A CISO is designing an access control policy for a financial system. The policy must ensure that no single user can both initiate a wire transfer and approve it. Additionally, users should only have access to the specific functions required for their job. Which combination of principles is being applied?

Least privilege and accountability

Defense in depth and mandatory vacation

Separation of duties and least privilege

What is the primary difference between authentication and authorization?

Authentication is based on user roles, while authorization is based on user credentials

Authentication is performed once per session, while authorization is performed every time a user logs in

Authentication grants permissions, while authorization verifies identity

Authentication verifies identity, while authorization determines what actions the authenticated user is allowed to perform

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 1

Access Controls CCISO Practice Questions (Page 6)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

10 Concepts in This Objective

Access Control Fundamentals
Access Control Models
Identification, Authentication, Authorization, and Accountability
Authentication Methods
Authorization Mechanisms
Access Control Implementation
Access Control Administration
Access Control Monitoring and Auditing
Access Control Threats and Countermeasures
Access Control Best Practices and Standards

Questions 26–30

26foundation · easy
Which of the following is an example of a 'something you have' authentication factor?
Select an answer first
27foundation · easy
Which of the following is a common access control attack that involves an attacker reusing captured credentials?
Select an answer first
28expert · hard
A CISO is designing an access control policy for a financial system. The policy must ensure that no single user can both initiate a wire transfer and approve it. Additionally, users should only have access to the specific functions required for their job. Which combination of principles is being applied?
Select an answer first
29foundation · easy
What is the primary difference between authentication and authorization?
Select an answer first
30expert · hard
A security team is investigating a breach where an attacker used a stolen certificate to authenticate as a legitimate user. The certificate was issued to a user but was stored insecurely. Which IAAA component was most directly compromised?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Access Controls CCISO Practice Questions (Page 6)

Questions 26–30

Which of the following is an example of a 'something you have' authentication factor?

Which of the following is a common access control attack that involves an attacker reusing captured credentials?

What is the primary difference between authentication and authorization?

A security team is investigating a breach where an attacker used a stolen certificate to authenticate as a legitimate user. The certificate was issued to a user but was stored insecurely. Which IAAA component was most directly compromised?

Keep studying — Information Security Core Competencies