ISC2 CC Access Controls 1 — Questions and Answers
Question 1: What is the primary purpose of access control?
- To monitor network traffic
- To ensure only authorized users can access resources (Correct answer)
- To encrypt sensitive data
- To detect security incidents
Correct answer: To ensure only authorized users can access resources
Access control ensures that only authorized individuals can access specific systems, data, or physical locations.
Question 2: Which access control model grants access based on job functions or roles?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC (Role-Based Access Control) assigns permissions based on a user's role or job function within an organization.
Question 3: What is multi-factor authentication (MFA)?
- Using multiple passwords for the same account
- Requiring two or more different types of authentication factors to verify identity (Correct answer)
- Authenticating to multiple systems simultaneously
- Using biometrics as the sole authentication method
Correct answer: Requiring two or more different types of authentication factors to verify identity
MFA requires users to provide two or more different authentication factors (something you know, have, or are) to verify identity.
Question 4: Which authentication factor category does a password belong to?
- Something you have
- Something you are
- Something you know (Correct answer)
- Something you do
Correct answer: Something you know
Passwords, PINs, and security question answers are all knowledge-based 'something you know' authentication factors.
Question 5: What is the principle of separation of duties?
- Dividing network access between departments
- Requiring multiple individuals to complete sensitive or critical tasks (Correct answer)
- Separating development and production environments
- Dividing security responsibilities among team members
Correct answer: Requiring multiple individuals to complete sensitive or critical tasks
Separation of duties requires that critical tasks be divided among multiple individuals to prevent fraud or error by any single person.
Question 6: Which access control model allows resource owners to determine who can access their resources?
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC) (Correct answer)
- Rule-Based Access Control
Correct answer: Discretionary Access Control (DAC)
Discretionary Access Control (DAC) allows the owner of a resource to decide who can access it and what permissions they have.
ISC2 CC Access Controls 1
What is the primary purpose of access control?