A company is merging with another firm. During the merger, they need to provision accounts for new employees and deprovision accounts for employees who are leaving. The security team wants to ensure that no account remains active after an employee's last day. Which combination of controls would be MOST effective?

Deprovisioning only when the employee requests it

Manual provisioning and quarterly access reviews

Automated provisioning/deprovisioning integrated with HR systems and regular access reviews

Automated provisioning only, with no deprovisioning process

A company is evaluating authentication methods for a new remote access solution. The security team requires phishing-resistant authentication, but the company has a large number of employees who use personal mobile devices and cannot be issued hardware tokens. The solution must also provide a way to audit authentication events. Which authentication method should be selected?

WebAuthn with platform authenticators (e.g., biometrics on personal devices)

Push notifications to a mobile app

A company wants to implement access control for its new cloud storage service. The security team wants to ensure that users can only access files they own or files explicitly shared with them. Which access control implementation should be used?

Implement discretionary access control (DAC) where the file owner sets sharing permissions

Implement attribute-based access control (ABAC) with policies based on file metadata

Implement mandatory access control (MAC) with classification labels

Implement role-based access control (RBAC) with roles for each department

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 5)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 21–25

21expert · hard
A company is merging with another firm. During the merger, they need to provision accounts for new employees and deprovision accounts for employees who are leaving. The security team wants to ensure that no account remains active after an employee's last day. Which combination of controls would be MOST effective?
Select an answer first
22expert · hard
A company is evaluating authentication methods for a new remote access solution. The security team requires phishing-resistant authentication, but the company has a large number of employees who use personal mobile devices and cannot be issued hardware tokens. The solution must also provide a way to audit authentication events. Which authentication method should be selected?
Select an answer first
23foundation · easy
Which type of access control measure includes security policies, procedures, and employee training?
Select an answer first
24application · medium
A company wants to implement access control for its new cloud storage service. The security team wants to ensure that users can only access files they own or files explicitly shared with them. Which access control implementation should be used?
Select an answer first
25foundation · easy
Which access control principle is designed to prevent fraud and errors by requiring more than one person to complete a critical task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Access Control Management GCCC Practice Questions (Page 5)

Questions 21–25

Which type of access control measure includes security policies, procedures, and employee training?

A company wants to implement access control for its new cloud storage service. The security team wants to ensure that users can only access files they own or files explicitly shared with them. Which access control implementation should be used?

Which access control principle is designed to prevent fraud and errors by requiring more than one person to complete a critical task?

Keep studying — Access and Identity Management