Access Controls CCISO Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is deploying a new application that requires fine-grained access decisions based on user attributes, resource type, and current threat level. The CISO wants a centralized policy engine that can enforce these decisions across multiple applications. Which implementation approach is best?

   • AMandatory access control using system labels
   • BRole-based access control embedded in each application
   • CAttribute-based access control with a centralized policy decision point (PDP)
   • DAccess control lists on each resource
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is investigating a data breach. The logs show that a valid user account was used to access sensitive data from an IP address in a foreign country. The user denies any involvement and claims their password was stolen. The analyst also finds that the account did not have multi-factor authentication (MFA) enabled. Which conclusion is most defensible?

   • AThe lack of MFA is irrelevant to the investigation.
   • BThe user is definitely responsible because the account was used with valid credentials.
   • CThe account was likely compromised, but the lack of MFA means the organization cannot prove that the user was not involved.
   • DThe IP address in a foreign country proves that the user was not involved.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's security team notices that a terminated employee's account is still active and has been used to access the corporate VPN after the termination date. The investigation reveals that the account was not disabled promptly. Which component of the IAAA framework was most directly violated?

   • AAuthorization, because the terminated employee should not have had permission to access the VPN.
   • BAccountability, because the actions cannot be reliably attributed to the terminated employee if the account was shared or compromised.
   • CIdentification, because the system did not recognize the user as terminated.
   • DAuthentication, because the user's credentials were not verified properly.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is reviewing logs and notices that a user account has successfully logged in from two different geographic locations within 10 minutes. The user is a remote employee who normally works from home. Which action should the analyst take first?

   • AImmediately disable the account to prevent further access.
   • BChange the user's password without notifying them.
   • CVerify with the user whether they used a VPN or a mobile device that could explain the different locations.
   • DIgnore the alert because the user is a remote employee.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A regional hospital is implementing a new electronic health record (EHR) system. The compliance officer insists that only the attending physician and the assigned nurses may view a patient's record, and that any access must be logged with the user's identity and timestamp. The CIO wants to ensure that the access control system enforces this requirement consistently across all departments. Which access control approach best satisfies the stated requirement?

   • AImplement role-based access control (RBAC) with roles mapped to job functions, and enable auditing on all record access.
   • BApply mandatory access control (MAC) with security labels on all records and user clearances.
   • CDeploy attribute-based access control (ABAC) using only the patient's age as the access attribute.
   • DUse discretionary access control (DAC) where each physician sets permissions on their own patient records.
   Reveal Solution Discussion Select an answer first