Access Controls practice questions

A system administrator needs to implement a control that ensures users can only access files necessary for their job functions. Which principle is being applied?

Trap 1: Need-to-know

Need-to-know restricts access to information required for a specific task, but least privilege is broader.

Trap 2: Separation of duties

Separation of duties divides critical tasks among multiple people, not about minimum access.

Trap 3: Job rotation

Job rotation moves employees across roles to reduce fraud risk, not about access levels.

A
Need-to-know
Why wrong: Need-to-know restricts access to information required for a specific task, but least privilege is broader.
B
Separation of duties
Why wrong: Separation of duties divides critical tasks among multiple people, not about minimum access.
C
Job rotation
Why wrong: Job rotation moves employees across roles to reduce fraud risk, not about access levels.
D
Least privilege
Least privilege ensures users have only the permissions necessary to perform their job.

Question 2mediummultiple choice

An organization wants to implement an access control model where data owners decide who can access resources. Which model should they choose?

Trap 1: Attribute-Based Access Control (ABAC)

ABAC uses policies that evaluate attributes, not owner discretion.

Trap 2: Mandatory Access Control (MAC)

MAC is centrally controlled by security labels, not by data owners.

Trap 3: Role-Based Access Control (RBAC)

RBAC assigns permissions based on roles, not individual owner decisions.

A
Attribute-Based Access Control (ABAC)
Why wrong: ABAC uses policies that evaluate attributes, not owner discretion.
B
Mandatory Access Control (MAC)
Why wrong: MAC is centrally controlled by security labels, not by data owners.
C
Role-Based Access Control (RBAC)
Why wrong: RBAC assigns permissions based on roles, not individual owner decisions.
D
Discretionary Access Control (DAC)
DAC allows data owners to grant access to others at their discretion.

Question 3hardmultiple choice

During a security audit, it is discovered that a developer has direct access to production databases. The policy requires that changes be reviewed and deployed by a separate team. Which control is being violated?

Trap 1: Need-to-know

Need-to-know is about information access, but the violation is about performing conflicting duties.

Trap 2: Job rotation

Job rotation reduces collusion risk but does not directly address the conflict of duties.

Trap 3: Least privilege

The developer has excessive access, but the core issue is lack of separation between development and production.

A
Need-to-know
Why wrong: Need-to-know is about information access, but the violation is about performing conflicting duties.
B
Job rotation
Why wrong: Job rotation reduces collusion risk but does not directly address the conflict of duties.
C
Least privilege
Why wrong: The developer has excessive access, but the core issue is lack of separation between development and production.
D
Separation of duties
The developer should not have direct production access; changes should go through a separate deployment team.

Read the full NAT/PAT explanation →

Question 4easymultiple choice

An administrator notices that a terminated employee's account is still active. Which access control process was likely skipped?

Trap 1: Authorization

Authorization defines access rights, but the issue is that the account was not disabled.

Trap 2: Authentication

Authentication verifies identity, not account deactivation.

Trap 3: Accounting

Accounting logs activities, but does not manage account lifecycle.

A
Authorization
Why wrong: Authorization defines access rights, but the issue is that the account was not disabled.
B
Authentication
Why wrong: Authentication verifies identity, not account deactivation.
C
Provisioning
Provisioning includes creating and disabling accounts; the termination process should have disabled the account.
D
Accounting
Why wrong: Accounting logs activities, but does not manage account lifecycle.

Question 5mediummultiple choice

A company uses an identity management system that requires users to authenticate using a smart card and a PIN. This is an example of:

Trap 1: Single sign-on (SSO)

SSO allows one login to multiple systems, not about factors.

Trap 2: Biometric authentication

Biometrics uses physical traits, not a card and PIN.

Trap 3: Multi-factor authentication

MFA requires two or more factors; this is a specific case of MFA, but two-factor is more precise.

A
Single sign-on (SSO)
Why wrong: SSO allows one login to multiple systems, not about factors.
B
Biometric authentication
Why wrong: Biometrics uses physical traits, not a card and PIN.
C
Two-factor authentication
Smart card (possession) and PIN (knowledge) constitute two-factor authentication.
D
Multi-factor authentication
Why wrong: MFA requires two or more factors; this is a specific case of MFA, but two-factor is more precise.

Question 6hardmultiple choice

An organization is implementing an access control system where access decisions are based on the sensitivity of the resource and the clearance of the user. Which model is being used?

Trap 1: Discretionary Access Control (DAC)

DAC lets owners set permissions, not based on clearance levels.

Trap 2: Attribute-Based Access Control (ABAC)

ABAC evaluates multiple attributes but does not inherently use clearance labels like MAC.

Trap 3: Role-Based Access Control (RBAC)

RBAC uses roles, not clearance levels.

A
Discretionary Access Control (DAC)
Why wrong: DAC lets owners set permissions, not based on clearance levels.
B
Attribute-Based Access Control (ABAC)
Why wrong: ABAC evaluates multiple attributes but does not inherently use clearance labels like MAC.
C
Role-Based Access Control (RBAC)
Why wrong: RBAC uses roles, not clearance levels.
D
Mandatory Access Control (MAC)
MAC uses security labels to enforce access based on classification and clearance.

Question 7easymultiple choice

A security policy requires that all access to sensitive data be logged. Which access control function does this support?

Trap 1: Authentication

Authentication is about verifying identity, not logging.

Trap 2: Authorization

Authorization defines what a user can do, but logging is part of accounting.

Trap 3: Provisioning

Provisioning manages account creation and deletion, not logging.

A
Authentication
Why wrong: Authentication is about verifying identity, not logging.
B
Authorization
Why wrong: Authorization defines what a user can do, but logging is part of accounting.
C
Accounting
Accounting tracks and logs user actions for auditing.
D
Provisioning
Why wrong: Provisioning manages account creation and deletion, not logging.

Question 8mediummultiple choice

A user reports that they cannot access a network share. The administrator checks the share permissions and NTFS permissions. The share permission allows Everyone: Read, and the NTFS permission allows the user: Full Control. What is the user's effective access?

Trap 1: Full Control

Full Control is not the most restrictive; share permission restricts it to Read.

Trap 2: No access

The user has Read access via share, so not no access.

Trap 3: Modify

Modify is not a standard permission in this context; the effective is Read.

A
Read
The effective permission is the most restrictive: share Read vs NTFS Full Control, so Read.
B
Full Control
Why wrong: Full Control is not the most restrictive; share permission restricts it to Read.
C
No access
Why wrong: The user has Read access via share, so not no access.
D
Modify
Why wrong: Modify is not a standard permission in this context; the effective is Read.

Question 9hardmultiple choice

An organization wants to implement a centralized authentication system that supports single sign-on and uses tickets. Which technology should they choose?

Trap 1: LDAP

LDAP is a directory protocol, not a ticket-based authentication system.

Trap 2: SAML

SAML is for federated identity and uses assertions, not tickets.

Trap 3: RADIUS

RADIUS is for network access authentication, not typically ticket-based SSO.

A
LDAP
Why wrong: LDAP is a directory protocol, not a ticket-based authentication system.
B
Kerberos
Kerberos uses a ticket-granting system for SSO.
C
SAML
Why wrong: SAML is for federated identity and uses assertions, not tickets.
D
RADIUS
Why wrong: RADIUS is for network access authentication, not typically ticket-based SSO.

Question 10mediummulti select

Which TWO of the following are examples of biometric authentication? (Choose two.)

Trap 1: Smart card

Smart card is something you have, not biometric.

Trap 2: PIN

PIN is something you know, not biometric.

Trap 3: Password

Password is something you know, not a biometric.

A
Smart card
Why wrong: Smart card is something you have, not biometric.
B
Retina scan
Retina scan is a biometric trait.
C
PIN
Why wrong: PIN is something you know, not biometric.
D
Fingerprint
Fingerprint is a biometric trait.
E
Password
Why wrong: Password is something you know, not a biometric.

Question 11hardmulti select

Which THREE are appropriate controls to prevent unauthorized access to a data center? (Choose three.)

Trap 1: Firewall

Firewall is a network control, not a physical data center access control.

Trap 2: Encryption

Encryption protects data at rest or in transit, not physical access.

A
Biometric scanner
Biometric scanner authenticates individuals for physical access.
B
Firewall
Why wrong: Firewall is a network control, not a physical data center access control.
C
Mantrap
Mantrap prevents tailgating and unauthorized entry.
D
Security guards
Guards can verify identity and control entry.
E
Encryption
Why wrong: Encryption protects data at rest or in transit, not physical access.

Study the full AAA explanation →

Question 12easymulti select

Which TWO are components of the AAA framework? (Choose two.)

Trap 1: Auditing

Auditing is related but not a core AAA component; the term is Accounting.

Trap 2: Accounting

Accounting is part of AAA, but only two are correct; we chose Authentication and Authorization.

Trap 3: Administration

Administration is not part of AAA.

A
Authorization
Authorization determines access rights.
B
Auditing
Why wrong: Auditing is related but not a core AAA component; the term is Accounting.
C
Accounting
Why wrong: Accounting is part of AAA, but only two are correct; we chose Authentication and Authorization.
D
Administration
Why wrong: Administration is not part of AAA.
E
Authentication
Authentication verifies identity.

Read the full VPN explanation →

Question 13hardmultiple choice

You are the security administrator for a healthcare organization that uses a Windows Active Directory domain. The organization has recently implemented a new electronic health record (EHR) system that requires users to authenticate before accessing patient data. The EHR system uses Kerberos for authentication. Users report that they can access the EHR system from their office workstations, but when they attempt to access it remotely via VPN, they receive an 'Access Denied' error. The VPN uses RADIUS for authentication and assigns IP addresses from a separate subnet. The EHR server is in the same domain as the workstations. You verify that the users are able to connect to the VPN successfully and can access other internal resources. What is the most likely cause of the issue?

Trap 1: The EHR server is not joined to the domain.

The server is in the same domain, otherwise office access would fail.

Trap 2: The VPN does not forward Kerberos traffic to the domain controller.

Other resources are accessible, so Kerberos traffic is likely forwarded.

Trap 3: The user's account is not in the EHR application's access group.

Users can access from office, so group membership is correct.

A
The EHR server is not joined to the domain.
Why wrong: The server is in the same domain, otherwise office access would fail.
B
The VPN does not forward Kerberos traffic to the domain controller.
Why wrong: Other resources are accessible, so Kerberos traffic is likely forwarded.
C
The remote user's system clock is not synchronized with the domain controller.
Kerberos requires time sync; VPN issues often corrupt time sync.
D
The user's account is not in the EHR application's access group.
Why wrong: Users can access from office, so group membership is correct.

Question 14mediummultiple choice

You are a security analyst at a financial institution. The company uses a role-based access control (RBAC) system for its internal banking application. Recently, the compliance team discovered that a teller, who should only have access to customer account information for their branch, was able to view account details for customers in other branches. The RBAC system assigns roles based on job titles. You review the configuration and find that the 'Teller' role has a permission that allows viewing all customer accounts, regardless of branch. The company wants to enforce branch-level restrictions. Which of the following is the best approach to address this issue?

Trap 1: Use mandatory access control (MAC) with labels for each customer…

MAC is not designed for branch-level separation and is complex to implement.

Trap 2: Create separate roles for each branch, such as 'Teller_Branch1',…

This leads to role explosion and is hard to manage.

Trap 3: Modify the 'Teller' role to remove the permission to view all…

This would prevent tellers from viewing any accounts, which is too restrictive.

A
Implement attribute-based access control (ABAC) to incorporate branch location as an attribute.
ABAC adds context like branch to RBAC, providing necessary restrictions.
B
Use mandatory access control (MAC) with labels for each customer account.
Why wrong: MAC is not designed for branch-level separation and is complex to implement.
C
Create separate roles for each branch, such as 'Teller_Branch1', 'Teller_Branch2', etc.
Why wrong: This leads to role explosion and is hard to manage.
D
Modify the 'Teller' role to remove the permission to view all accounts.
Why wrong: This would prevent tellers from viewing any accounts, which is too restrictive.

Question 15mediumdrag order

Drag and drop the steps for configuring a Windows Firewall rule to allow inbound RDP traffic into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediummatching

Match each authentication factor to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Something you know

Something you have

Something you are

Something you do

Question 17easymultiple choice

A help desk technician needs to reset a user's password but should not be able to modify other user attributes. Which access control principle should be applied to enforce this restriction?

Trap 1: Need-to-know

Need-to-know limits access to data, not actions; it is not the best fit for restricting operational permissions.

Trap 2: Separation of duties

Separation of duties involves dividing responsibilities among multiple people to prevent fraud, not restricting a single user's permissions.

Trap 3: Mandatory access control

MAC uses sensitivity labels and clearance levels; it is not designed for granular administrative task restrictions.

A
Need-to-know
Why wrong: Need-to-know limits access to data, not actions; it is not the best fit for restricting operational permissions.
B
Least privilege
Least privilege grants only the minimal permissions required to perform a job, which directly applies to restricting the technician to password reset only.
C
Separation of duties
Why wrong: Separation of duties involves dividing responsibilities among multiple people to prevent fraud, not restricting a single user's permissions.
D
Mandatory access control
Why wrong: MAC uses sensitivity labels and clearance levels; it is not designed for granular administrative task restrictions.

Question 18mediummultiple choice

A company uses role-based access control (RBAC). A user is assigned to the 'Sales' role, which grants access to CRM and reporting, and also to the 'Sales Manager' role, which grants additional access to team reports. However, the user cannot access team reports. What is the most likely cause?

Trap 1: An access control list on the report folder explicitly denies the…

While possible, this is less likely than a missing hierarchy; ACLs are more common in DAC environments.

Trap 2: The user account has been disabled

A disabled account would block all access, not just to team reports.

Trap 3: The user's session is not properly managed

Session issues would cause random access failures, not a consistent inability to access a specific resource.

A
An access control list on the report folder explicitly denies the 'Sales' role
Why wrong: While possible, this is less likely than a missing hierarchy; ACLs are more common in DAC environments.
B
The user account has been disabled
Why wrong: A disabled account would block all access, not just to team reports.
C
RBAC role hierarchy is not configured
Without a hierarchy, the user's permissions are the union of both roles; if the system only uses the first role's permissions, team reports are inaccessible.
D
The user's session is not properly managed
Why wrong: Session issues would cause random access failures, not a consistent inability to access a specific resource.

Read the full NAT/PAT explanation →

Question 19hardmultiple choice

An organization implements an attribute-based access control (ABAC) system with the following policy: if user.role == 'doctor' and resource.type == 'patient_record' and environment.time between 08:00-18:00 then permit. A doctor tries to access a patient record at 20:00. What is the result?

Trap 1: Permit

The policy requires time between 08:00-18:00; 20:00 is outside this range, so access is not permitted.

Trap 2: Indeterminate

Indeterminate results occur when there is missing or conflicting attribute data; here all attributes are present and consistent.

Trap 3: Not applicable

The policy is applicable because the user role and resource type match; it is evaluated and results in deny.

A
Permit
Why wrong: The policy requires time between 08:00-18:00; 20:00 is outside this range, so access is not permitted.
B
Indeterminate
Why wrong: Indeterminate results occur when there is missing or conflicting attribute data; here all attributes are present and consistent.
C
Not applicable
Why wrong: The policy is applicable because the user role and resource type match; it is evaluated and results in deny.
D
Deny
Since the time condition is not satisfied, the policy does not grant access, and the default deny rule applies.

Question 20easymultiple choice

Which access control model is best suited for a military environment where data classification (Unclassified, Confidential, Secret, Top Secret) and subject clearance levels are the primary factors for access decisions?

Trap 1: Attribute-Based Access Control (ABAC)

ABAC is flexible but is not the traditional or required model for military classification-based systems.

Trap 2: Discretionary Access Control (DAC)

DAC lets resource owners control access, which does not provide the mandatory enforcement required for classified data.

Trap 3: Role-Based Access Control (RBAC)

RBAC organizes permissions by job roles, not by data classification or clearance levels.

A
Attribute-Based Access Control (ABAC)
Why wrong: ABAC is flexible but is not the traditional or required model for military classification-based systems.
B
Mandatory Access Control (MAC)
MAC uses labels and clearance levels to enforce access, making it ideal for military and classified environments.
C
Discretionary Access Control (DAC)
Why wrong: DAC lets resource owners control access, which does not provide the mandatory enforcement required for classified data.
D
Role-Based Access Control (RBAC)
Why wrong: RBAC organizes permissions by job roles, not by data classification or clearance levels.