An organization uses a system where access decisions are made by comparing the user's security clearance with the classification label of the resource. The user cannot change these labels. Which access control model is in use?

Attribute-based access control (ABAC)

Discretionary access control (DAC)

Role-based access control (RBAC)

A company has experienced a credential-stuffing attack where attackers used username/password pairs from a previous data breach. The CISO wants to implement a control that would most effectively prevent this type of attack. Which control should be prioritized?

Increase password length requirements

Implement multi-factor authentication (MFA)

A security analyst notices that a user account has been attempting to access a sensitive file share repeatedly at odd hours. The attempts are failing, but the analyst wants to determine whether this is a brute-force attack or a legitimate user who forgot their password. Which monitoring and auditing practice would provide the most useful information?

Increase the password complexity requirement for that user.

Check the file share's access control list (ACL) to see if the user has permission.

Review the authentication logs for the account to see the source IP addresses and the timestamps of the attempts.

Disable the account immediately to prevent further attempts.

An organization is experiencing brute-force attacks on its VPN. The CISO wants to implement a control that slows down attackers without locking out legitimate users. Which control is most effective?

Rate limiting and progressive delays

Disabling the VPN during off-hours

Account lockout after a set number of failed attempts

Which access control model is most appropriate for an organization that needs to enforce a security policy where access decisions are based on the user's job function, such as 'manager' or 'analyst'?

Discretionary Access Control (DAC)

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 1

Access Controls CCISO Practice Questions (Page 3)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

10 Concepts in This Objective

Access Control Fundamentals
Access Control Models
Identification, Authentication, Authorization, and Accountability
Authentication Methods
Authorization Mechanisms
Access Control Implementation
Access Control Administration
Access Control Monitoring and Auditing
Access Control Threats and Countermeasures
Access Control Best Practices and Standards

Questions 11–15

11expert · hard
An organization uses a system where access decisions are made by comparing the user's security clearance with the classification label of the resource. The user cannot change these labels. Which access control model is in use?
Select an answer first
12application · medium
A company has experienced a credential-stuffing attack where attackers used username/password pairs from a previous data breach. The CISO wants to implement a control that would most effectively prevent this type of attack. Which control should be prioritized?
Select an answer first
13application · medium
A security analyst notices that a user account has been attempting to access a sensitive file share repeatedly at odd hours. The attempts are failing, but the analyst wants to determine whether this is a brute-force attack or a legitimate user who forgot their password. Which monitoring and auditing practice would provide the most useful information?
Select an answer first
14expert · hard
An organization is experiencing brute-force attacks on its VPN. The CISO wants to implement a control that slows down attackers without locking out legitimate users. Which control is most effective?
Select an answer first
15foundation · easy
Which access control model is most appropriate for an organization that needs to enforce a security policy where access decisions are based on the user's job function, such as 'manager' or 'analyst'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.