ISC2 CC Access Controls 2 — Questions and Answers
Question 1: What does Single Sign-On (SSO) allow users to do?
- Use a single very strong password across all systems
- Authenticate once and access multiple systems without re-authenticating (Correct answer)
- Share login credentials securely with colleagues
- Sign in from a single device only
Correct answer: Authenticate once and access multiple systems without re-authenticating
SSO allows users to authenticate once and then access multiple applications or systems without needing to log in again.
Question 2: What is the purpose of a privileged account?
- To give all users elevated access temporarily
- To provide administrators with elevated permissions for system management tasks (Correct answer)
- To allow temporary access for contractors
- To bypass security controls for efficiency
Correct answer: To provide administrators with elevated permissions for system management tasks
Privileged accounts have elevated permissions beyond standard users, typically used by administrators for system management tasks.
Question 3: Which of the following is a biometric authentication method?
- Password
- Smart card
- PIN
- Retinal scan (Correct answer)
Correct answer: Retinal scan
A retinal scan is a biometric authentication method that uses unique physical characteristics to verify identity.
Question 4: What is account provisioning?
- Monitoring user account activity for anomalies
- The process of creating and configuring user accounts and access rights (Correct answer)
- Disabling inactive user accounts
- Auditing user access permissions
Correct answer: The process of creating and configuring user accounts and access rights
Account provisioning is the process of creating user accounts and granting appropriate access rights based on job roles and requirements.
Question 5: What is the purpose of an access control list (ACL)?
- To log all user access attempts
- To define which users or systems have permission to access specific resources (Correct answer)
- To authenticate users to a network
- To encrypt network communications
Correct answer: To define which users or systems have permission to access specific resources
An ACL defines rules that specify which users, systems, or processes are permitted or denied access to specific resources.
Question 6: What does 'need to know' mean in the context of access control?
- Users should know all security policies
- Access is granted only to information required to perform a specific job (Correct answer)
- Managers must be notified of all access requests
- Users must know their security classification level
Correct answer: Access is granted only to information required to perform a specific job
Need to know means that access to information is granted only when it is necessary for a user to perform their specific job duties.
ISC2 CC Access Controls 2
What does Single Sign-On (SSO) allow users to do?