A multinational company is implementing federated SSO. They need to support employees from multiple subsidiaries, each with its own identity provider. They also need to enforce different access policies based on the employee's home country. Which approach BEST meets these requirements?

Create a single global identity provider and delete all subsidiary IdPs

Use a central identity provider that federates with each subsidiary's IdP and passes country as an attribute

Have each subsidiary independently authenticate users and pass no attributes

Use a shared password database across all subsidiaries

An employee is transferred from the sales department to the marketing department. The IAM team needs to update the user's access rights. Which action best follows the principle of least privilege during this transfer?

Add the marketing role permissions while keeping the sales role permissions

Disable the user's account and create a new account for the marketing role

Remove all existing access rights and then grant only the permissions required for the new marketing role

Grant the marketing role permissions and schedule a review in six months

A healthcare organization needs to ensure that only cardiologists can view cardiac imaging reports, and only when they are assigned to the patient's care team. The access decision must consider the user's job role, the patient's care-team membership, and the current time (to enforce shift-based access). Which access control model best meets these requirements?

Role-based access control (RBAC)

Discretionary access control (DAC)

Attribute-based access control (ABAC)

A small business wants to protect its server room. They have installed a badge reader on the door and a camera in the hallway. Which additional control would BEST enforce least privilege for physical access?

Add a second camera inside the server room

Require all employees to sign in at the front desk

Configure the badge system so each employee can only enter the server room during their assigned shift

Post a sign listing authorized personnel

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 2)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 6–10

6expert · hard
A multinational company is implementing federated SSO. They need to support employees from multiple subsidiaries, each with its own identity provider. They also need to enforce different access policies based on the employee's home country. Which approach BEST meets these requirements?
Select an answer first
7application · medium
An employee is transferred from the sales department to the marketing department. The IAM team needs to update the user's access rights. Which action best follows the principle of least privilege during this transfer?
Select an answer first
8application · medium
A healthcare organization needs to ensure that only cardiologists can view cardiac imaging reports, and only when they are assigned to the patient's care team. The access decision must consider the user's job role, the patient's care-team membership, and the current time (to enforce shift-based access). Which access control model best meets these requirements?
Select an answer first
9application · medium
A small business wants to protect its server room. They have installed a badge reader on the door and a camera in the hallway. Which additional control would BEST enforce least privilege for physical access?
Select an answer first
10foundation · easy
Which type of access control measure includes security guards, locks, and biometric door entry systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Access Control Management GCCC Practice Questions (Page 2)

Questions 6–10

A multinational company is implementing federated SSO. They need to support employees from multiple subsidiaries, each with its own identity provider. They also need to enforce different access policies based on the employee's home country. Which approach BEST meets these requirements?

An employee is transferred from the sales department to the marketing department. The IAM team needs to update the user's access rights. Which action best follows the principle of least privilege during this transfer?

A small business wants to protect its server room. They have installed a badge reader on the door and a camera in the hallway. Which additional control would BEST enforce least privilege for physical access?

Which type of access control measure includes security guards, locks, and biometric door entry systems?

Keep studying — Access and Identity Management