35 of 110 questions · Page 2/2 · Cc Access Controls topic · Answers revealed
A system administrator has a regular user account for daily work and a separate account with elevated privileges. Which principle is being applied?
Correct. Using a limited account for daily work follows least privilege.
Why this answer
Least privilege for admins means using a separate account with only necessary privileges, reducing risk.
Which THREE are recommended practices for password policies according to current guidelines?
Prevents use of compromised passwords.
Why this answer
Current guidelines recommend long passwords, breach checking, and avoiding frequent changes.
A security engineer is designing a physical security plan. Which combination of controls best represents defense in depth for a data center?
Correct. This layered approach exemplifies defense in depth.
Why this answer
Defense in depth uses multiple, overlapping controls. Perimeter fencing, access badges, biometric readers, and cable locks each address different layers, providing redundancy.
An organization uses Active Directory to manage user accounts. Which protocol does Active Directory primarily use to query and modify directory services?
LDAP is the protocol used by Active Directory for directory access.
Why this answer
Active Directory uses LDAP (Lightweight Directory Access Protocol) as the underlying protocol for directory queries and modifications.
Which account type is considered highest risk and should be protected with strict controls, including separate daily use accounts?
Admin accounts have full system access and are high risk.
Why this answer
Admin/root accounts have elevated privileges and are high-risk targets.
Which of the following is a recommended practice for password security according to NIST SP 800-63?
Correct. Length is favored, and passwords should be checked against known breaches.
Why this answer
NIST SP 800-63 recommends favoring password length over complexity and checking passwords against breached lists.
A security analyst notices that a user is accessing files in a department they do not work in. Which principle is being violated?
Accessing files outside job scope violates need-to-know.
Why this answer
Need-to-know restricts access to data necessary for one's job, even if the user has broader permissions.
A company implements a visitor management policy requiring all visitors to sign in, wear a badge, and be escorted. Which access control principle does this primarily support?
Multiple controls (sign-in, badge, escort) create layered security.
Why this answer
Visitor management controls physical access and supports defense in depth by adding layers.
A security administrator is implementing controls to prevent a single employee from approving and disbursing payments. Which principle is being applied?
Separation of duties prevents fraud by dividing critical functions.
Why this answer
Separation of duties ensures no single person can complete a high-risk action alone.
Which THREE are best practices for password management according to modern guidelines? (Select THREE.)
Length is favored over complexity; 8+ is minimum.
Why this answer
Modern guidelines (NIST SP 800-63) recommend length over complexity, no frequent changes, and checking against breach lists.
Which principle ensures that users are granted only the minimum permissions necessary to perform their job functions?
Least privilege grants only the minimum permissions needed.
Why this answer
Least privilege limits permissions to the minimum required, reducing the blast radius of a compromise.
In a directory service such as Active Directory, which component is responsible for storing information about users, groups, and computers in a hierarchical structure?
Correct. OUs are containers that organize directory objects.
Why this answer
Organizational Units (OUs) are containers that organize objects like users and computers in a hierarchy.
Which of the following is an example of a logical access control?
Correct. Passwords are logical access controls.
Why this answer
Logical access controls are software-based mechanisms that restrict access to systems and data. Passwords are a common logical control.
A company implements a policy where users must swipe their access card and then enter a PIN to enter the data center. This is an example of:
Correct. Card (something you have) and PIN (something you know) constitute MFA.
Why this answer
Multi-factor authentication (MFA) requires two or more factors: something you have (card) and something you know (PIN).
A company wants to implement defense in depth for its data center. Which THREE of the following controls should be included? (Select THREE.)
Correct. Badges control entry.
Why this answer
Defense in depth uses multiple layers: perimeter fencing (physical), access badges (physical/administrative), and encryption (logical).
A system administrator uses a separate administrative account with elevated privileges only when performing system maintenance, and uses a standard user account for daily activities like email. This practice aligns with which principle?
Using separate accounts ensures admin rights are only used when necessary, adhering to least privilege.
Why this answer
Least privilege for administrators: using separate admin accounts minimizes the risk of accidental changes or compromise, as the admin account is only used when needed.
Which THREE of the following are best practices for privileged account management? (Select THREE.)
PAM solutions centralize and secure privileged access.
Why this answer
Privileged accounts require special controls like separate accounts, PAM, and least privilege.
An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?
Separation of duties prevents a single person from performing both initiation and approval.
Why this answer
Separation of duties ensures no single individual can complete a high-risk action alone, reducing fraud risk.
A company implements a policy where no single employee can approve a purchase order over $10,000. Instead, two managers must jointly approve it. Which security principle does this practice exemplify?
Requiring two approvals for high-risk actions prevents a single person from committing fraud.
Why this answer
Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error.
A visitor signs in at a company's reception, receives a badge, and is escorted throughout the building. This process is part of which type of access control?
Visitor management is a physical security measure.
Why this answer
Visitor management includes sign-in, badge issuance, and escort policies, all of which are physical access controls to secure the premises.
A bank implements a policy that requires two different employees to approve any wire transfer over $10,000. One employee initiates the transfer, and another approves it. This is an example of which access control principle?
Separation of duties requires multiple people to complete a sensitive action, preventing fraud.
Why this answer
Separation of duties prevents any single individual from having complete control over a high-risk action, reducing the risk of fraud.
A visitor enters a company building and is required to sign in, present identification, and wear a visitor badge. This is an example of which type of access control?
Visitor management involves physical security measures.
Why this answer
Visitor management procedures are part of physical access controls to monitor and restrict entry.
An organization enforces a password policy requiring a minimum of 15 characters with no complexity requirements, and does not force periodic changes. This policy aligns with which current best practice?
NIST SP 800-63 recommends longer passwords and only forced changes upon compromise.
Why this answer
NIST SP 800-63 recommends favoring length over complexity and avoiding frequent forced changes unless compromised.
An organization wants to implement a physical access control that requires two different credentials to enter a high-security server room. Which concept does this best represent?
Correct. Using multiple layers of security (e.g., badge + biometric) is defense in depth.
Why this answer
Defense in depth involves multiple overlapping controls, such as requiring both a badge and a biometric scan.
What is the difference between identification and authentication?
Correct.
Why this answer
Identification is claiming an identity; authentication is proving that identity.
A company wants to implement account lockout to prevent brute-force attacks. Which lockout threshold is most appropriate according to common best practices?
5 attempts is within the recommended range.
Why this answer
Typical lockout thresholds are between 3 and 10 failed attempts to balance security and usability.
An employee claims to have accessed a confidential document that is not related to their job role. The security team investigates and finds that the employee's account had read access to the folder containing the document. Which TWO access control concepts were likely violated?
The employee accessed data not needed for their job.
Why this answer
Need-to-know restricts access to data required for job duties; the employee should not have accessed the document if it wasn't job-related. Least privilege ensures users have only necessary permissions; the employee likely had excessive rights if they could access unrelated data.
A security analyst is reviewing physical security controls. Which TWO are examples of perimeter physical controls? (Select TWO.)
Fencing is a perimeter control.
Why this answer
Perimeter controls secure the outer boundary. Fencing and lighting are common perimeter controls; badges and biometrics are interior or point-of-entry controls.
An organization implements a policy where no single employee can approve a financial transaction over $10,000; a second manager must also approve. This is an example of which access control principle?
Dual approval for high-risk actions exemplifies separation of duties.
Why this answer
Separation of duties requires multiple people to complete a critical task, reducing fraud risk.
According to modern password guidance from NIST SP 800-63, which of the following is the most important factor when setting password requirements?
Length is prioritized, with 8 characters minimum (15+ for high assurance).
Why this answer
NIST SP 800-63 recommends favoring password length over complexity, with a minimum of 8 characters (or 15+ for high assurance) and avoiding frequent forced changes unless compromised.
A security analyst notices repeated failed login attempts from a single IP address. The account is locked after 10 failed attempts. This is an example of which type of control?
Account lockout is a software-based control to prevent unauthorized access.
Why this answer
Account lockout is a logical access control that detects and mitigates brute-force attacks.
An LDAP distinguished name (DN) is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. Which component represents the organizational unit?
OU represents the Organizational Unit.
Why this answer
OU stands for Organizational Unit in LDAP DNs.
An organization wants to implement layered physical security for its data center. Which THREE of the following controls would be considered part of a defense-in-depth physical security strategy?
Equipment-level security is a final layer within the facility.
Why this answer
Defense in depth for physical security involves multiple layers: external perimeter controls (fencing, bollards, lighting), building entrance controls (guards, access badges, mantraps), and internal controls (server room biometric readers, equipment locks). Together they create overlapping barriers.
A system administrator is configuring account lockout policies to mitigate brute-force attacks. Which TWO settings are most critical for this purpose?
Threshold triggers lockout after a set number of failures.
Why this answer
Account lockout policies typically include an attempt threshold (e.g., 3-10 failed attempts) and a lockout duration or manual unlock requirement to prevent continuous brute-force attempts. These settings directly limit an attacker's ability to guess passwords.
Which of the following is an example of a physical access control at the building entrance?
Access badges are used at building entrances to authenticate individuals.
Why this answer
Access badges are a common physical control at building entrances.
Ready to test yourself?
Try a timed practice session using only Cc Access Controls questions.