ISC2 CC Access Control Concepts Quiz

1. What is account provisioning in IAM?

Assigning access rights and creating user accounts

Monitoring user activities and login attempts

Removing user access when employment ends

Encrypting user credentials in transit

Submit

5. Which statement best describes conditional access?

All users must access systems from the same location

Access is granted or denied based on real-time risk assessment

Users receive access only during business hours

Conditional access replaces the need for authentication

6. Privileged Access Management (PAM) solutions primarily protect:

End-user passwords and email accounts

High-risk accounts with elevated permissions

Social media credentials

Public-facing web applications

7. In the context of access control, what does authorization determine?

Whether a user's identity is genuine

What actions an authenticated user can perform

How user activities are recorded and monitored

The strength of the user's password

8. Single Sign-On (SSO) provides which security benefit?

Users access multiple systems with one authentication

Eliminates the need for passwords entirely

Prevents unauthorized network access completely

Removes the requirement for encryption

9. Which access control mechanism uses Access Control Lists (ACLs)?

Role-Based Access Control

Mandatory Access Control

Discretionary Access Control

Attribute-Based Access Control

10. Separation of duties is a control principle that requires:

One person to handle all critical functions

Critical functions distributed among multiple people

All duties performed by system administrators

Users to change roles monthly

11. Which of the following best defines access control in a cybersecurity context?

The process of identifying users before granting system access

Mechanisms that restrict what authenticated users can do with resources

Monitoring and recording user activities for compliance purposes

Encrypting data to prevent unauthorized viewing

12. Identity and Access Management (IAM) systems typically include which core functions?

Encryption and data classification only

Identity verification, provisioning, and access control

Network monitoring and intrusion detection

Backup and disaster recovery

13. Which of the following is NOT typically considered an authentication factor?

Something you know (password)

Something you are (biometric)

Something you have (token)

Something you see (visual cues)

14. Multi-factor authentication (MFA) enhances security by requiring:

Multiple passwords for the same account

Two or more different types of authentication factors

Longer passwords with special characters

Repeated login attempts on different devices

15. Which statement accurately describes Discretionary Access Control (DAC)?

The system enforces access based on security labels

Resource owners determine who can access their resources

Access is determined solely by user roles

The operating system controls all access decisions

16. In MAC, access decisions are based on:

User roles assigned by administrators

Security labels and classifications set by system policy

Owner discretion and file permissions

User attributes and environmental factors

17. Which access control model uses attributes (user, resource, environment) to make access decisions?

Discretionary Access Control (DAC)

Mandatory Access Control (MAC)

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

18. What is the principle of least privilege?

Users should have maximum access to perform their duties

Users receive only the minimum permissions necessary for their role

All users have equal access to all resources

Privileges increase automatically with job tenure

19. In Role-Based Access Control (RBAC), access decisions are based on:

User attributes and environmental conditions

The user's assigned organizational role

Data classification level only

Time of access and network location

20. Authentication, authorization, and accounting (AAA) are core security functions. Which component verifies user identity?

Authorization

Accounting

Authentication

Auditing