A security analyst is investigating a potential insider threat. The analyst needs to determine whether a user accessed a sensitive file and then transferred it to an external device. Which type of audit log would provide the most direct evidence?

File access and data loss prevention (DLP) logs

What is the primary purpose of separation of duties (SoD) in access control?

To ensure that all users have the same level of access to simplify administration

To ensure that only one person can access a system at a time

To allow users to share passwords to reduce the number of accounts

To prevent fraud and errors by requiring more than one person to complete a critical task

A remote workforce uses a legacy VPN that only requires a username and password. After a phishing campaign, several accounts were compromised. The CISO wants to reduce the risk of credential theft without requiring hardware tokens for every employee. Which solution best addresses the stated risk?

Implement multi-factor authentication (MFA) using a mobile authenticator app as the second factor.

Require users to change their passwords every 30 days.

Deploy a biometric fingerprint scanner on each employee's laptop.

Use a single sign-on (SSO) solution that caches credentials on the client.

In a web application, which of the following is a common access control implementation to restrict what a logged-in user can do?

Encrypting all data in the database

Implementing a CAPTCHA on the login page

Using a load balancer to distribute traffic

Session-based authorization checks that verify the user's role before allowing an action

A mid-sized company has grown rapidly and the IT team manually creates user accounts. A recent audit found that many former employees still have active accounts, and some users have permissions that exceed their job requirements. The CISO wants to implement a process to address these issues with minimal administrative overhead. Which combination of practices is most effective?

Use a single shared account for all employees to simplify management.

Require all users to change their passwords every 60 days.

Implement an automated identity lifecycle management system that provisions accounts based on HR records and triggers immediate deprovisioning on termination.

Conduct quarterly access reviews and manually disable accounts that are no longer needed.

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 1

Access Controls CCISO Practice Questions (Page 10)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

10 Concepts in This Objective

Access Control Fundamentals
Access Control Models
Identification, Authentication, Authorization, and Accountability
Authentication Methods
Authorization Mechanisms
Access Control Implementation
Access Control Administration
Access Control Monitoring and Auditing
Access Control Threats and Countermeasures
Access Control Best Practices and Standards

Questions 46–50

46expert · hard
A security analyst is investigating a potential insider threat. The analyst needs to determine whether a user accessed a sensitive file and then transferred it to an external device. Which type of audit log would provide the most direct evidence?
Select an answer first
47foundation · easy
What is the primary purpose of separation of duties (SoD) in access control?
Select an answer first
48application · medium
A remote workforce uses a legacy VPN that only requires a username and password. After a phishing campaign, several accounts were compromised. The CISO wants to reduce the risk of credential theft without requiring hardware tokens for every employee. Which solution best addresses the stated risk?
Select an answer first
49foundation · easy
In a web application, which of the following is a common access control implementation to restrict what a logged-in user can do?
Select an answer first
50application · medium
A mid-sized company has grown rapidly and the IT team manually creates user accounts. A recent audit found that many former employees still have active accounts, and some users have permissions that exceed their job requirements. The CISO wants to implement a process to address these issues with minimal administrative overhead. Which combination of practices is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.