A company is evaluating authentication methods for a high-security remote access portal. They want to implement multi-factor authentication. Which of the following are valid MFA factors? (Select all that apply.)

A hardware token that generates a one-time code

A company performs quarterly access reviews. During a review, the manager notices that a contractor who left two months ago still has an active VPN account. What is the BEST immediate action?

Change the VPN password and keep the account active

Disable the VPN account immediately and document the action

Send an email to the contractor asking them to stop using the VPN

Wait until the next quarterly review to disable it

What is the primary purpose of monitoring access logs?

To prevent all unauthorized access

To detect and investigate unauthorized access attempts

What is the primary benefit of Single Sign-On (SSO) in an identity and access management (IAM) system?

It eliminates the need for passwords

It allows users to access multiple applications with one set of credentials

It automatically grants all users the same access rights

It provides stronger encryption for data at rest

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 1)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 1–5

1expert · hard · select all that apply
A company is evaluating authentication methods for a high-security remote access portal. They want to implement multi-factor authentication. Which of the following are valid MFA factors? (Select all that apply.)
Select an answer first
2application · medium
A company performs quarterly access reviews. During a review, the manager notices that a contractor who left two months ago still has an active VPN account. What is the BEST immediate action?
Select an answer first
3foundation · easy
What is the primary purpose of monitoring access logs?
Select an answer first
4foundation · easy
Which access control principle ensures that a user is granted only the permissions necessary to perform their job functions and nothing more?
Select an answer first
5foundation · easy
What is the primary benefit of Single Sign-On (SSO) in an identity and access management (IAM) system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.