ABAC)

ABAC uses attributes, not necessarily labels from a central policy.

Trap 3: Role-Based Access Control (RBAC)

RBAC uses roles, not labels.

Study all Access Controls Concepts common traps →

A
Discretionary Access Control (DAC)
Why wrong: DAC allows owners to set permissions, not label-based.
B
Attribute-Based Access Control (ABAC)
Why wrong: ABAC uses attributes, not necessarily labels from a central policy.
C
Mandatory Access Control (MAC)
MAC uses labels and a central policy to control access.
D
Role-Based Access Control (RBAC)
Why wrong: RBAC uses roles, not labels.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Access Controls Concepts explanation →

A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?

Trap 1: Need-to-know

Need-to-know restricts data access, not task division.

Trap 2: Least privilege

Least privilege is about minimal permissions, not splitting tasks.

Trap 3: Job rotation

Job rotation moves people through roles over time.

Study all Access Controls Concepts common traps →

A
Need-to-know
Why wrong: Need-to-know restricts data access, not task division.
B
Separation of duties
Separation of duties requires multiple people to complete a sensitive task.
C
Least privilege
Why wrong: Least privilege is about minimal permissions, not splitting tasks.
D
Job rotation
Why wrong: Job rotation moves people through roles over time.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Access Controls Concepts explanation →

An organization uses Active Directory and wants to grant a group of temporary interns access to a shared folder for exactly 30 days. Which access control approach is most efficient?

Trap 1: Use a group managed service account with a 30-day password…

Service accounts are not for user access; password expiration does not remove permissions.

Trap 2: Assign each intern directly to the folder permissions and set a…

Direct assignment and manual revocation is inefficient and risky.

Trap 3: Create a security group, add interns, and manually remove them…

Manual removal is error-prone and not efficient.

Study all Access Controls Concepts common traps →

A
Use a group managed service account with a 30-day password expiration.
Why wrong: Service accounts are not for user access; password expiration does not remove permissions.
B
Create a security group with a time-based membership that expires automatically after 30 days.
Time-based group membership automates access lifecycle, aligning with least privilege.
C
Assign each intern directly to the folder permissions and set a calendar reminder to revoke.
Why wrong: Direct assignment and manual revocation is inefficient and risky.
D
Create a security group, add interns, and manually remove them after 30 days.
Why wrong: Manual removal is error-prone and not efficient.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Access Controls Concepts explanation →

Which TWO are characteristics of Role-Based Access Control (RBAC)?

Trap 1: Object owners can delegate permissions to others.

Owner delegation is characteristic of DAC, not RBAC.

Trap 2: Access decisions are based on security labels.

Labels are used in MAC, not RBAC.

Trap 3: It enforces a centralized policy that cannot be overridden by users.

That describes MAC, not RBAC.

Study all Access Controls Concepts common traps →

A
Users are assigned to roles, and inherit permissions from those roles.
Role assignment is fundamental to RBAC.
B
Object owners can delegate permissions to others.
Why wrong: Owner delegation is characteristic of DAC, not RBAC.
C
Access decisions are based on security labels.
Why wrong: Labels are used in MAC, not RBAC.
D
It enforces a centralized policy that cannot be overridden by users.
Why wrong: That describes MAC, not RBAC.
E
Permissions are assigned to roles, not individual users.
RBAC groups permissions into roles.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Access Controls Concepts explanation →

Which THREE are valid methods for authenticating a user in an access control system?

Trap 1: User ID

User ID is identification, not authentication.

Trap 2: Access control list

ACL is an authorization mechanism, not authentication.

Study all Access Controls Concepts common traps →

A
User ID
Why wrong: User ID is identification, not authentication.
B
Fingerprint scan
Fingerprint is inherence factor.
C
Password
Password is knowledge factor.
D
Smart card
Smart card is possession factor.
E
Access control list
Why wrong: ACL is an authorization mechanism, not authentication.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full NAT/PAT explanation →

You are the security administrator for a mid-sized e-commerce company. The company uses a Linux-based web server running Apache, with a MySQL database backend. User authentication is handled via LDAP. Recently, the security team discovered that a former employee's account was used to access the customer database two weeks after the employee was terminated. The account had not been disabled. The database contains personally identifiable information (PII). The incident was traced to an internal IP address from the marketing department. The marketing department's network segment is not segregated from the database server. Additionally, the database server's firewall rules allow any internal IP to connect to the MySQL port (3306). The company has a written policy that accounts must be disabled within 24 hours of termination, but the HR department did not notify IT in a timely manner. Which combination of controls would BEST prevent a recurrence of this incident?

Trap 1: Deploy a database activity monitoring (DAM) solution that alerts on…

Monitoring detects but does not prevent; strong passwords don't stop terminated accounts.

Trap 2: Implement a firewall rule to block all traffic from the marketing…

This only addresses network segregation, not the account disablement issue.

Trap 3: Implement two-factor authentication for all database access, and…

2FA helps but does not prevent if account is still active; quarterly reviews are too infrequent.

Study all Access Controls Concepts common traps →

A
Deploy a database activity monitoring (DAM) solution that alerts on unusual queries, and require strong passwords for all database accounts.
Why wrong: Monitoring detects but does not prevent; strong passwords don't stop terminated accounts.
B
Implement a firewall rule to block all traffic from the marketing network to the database server, and require all database access to go through a bastion host.
Why wrong: This only addresses network segregation, not the account disablement issue.
C
Integrate HR system with identity management to automatically disable accounts upon termination, and implement network segmentation with a firewall that restricts database access to only authorized application servers.
Automated account disablement prevents use of terminated accounts; segmentation limits lateral movement.
D
Implement two-factor authentication for all database access, and conduct quarterly access reviews.
Why wrong: 2FA helps but does not prevent if account is still active; quarterly reviews are too infrequent.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Access Controls Concepts explanation →

A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?

Trap 1: Attribute-Based Access Control (ABAC)

ABAC can handle this but is more complex; RuBAC is more appropriate for simple rule enforcement.

Trap 2: Discretionary Access Control (DAC)

DAC allows users to control access, not enforce time/device rules.

Trap 3: Mandatory Access Control (MAC)

MAC uses labels like Top Secret, not time or device restrictions.

Study all Access Controls Concepts common traps →

A
Attribute-Based Access Control (ABAC)
Why wrong: ABAC can handle this but is more complex; RuBAC is more appropriate for simple rule enforcement.
B
Rule-Based Access Control (RuBAC)
RuBAC enforces access based on rules including time and device.
C
Discretionary Access Control (DAC)
Why wrong: DAC allows users to control access, not enforce time/device rules.
D
Mandatory Access Control (MAC)
Why wrong: MAC uses labels like Top Secret, not time or device restrictions.

Full breakdown with real-world context →

Question 10hardmulti select

Study the full AAA explanation →

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Trap 1: Identification

Identification is a step before authentication, not a separate AAA component.

Trap 2: Non-repudiation

Non-repudiation is a security objective, not part of AAA.

Trap 3: Auditing

Auditing is part of accounting but not a separate AAA component.

Study all Access Controls Concepts common traps →

A
Authorization
Authorization determines access rights; it is a core AAA component.
B
Identification
Why wrong: Identification is a step before authentication, not a separate AAA component.
C
Non-repudiation
Why wrong: Non-repudiation is a security objective, not part of AAA.
D
Authentication
Authentication verifies identity; it is a core AAA component.
E
Auditing
Why wrong: Auditing is part of accounting but not a separate AAA component.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Access Controls Concepts explanation →

Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?

Exhibit

Refer to the exhibit.
```
Policy Name: FinanceApp Access
Subject: user role
Resource: /finance/data
Action: read, write
Condition: time between 09:00 and 17:00 AND device.os == "Windows"
Effect: Permit
```

Trap 1: The condition is evaluated as OR instead of AND.

If OR, the time condition alone would permit access; but the condition explicitly uses AND.

Trap 2: The time condition is evaluated as BETWEEN 09:00 and 17:00…

10:00 is still inside 09:00-17:00 even if exclusive of endpoints.

Trap 3: The policy is misconfigured with effect Deny.

The effect is Permit, so it would allow access when conditions are met.

Study all Access Controls Concepts common traps →

A
The condition is evaluated as OR instead of AND.
Why wrong: If OR, the time condition alone would permit access; but the condition explicitly uses AND.
B
The time condition is evaluated as BETWEEN 09:00 and 17:00 exclusive.
Why wrong: 10:00 is still inside 09:00-17:00 even if exclusive of endpoints.
C
The policy is misconfigured with effect Deny.
Why wrong: The effect is Permit, so it would allow access when conditions are met.
D
The user's device attribute is incorrectly set to Windows.
If the device OS attribute is wrong, the condition might be satisfied.

Full breakdown with real-world context →

Question 12mediumdrag order

Review the full routing breakdown →

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediumdrag order

Read the full Access Controls Concepts explanation →

Drag and drop the steps to implement a firewall rule allowing inbound HTTPS traffic into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediummatching

Read the full Access Controls Concepts explanation →

Match each security control type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Discourages potential attackers

Blocks unauthorized access

Identifies and logs incidents

Restores after an incident

Alternative control when primary is not feasible

Question 15mediummatching

Read the full Access Controls Concepts explanation →

Match each authentication factor to an example.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Password

Smart card

Fingerprint

GPS location

Question 16easymultiple choice

Read the full Access Controls Concepts explanation →

A system administrator needs to grant a user the ability to read files in a specific folder but not modify them. Which access control principle should be applied?

Trap 1: Role-Based Access Control (RBAC)

RBAC assigns permissions based on roles, but does not inherently enforce the principle of least privilege.

Trap 2: Separation of Duties (SoD)

SoD requires multiple individuals to complete a sensitive task, not about permission levels.

Trap 3: Mandatory Access Control (MAC)

MAC is a system-enforced policy based on labels, not about limiting permissions to read-only.

Study all Access Controls Concepts common traps →

A
Role-Based Access Control (RBAC)
Why wrong: RBAC assigns permissions based on roles, but does not inherently enforce the principle of least privilege.
B
Least Privilege
Least privilege grants only the permissions necessary for the job, such as read-only access.
C
Separation of Duties (SoD)
Why wrong: SoD requires multiple individuals to complete a sensitive task, not about permission levels.
D
Mandatory Access Control (MAC)
Why wrong: MAC is a system-enforced policy based on labels, not about limiting permissions to read-only.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full Access Controls Concepts explanation →

A financial company requires that any transaction over $10,000 must be approved by two different managers before being processed. This is an example of which access control principle?

Trap 1: Least Privilege

Least Privilege limits permissions to the minimum needed, but does not involve multiple approvals.

Trap 2: Need-to-Know

Need-to-Know restricts information access based on job requirements, not task segregation.

Trap 3: Dual Control

Dual Control is a specific implementation of SoD but SoD is the overarching principle.

Study all Access Controls Concepts common traps →

A
Least Privilege
Why wrong: Least Privilege limits permissions to the minimum needed, but does not involve multiple approvals.
B
Need-to-Know
Why wrong: Need-to-Know restricts information access based on job requirements, not task segregation.
C
Dual Control
Why wrong: Dual Control is a specific implementation of SoD but SoD is the overarching principle.
D
Separation of Duties
SoD ensures that no single individual has complete control over a sensitive process by requiring multiple approvals.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Access Controls Concepts explanation →

During a security audit, it is discovered that a contractor has access to customer databases that were not required for their project. Which step should be taken first to mitigate the risk?

Trap 1: Notify the contractor's manager

Notifying management is important but does not directly stop the ongoing access.

Trap 2: Perform a risk assessment

Risk assessment should be done, but it is not the first step to mitigate immediate risk.

Trap 3: Log the access for evidence

Logging is useful for forensic purposes but does not mitigate the current risk.

Study all Access Controls Concepts common traps →

A
Notify the contractor's manager
Why wrong: Notifying management is important but does not directly stop the ongoing access.
B
Revoke the contractor's access immediately
Revoking access immediately stops the unauthorized access and reduces risk.
C
Perform a risk assessment
Why wrong: Risk assessment should be done, but it is not the first step to mitigate immediate risk.
D
Log the access for evidence
Why wrong: Logging is useful for forensic purposes but does not mitigate the current risk.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Access Controls Concepts explanation →

An organization implements an access control system where users are assigned to groups, and permissions are granted to groups rather than individuals. This is known as:

Trap 1: Mandatory Access Control (MAC)

MAC enforces policies system-wide using labels, not group assignments.

Trap 2: Discretionary Access Control (DAC)

DAC allows resource owners to set permissions, not necessarily group-based.

Trap 3: Attribute-Based Access Control (ABAC)

ABAC uses multiple attributes for access decisions, not just group membership.

Study all Access Controls Concepts common traps →

A
Mandatory Access Control (MAC)
Why wrong: MAC enforces policies system-wide using labels, not group assignments.
B
Role-Based Access Control (RBAC)
RBAC uses roles/groups to manage permissions efficiently.
C
Discretionary Access Control (DAC)
Why wrong: DAC allows resource owners to set permissions, not necessarily group-based.
D
Attribute-Based Access Control (ABAC)
Why wrong: ABAC uses multiple attributes for access decisions, not just group membership.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full Access Controls Concepts explanation →

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

Trap 1: Group membership inheritance

Inheritance might affect permissions, but the user is already in the correct group.

Trap 2: User account lockout status

Lockout would prevent all network access, not just this drive.

Trap 3: Effective permissions

Effective permissions show the result, but checking for denies is a more direct diagnostic step.

Study all Access Controls Concepts common traps →

A
Group membership inheritance
Why wrong: Inheritance might affect permissions, but the user is already in the correct group.
B
User account lockout status
Why wrong: Lockout would prevent all network access, not just this drive.
C
Check for explicit deny permissions on the folder
Deny entries override allows and can cause access issues even with correct group membership.
D
Effective permissions
Why wrong: Effective permissions show the result, but checking for denies is a more direct diagnostic step.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Access Controls Concepts sessions

Start a Access Controls Concepts only practice session

Every question in these sessions is drawn from the Access Controls Concepts domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Access Controls Concepts questions →Mixed CC session

Frequently asked questions

What does the CC exam test about Access Controls Concepts?: Access Controls Concepts questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Access Controls Concepts questions in a focused session?: Yes — the session launcher on this page draws every question from the Access Controls Concepts domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CC topics?: Use the topic links above to move to related areas, or go back to the CC question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CC exam covers. They are not copied from any real exam or dump site.

Access Controls Concepts only

10 questions 20 questions 30 questions 50 questions

Mixed CC session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CC questions Access Controls Concepts domain overview CC exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Access Controls Concepts practice questions

What to know about Access Controls Concepts

Common Access Controls Concepts exam traps

Access Controls Concepts questions

An organization wants to implement the principle of least privilege for its database administrators. Which approach best achieves this goal?

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Which access control model uses subject and object labels to enforce access based on a security policy?

A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?

An organization uses Active Directory and wants to grant a group of temporary interns access to a shared folder for exactly 30 days. Which access control approach is most efficient?

Which TWO are characteristics of Role-Based Access Control (RBAC)?

Which THREE are valid methods for authenticating a user in an access control system?

A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?

Exhibit

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag and drop the steps to implement a firewall rule allowing inbound HTTPS traffic into the correct order.

Match each security control type to its description.

Match each authentication factor to an example.

A system administrator needs to grant a user the ability to read files in a specific folder but not modify them. Which access control principle should be applied?

A financial company requires that any transaction over $10,000 must be approved by two different managers before being processed. This is an example of which access control principle?

During a security audit, it is discovered that a contractor has access to customer databases that were not required for their project. Which step should be taken first to mitigate the risk?

An organization implements an access control system where users are assigned to groups, and permissions are granted to groups rather than individuals. This is known as:

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

Track your progress over time

Start a Access Controls Concepts only practice session

Related CC topic practice pages