ISC2 CC Access Controls Concepts Practice Question
Which TWO of the following are recommended practices for managing privileged accounts? (Select TWO.)
⚠ Common exam trap
The trap is that 'convenience' options (shared passwords, single account, disabled logging) sound efficient to busy admins, but the exam expects you to recognize they all violate core security principles of accountability, least privilege, and auditability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a separate admin account for privileged tasks
Option A is correct because creating a separate admin account for privileged tasks enforces separation between a user's standard daily-use account and their elevated account, so routine activities like email and web browsing cannot be leveraged to compromise administrative rights, and it enables auditing of privileged actions to a distinct identity. Option D is correct because a Privileged Access Management (PAM) solution provides vaulting, credential rotation, session brokering, just-in-time elevation, and monitoring of privileged sessions, which are core controls for reducing standing administrative access and detecting misuse. Option B is not recommended because using one account for both daily work and administrative tasks grants excessive standing privilege and exposes admin credentials to everyday attack surfaces such as phishing and malicious websites. Option C is wrong because disabling logging for admin activities destroys the audit trail needed for accountability, incident response, and compliance, and the overhead is not a valid reason to eliminate it. Option E is wrong because sharing admin passwords among team members eliminates individual accountability, prevents effective credential rotation, and violates the principle of least privilege and non-repudiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a separate admin account for privileged tasks
Why this is correct
Separating administrative duties from everyday user activity prevents routine browsing, email and document handling from exposing highly privileged credentials to phishing or credential theft. This directly satisfies the least-privilege and separation-of-duties requirements for privileged account management, limiting the blast radius if a standard account is compromised.
- ✗
Use the same account for daily work and administrative tasks
Why it's wrong here
Merging daily work and administrative duties into one account removes the separation of duties that limits blast radius if credentials are phished; the account then holds standing privilege. Dedicated admin accounts are tempting because they reduce the number of logins to manage, and would suit a single-operator lab with no sensitive data.
- ✗
Disable logging for admin activities to reduce overhead
Why it's wrong here
Disabling logging destroys the audit trail needed to attribute privileged actions and detect misuse, so accountability and forensic reconstruction both fail. Turning logging off is tempting where storage or performance budgets are tight, and would be defensible only in an isolated test environment holding no regulated data.
- ✓
Implement a Privileged Access Management (PAM) solution
Why this is correct
A PAM solution satisfies the requirement to control, monitor and audit elevated access by vaulting credentials, enforcing just-in-time elevation and session recording. This directly addresses the risk of standing administrative rights, which standard Microsoft Entra ID role assignment alone does not mitigate.
- ✗
Share admin passwords among team members for convenience
Why it's wrong here
Shared passwords remove individual accountability, since audit logs can no longer attribute an action to one person, and they prevent revocation when someone leaves. Sharing is tempting for small teams covering on-call rotas, and would only be tolerable for a non-privileged shared mailbox with no administrative rights.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.