22 Logical Access Controls & Models Practice Questions & Answers

1. 1. An organization's policy states that every account is granted only the permissions its assigned job requires. Which statement best expresses what the principle of least privilege demands?

   • A.Permissions are set to the department's highest common level so colleagues can cover work.
   • B.Permissions are limited to what the assigned duties require, and limited in duration too.✓ Answer
   • C.Permissions are granted broadly at hire and trimmed later when an audit finds excess rights.
   • D.Permissions are assigned by seniority, so longer-serving staff hold wider system rights.

   Least privilege means a subject holds the minimum permissions needed to perform its function and nothing more. The limit applies to how long a right is held as well as how broad it is, which is why temporary or just-in-time elevation is preferred over a permanent grant: the smaller the standing permission set, the smaller the damage a compromised or misused account can do.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts (Identity and Access Management Concepts), logical access controls — principle of least privilege; NIST SP 800-53, control AC-6 Least PrivilegeReport a problem with this question

2. 2. An employee has transferred twice in four years, from purchasing to logistics to marketing. Each time she received the permissions of the new department, and none of the earlier permissions were removed. What is this condition called, and which principle does it break?

   • A.Privilege escalation, which breaks least privilege by letting her raise her own rights.
   • B.Privilege creep, which breaks least privilege by leaving unneeded rights in place.✓ Answer
   • C.Separation of duties, which is broken because two departments use the same system.
   • D.An orphaned account, which breaks least privilege by leaving a login with no owner.

   Privilege creep (also called authorization creep) is the failure of the "mover" stage of the identity life cycle: new rights are added on transfer but old ones are never revoked, so the account slowly accumulates access far beyond the current job. It differs from privilege escalation, where an attacker or user gains rights they were never granted. The standard detective control is a periodic access review in which the manager or data owner recertifies each entitlement.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts (Identity and Access Management Concepts) — identity life cycle management (provision, review, deprovision) and principle of least privilegeReport a problem with this question

3. 3. A company deploys an AI agent that reads its ticketing system and drafts replies. To save configuration time, the agent is issued credentials with read and write access to every system the company runs. Which principle is violated, and what is the correct fix?

   • A.Need-to-know; the agent should justify each ticket it opens to a human supervisor.
   • B.Separation of duties; the agent should be divided into two agents with two owners.
   • C.Least privilege; the agent should hold only the ticketing permissions it needs.✓ Answer
   • D.Job rotation; the agent's credentials should be moved to another system each month.

   Least privilege applies to non-human identities exactly as it does to people: an AI agent, bot or service account is an identity and must be provisioned with only the permissions its task requires. Granting blanket access makes the agent's credential a single point of total compromise, because anything that hijacks the agent inherits every right it holds. Such identities should also be non-interactive and run through the same provision, review and deprovision life cycle as human accounts.

   Source: NIST SP 800-53, control AC-6 Least Privilege (applies to users and to processes acting on their behalf); ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts — logical access controlsReport a problem with this question

4. 4. Two analysts hold the same role and identical system permissions, yet only one of them may open the case file for a particular investigation. Which concept explains that additional restriction?

   • A.Separation of duties, which splits a sensitive task between two people.
   • B.Least privilege, which limits the permission level an account is issued.
   • C.Need-to-know, which limits access to the specific information a duty requires.✓ Answer
   • D.Dual control, which requires two people to act on the same task at once.

   Need-to-know and least privilege are related but distinct. Least privilege governs the breadth of permissions an account is issued; need-to-know governs whether a particular item of information is justified by the holder's current duty. Two people can therefore carry identical privileges and still be separated by need-to-know, because only one of them is working the case that the file belongs to.

   Source: NIST SP 800-53, control AC-6 Least Privilege and its need-to-know discussion; ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts — logical access controlsReport a problem with this question

5. 5. Why does an organization divide a sensitive business process so that no single employee can carry it out from beginning to end?

   • A.So that one person acting alone cannot both commit and then conceal a fraudulent act.✓ Answer
   • B.So that each person involved needs fewer individual permissions on the system.
   • C.So that the process keeps running whenever one assigned employee is absent.
   • D.So that every step is recorded in a log the participants are unable to edit.

   Separation of duties splits a critical process so that completing it requires two or more people. The security value is that the same individual cannot both carry out a fraudulent action and control the step that would reveal or approve it; a second, independent person has to act before the process finishes. Reducing individual permissions is a least-privilege outcome, and continuity of operations is a side effect, not the purpose.

   Source: NIST SP 800-53, control AC-5 Separation of Duties; ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts — logical access controlsReport a problem with this question

6. 6. In an accounts payable department, the same clerk adds new vendors to the master file, enters their invoices, approves the payments and releases the bank transfers. Which control is missing?

   • A.Job rotation, because the clerk has held the same position for too long.
   • B.Least privilege, because the clerk's account holds more rights than needed.
   • C.Need-to-know, because the clerk can read vendor records from other units.
   • D.Separation of duties, because one person controls the whole payment chain.✓ Answer

   This is the classic separation-of-duties violation: the person who can create a payee is also the person who approves and releases payment to that payee, so a fictitious vendor can be set up and paid without anyone else touching the transaction. The defect is the combination of conflicting duties in one pair of hands, not merely the size of the account's permission set, which is what least privilege addresses.

   Source: NIST SP 800-53, control AC-5 Separation of Duties; ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts — logical access controlsReport a problem with this question

7. 7. A payment process is arranged so that one employee creates the vendor record and a different employee approves the payment. Which risk does this arrangement still leave open?

   • A.Shoulder surfing, if either employee approves payments in an open office.
   • B.Privilege creep, if either employee is later transferred to another team.
   • C.An orphaned account, if one of the two employees leaves without notice.
   • D.Collusion, if the two employees agree to abuse the process together.✓ Answer

   Separation of duties works by making a fraudulent transaction impossible for one person alone, so its residual risk is collusion: if the two people who hold the split duties cooperate, the control is defeated. That is why organizations pair it with detective measures such as job rotation, mandatory vacation and independent review, which disrupt an arrangement that depends on the same two people staying in place.

   Source: NIST SP 800-53, control AC-5 Separation of Duties (collusion as residual risk); ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts — logical access controlsReport a problem with this question

8. 8. A cash vault opens only when two custodians are present and turn their separate keys at the same moment. How is this control best described, and how does it differ from separation of duties?

   • A.Job rotation: the custodians trade assignments so no one keeps a single duty.
   • B.Separation of duties: opening the vault has been divided into two distinct tasks.
   • C.Dual control: two people act on the very same task, rather than on different tasks.✓ Answer
   • D.Least privilege: each custodian holds one key instead of a full master key.

   Dual control, also called two-person integrity, requires two authorized people to act simultaneously on one single action before it can take effect. Separation of duties is different in structure: it breaks a process into several distinct tasks and assigns them to different people, who each act at a different point in the sequence rather than together on the same step.

   Source: NIST SP 800-53, control enhancement AC-3(2) Dual Authorization; ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts — logical access controlsReport a problem with this question

9. 9. A bank requires every employee in a sensitive position to take at least one uninterrupted week of leave each year, during which another employee performs the duties. What is the security purpose of this rule?

   • A.It is a corrective control: errors found during the week are repaired by the stand-in.
   • B.It is a preventive control: the employee's rights are suspended for the whole week.
   • C.It is a detective control: irregularities the absent employee was hiding may surface.✓ Answer
   • D.It is a deterrent control: staff are reminded that leave records are audited yearly.

   Mandatory vacation is a detective personnel control. Many long-running frauds survive only because one person keeps continuous, exclusive control of a process and can adjust the records daily; forcing that person away while someone else does the work removes the concealment and lets the discrepancy appear. It detects wrongdoing that has already occurred rather than preventing the act itself.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts (Identity and Access Management Concepts) — logical access controls supporting separation of duties (mandatory vacation as a detective personnel control)Report a problem with this question

10. 10. Beyond broadening a team's skills, what security benefit does rotating employees through different assignments provide?

    • A.A replacement performing the duties may notice wrongdoing the previous holder hid.✓ Answer
    • B.A replacement inherits the previous holder's accounts, keeping permissions stable.
    • C.A replacement lowers the total number of permissions the department has to issue.
    • D.A replacement removes the need for the department to run periodic access reviews.

    Job rotation is a detective control for the same reason mandatory vacation is: a fresh person working the same duties sees the records and routines without the previous holder's ability to keep adjusting them, so concealed irregularities come to light. Inheriting the previous holder's accounts is in fact bad practice, because it defeats accountability and carries old permissions forward.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Identity and Access Management (IAM) Concepts (Identity and Access Management Concepts) — logical access controls supporting separation of duties (job rotation as a detective personnel control)Report a problem with this question

11. 11. Under discretionary access control, who decides which subjects are allowed to access a given object?

    • A.The object's owner, who may also pass that access on to other users at will.✓ Answer
    • B.The operating system, using labels that the object's owner cannot change.
    • C.The security administrator, using roles that match each job function.
    • D.The policy engine, using conditions evaluated when the request arrives.

    Discretionary access control is defined by the discretion of the owner: the owner of a file or resource decides who may use it and can propagate that permission to others, typically through an access control list on the object. The other three descriptions belong to mandatory, role-based and rule-based or attribute-based models, in which the decision is taken out of the owner's hands.

    Source: NIST IR 7316, Assessment of Access Control Systems — Discretionary Access ControlReport a problem with this question

12. 12. An employee creates a spreadsheet on a shared file server and, on his own initiative, grants two colleagues permission to open it without involving the IT department. Which access control model does this illustrate?

    • A.Attribute-based access control, since the request is judged on its context.
    • B.Mandatory access control, since the server applies a label to every new file.
    • C.Role-based access control, since the colleagues share the same job function.
    • D.Discretionary access control, since the file's creator picks who may read it.✓ Answer

    The tell for discretionary access control is that the creator or owner of the resource makes the grant personally, with no central authority evaluating it. Nothing in the scenario involves a classification label, a job role or a contextual condition, so the decision rests entirely on the owner's discretion, which is the defining property of the model.

    Source: NIST IR 7316, Assessment of Access Control Systems — Discretionary Access ControlReport a problem with this question

13. 13. Which statement best describes the principal security weakness of discretionary access control in a large organization?

    • A.Access decisions need a central label scheme, so new data cannot be shared quickly.
    • B.Access decisions are scattered among many owners, so rights sprawl and resist audit.✓ Answer
    • C.Access decisions rest on conditions such as time and place, which change constantly.
    • D.Access decisions follow job roles, so staff in unusual positions receive no rights.

    Because every owner decides independently, a discretionary system has no central oversight of who can reach what: permissions accumulate inconsistently, nobody holds a complete picture, and reviewing or revoking access becomes difficult. The same property also means malicious code running as the owner can re-grant that owner's access to others. The remaining options describe drawbacks of mandatory, rule-based and role-based models.

    Source: NIST IR 7316, Assessment of Access Control Systems — limitations of Discretionary Access ControlReport a problem with this question

14. 14. In a mandatory access control system, what determines whether a subject is permitted to read a particular object?

    • A.The subject's clearance level compared with the object's label, plus need-to-know.✓ Answer
    • B.The object owner's decision, recorded in the access control list of the file.
    • C.The subject's assigned role, compared with the roles the object is shared with.
    • D.The subject's device and location, compared with the rule set for the network.

    Mandatory access control assigns a classification label to every object and a clearance to every subject, and the system itself compares them: the clearance must dominate the classification, and the subject must additionally have a need-to-know for that compartment. Neither the owner nor the user can alter labels or grant exceptions, which is what makes the model the most rigid and the strongest for confidentiality.

    Source: NIST IR 7316, Assessment of Access Control Systems — Mandatory Access Control (labels and clearances)Report a problem with this question

15. 15. On a government system every document carries a classification and every user carries a clearance. The operating system enforces the comparison, and neither authors nor users may alter the markings. Which model is in use?

    • A.Mandatory access control, because the system, not the user, enforces the policy.✓ Answer
    • B.Discretionary access control, because the author marks the document at creation.
    • C.Role-based access control, because clearance levels act just like assigned roles.
    • D.Rule-based access control, because the comparison is written as a fixed rule.

    Two tells identify mandatory access control: classification labels matched against subject clearances, and enforcement by the system against a central policy that users cannot override. A clearance is not a role, because it expresses a trust level for handling classified material rather than a set of job-function permissions, and the inability of authors to change a marking is precisely what rules out the discretionary model.

    Source: NIST IR 7316, Assessment of Access Control Systems — Mandatory Access Control (system-enforced policy)Report a problem with this question

16. 16. An organization wants every new hire to receive a consistent, reviewable set of permissions on the first day, determined by the position the person was hired into. Which model best meets that requirement?

    • A.Role-based access control, which ties permissions to the job functions assigned.✓ Answer
    • B.Discretionary access control, which lets each manager grant what the hire needs.
    • C.Mandatory access control, which gives each new hire a clearance level on day one.
    • D.Attribute-based access control, which weighs the hire's context at each request.

    Role-based access control attaches permissions to roles that mirror job functions, and users acquire rights only by being assigned to a role. That makes provisioning repeatable, offboarding and transfers simple, and recertification practical, because a reviewer examines a manageable number of roles instead of thousands of individual grants. It also supports least privilege and separation of duties by allowing conflicting roles to be declared mutually exclusive.

    Source: INCITS 359, Role-Based Access Control standard — core RBAC (permissions assigned to roles, roles assigned to users)Report a problem with this question

17. 17. In a payroll application, everyone assigned the position 'Payroll Specialist' receives the same permissions, and permissions are never granted to individuals directly. In this design, what distinguishes a role from a group?

    • A.A role is created by the data owner; a group is created by system policy.
    • B.A role is a set of users in one department; a group is a set of shared folders.
    • C.A role applies only to administrators; a group applies to all standard users.
    • D.A role is a set of permissions tied to a job; a group is a set of users.✓ Answer

    A group is simply a named collection of user accounts, whereas a role is a named collection of permissions that corresponds to a job function; users are then assigned to the role. The distinction matters because it is what lets an organization review what a job is allowed to do independently of who currently holds it, and change the permissions of a whole job function in one place.

    Source: INCITS 359, Role-Based Access Control standard — role as a permission set corresponding to a job functionReport a problem with this question

18. 18. A company blocks sign-ins to its accounting system outside 07:00 to 20:00 on weekdays, and the restriction applies to every user including executives. Which model is this, and how does it differ from role-based access control?

    • A.Role-based: the decision rests on the job function each user has been assigned to.
    • B.Rule-based: the decision rests on conditions at request time, not on the user's job.✓ Answer
    • C.Rule-based: the decision rests on the seniority each user holds in the company.
    • D.Discretionary: the decision rests on limits chosen by the system's own owner.

    Rule-based access control applies predefined conditions uniformly to everyone: time of day, day of week, source address, network zone or device state, evaluated at the moment of the request. Role-based access control asks who the user is in the organization, which makes it relatively static. The clue here is that the restriction ignores identity entirely, applying even to executives, so it cannot be role-driven.

    Source: NIST IR 7316, Assessment of Access Control Systems — rule-based access control compared with role-based access controlReport a problem with this question

19. 19. A hospital policy allows a nurse to open a patient record only when the patient is on the nurse's assigned ward, the request falls inside the nurse's shift, and the device is hospital-managed. Which model does this describe?

    • A.Discretionary access control, which weighs the sharing choices of the owner.
    • B.Role-based access control, which weighs the single role the nurse was given.
    • C.Attribute-based access control, which weighs subject, resource and context.✓ Answer
    • D.Mandatory access control, which weighs the clearance the nurse was granted.

    Attribute-based access control evaluates a policy over several kinds of attribute at once: attributes of the subject (the nurse's ward and shift), of the resource (which patient the record belongs to), of the action, and of the environment (the device being managed). A role alone could not express this, because every nurse holds the same role yet each gets a different answer depending on the circumstances of the request.

    Source: NIST SP 800-162, Guide to Attribute Based Access Control (ABAC) Definition and ConsiderationsReport a problem with this question

20. 20. In access control terminology, a user account opens a database table. Which statement correctly identifies the subject and the object?

    • A.The database table is the subject; the user account is the object requesting access.
    • B.The user account is the subject that acts; the database table is the object acted upon.✓ Answer
    • C.The user account is the subject; the permission granted to it is the object involved.
    • D.The operating system is the subject; both the account and the table are its objects.

    A subject is the active entity that requests an action, and it need not be a person: a user account, a process or a service running on a user's behalf all qualify. An object is the passive resource being acted upon, such as a file, table, record or device. The permission itself is the access right that links the two; it is not the object.

    Source: NIST IR 7316, Assessment of Access Control Systems — subjects, objects and access rightsReport a problem with this question

21. 21. An access control list and a capability express the same permissions from opposite directions. Which statement describes that difference correctly?

    • A.An access control list is held by the subject; a capability is attached to the object.
    • B.An access control list is attached to the object; a capability is held by the subject.✓ Answer
    • C.An access control list names permitted actions; a capability names forbidden ones.
    • D.An access control list is checked at logon; a capability is checked at each request.

    Both describe the same access matrix, read along different axes. An access control list belongs to an object and lists the subjects permitted on it, which makes it easy to answer "who can reach this file?" A capability belongs to a subject and lists the objects it may reach, which makes it easy to answer "what can this user reach?" but harder to enumerate everyone with access to one resource.

    Source: NIST IR 7316, Assessment of Access Control Systems — access control lists and capability listsReport a problem with this question

22. 22. A small design studio wants each person who creates a file to share it directly with whichever collaborators they choose, with as little administrative involvement as possible. Which model fits, and what is the trade-off?

    • A.Rule-based control; conditions applied evenly, but sharing waits on a rule set.
    • B.Mandatory control; strong confidentiality, but every file must be labelled first.
    • C.Role-based control; consistent onboarding, but sharing is tied to job functions.
    • D.Discretionary control; flexible to run, but permissions resist later audit.✓ Answer

    When the stated requirement is maximum flexibility and minimum administration, the discretionary model is the fit, because owners grant access themselves without a central authority in the path. The cost is exactly the property that makes it convenient: decisions are decentralized, so permissions accumulate unevenly and become hard to review or revoke. Each model is chosen against the requirement word — flexibility, confidentiality or scalable consistency.

    Source: NIST IR 7316, Assessment of Access Control Systems — comparison of discretionary, mandatory, role-based and rule-based modelsReport a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →