What is the primary purpose of authorization in an access control system?

To determine what actions a user is allowed to perform on a resource

To verify the identity of a user

A security analyst is reviewing access logs and discovers that a terminated employee's account was used to access a sensitive database two weeks after the termination date. The account was supposed to be disabled during offboarding, but the analyst finds that the account is still active. The analyst also notices that the account's last password change was six months ago. Which combination of issues does this incident highlight?

Failure in account deprovisioning and lack of periodic access reviews

Insufficient logging and lack of intrusion detection system

Lack of role-based access control and improper user provisioning

Weak password policy and lack of multi-factor authentication

A data center operator wants to protect against tailgating at a secure entrance. They have a badge reader and a security guard. Which additional control would BEST reduce the risk of tailgating?

Post a sign reminding employees not to tailgate

Increase the frequency of security patrols

Install a mantrap with interlocking doors

Add a second badge reader inside the facility

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 6)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
What is the process of creating a user account and assigning initial permissions called?
Select an answer first
27foundation · easy
What is the primary purpose of authorization in an access control system?
Select an answer first
28expert · hard
A security analyst is reviewing access logs and discovers that a terminated employee's account was used to access a sensitive database two weeks after the termination date. The account was supposed to be disabled during offboarding, but the analyst finds that the account is still active. The analyst also notices that the account's last password change was six months ago. Which combination of issues does this incident highlight?
Select an answer first
29foundation · easy
Which authentication method relies on a physical device that generates a one-time code, typically synchronized with a server?
Select an answer first
30expert · hard
A data center operator wants to protect against tailgating at a secure entrance. They have a badge reader and a security guard. Which additional control would BEST reduce the risk of tailgating?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Access Control Management GCCC Practice Questions (Page 6)

Questions 26–30

What is the process of creating a user account and assigning initial permissions called?

What is the primary purpose of authorization in an access control system?

Which authentication method relies on a physical device that generates a one-time code, typically synchronized with a server?

A data center operator wants to protect against tailgating at a secure entrance. They have a badge reader and a security guard. Which additional control would BEST reduce the risk of tailgating?

Keep studying — Access and Identity Management