Access Control Management GCCC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is an audit trail in the context of access control?

   • AA list of authorized users
   • BA physical logbook for visitors
   • CA record of user activities and access events
   • DA set of rules for granting access
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst notices repeated failed login attempts for a user account followed by a successful login at 3:00 AM. The analyst reviews the access logs and determines the successful login originated from an unfamiliar IP address. Which action should the analyst take first?

   • ABlock the unfamiliar IP address in the firewall
   • BDisable the user account immediately and reset the password
   • CContact the user to verify whether they logged in at that time
   • DIgnore the event because failed logins are common
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which access control model is characterized by the use of security labels and clearances that are enforced by the system, not by the resource owner?

   • ARole-based access control (RBAC)
   • BMandatory access control (MAC)
   • CDiscretionary access control (DAC)
   • DAttribute-based access control (ABAC)
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial services firm is implementing a new trading system. The compliance team requires that no single employee can both enter a trade and approve the same trade. Additionally, the system must prevent a trader from viewing trade data for clients outside their assigned portfolio. The IAM team is designing the access control configuration. Which combination of access control principles should be applied?

   • ALeast privilege for all users, and mandatory access control for trade approval
   • BSeparation of duties for trade entry and approval, and need-to-know for portfolio data access
   • CNeed-to-know for trade entry, and least privilege for trade approval
   • DRole-based access control for trade entry, and discretionary access control for portfolio data
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A small business wants to protect its server room. The room contains sensitive customer data and is accessible only to IT staff. The business has a limited budget and wants a cost-effective physical control. Which measure should be implemented?

   • AKeep the door locked with a traditional key and give copies to all employees
   • BInstall a keycard access system that logs each entry
   • CInstall a biometric fingerprint scanner on the server room door
   • DUse a keypad lock with a shared code for all IT staff
   Reveal Solution Discussion Select an answer first