An organization uses a file server where each department head can grant read or write access to folders they own. A new employee in the marketing department needs read access to a sales report folder. The sales manager grants the employee read permission. This is an example of which access control model?

Attribute-based access control (ABAC)

Discretionary access control (DAC)

Role-based access control (RBAC)

A small business uses a shared network drive for all employees. The owner wants to ensure that only the finance team can access the payroll folder, and that any access to that folder is recorded. What is the most effective way to implement this requirement?

Encrypt the payroll folder with a password shared among all employees.

Configure the folder's access control list (ACL) to grant the finance group read/write permissions and enable auditing on the folder.

Place the payroll folder in a hidden directory and tell only the finance team about it.

Use a third-party file-sharing service and share the link publicly.

A company is deploying a new web application that stores sensitive customer data. The security architect wants to ensure that only the application server can access the database, and that database administrators cannot directly query the data from their workstations. Which implementation approach best meets this requirement?

Enable database auditing and rely on post-incident detection.

Grant database administrators the same credentials as the application server.

Use a shared database account with a strong password and store it in the application code.

Place the database in a private subnet with a network access control list (NACL) that only allows traffic from the application server's security group.

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 1

Access Controls CCISO Practice Questions (Page 11)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

10 Concepts in This Objective

Access Control Fundamentals
Access Control Models
Identification, Authentication, Authorization, and Accountability
Authentication Methods
Authorization Mechanisms
Access Control Implementation
Access Control Administration
Access Control Monitoring and Auditing
Access Control Threats and Countermeasures
Access Control Best Practices and Standards

Questions 51–55

51application · medium
An organization uses a file server where each department head can grant read or write access to folders they own. A new employee in the marketing department needs read access to a sales report folder. The sales manager grants the employee read permission. This is an example of which access control model?
Select an answer first
52application · medium
A small business uses a shared network drive for all employees. The owner wants to ensure that only the finance team can access the payroll folder, and that any access to that folder is recorded. What is the most effective way to implement this requirement?
Select an answer first
53application · medium
A company is deploying a new web application that stores sensitive customer data. The security architect wants to ensure that only the application server can access the database, and that database administrators cannot directly query the data from their workstations. Which implementation approach best meets this requirement?
Select an answer first
54application · medium
A small business wants to protect its customer database from unauthorized access. The owner asks the CISO for a simple way to ensure that only employees with a valid username and password can view the data. Which access control component is being implemented?
Select an answer first
55application · medium
An organization is conducting a quarterly access review. The CISO wants to ensure that former employees no longer have active accounts and that current employees have only the permissions needed for their roles. Which process should be performed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Access Controls CCISO Practice Questions (Page 11)

Questions 51–55

A small business uses a shared network drive for all employees. The owner wants to ensure that only the finance team can access the payroll folder, and that any access to that folder is recorded. What is the most effective way to implement this requirement?

A small business wants to protect its customer database from unauthorized access. The owner asks the CISO for a simple way to ensure that only employees with a valid username and password can view the data. Which access control component is being implemented?

An organization is conducting a quarterly access review. The CISO wants to ensure that former employees no longer have active accounts and that current employees have only the permissions needed for their roles. Which process should be performed?

Keep studying — Information Security Core Competencies