In which access control model does the owner of a resource decide who can access it and what privileges they receive?

Attribute-based access control (ABAC)

Discretionary access control (DAC)

Role-based access control (RBAC)

An organization is implementing multi-factor authentication (MFA) for remote access. The security team wants to use a method that is resistant to phishing and does not require additional hardware. Which authentication method best meets these requirements?

Hardware security keys (e.g., FIDO2)

WebAuthn with platform authenticator (e.g., built-in biometric on laptop)

Push notifications to a mobile app

A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company uses an identity provider (IdP) that supports SAML 2.0. Which approach should be implemented?

Create separate accounts in the SaaS application for each employee and synchronize passwords

Set up federation between the corporate IdP and the SaaS application using SAML 2.0

Configure the SaaS application to authenticate directly against the corporate LDAP directory

Use OAuth 2.0 with the corporate IdP as the authorization server

An organization uses an attribute-based access control (ABAC) system. A user requests access to a document. The policy engine evaluates the user's department, the document's classification label, and the current time. What is the primary purpose of this evaluation?

To assign the user a role in the system

To create an audit log of all access attempts

To authenticate the user's identity

To determine whether the user's attributes satisfy the policy conditions for the requested action

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 8)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
In which access control model does the owner of a resource decide who can access it and what privileges they receive?
Select an answer first
37application · medium
An organization is implementing multi-factor authentication (MFA) for remote access. The security team wants to use a method that is resistant to phishing and does not require additional hardware. Which authentication method best meets these requirements?
Select an answer first
38application · medium
A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company uses an identity provider (IdP) that supports SAML 2.0. Which approach should be implemented?
Select an answer first
39application · medium
An organization uses an attribute-based access control (ABAC) system. A user requests access to a document. The policy engine evaluates the user's department, the document's classification label, and the current time. What is the primary purpose of this evaluation?
Select an answer first
40foundation · easy
Which account lifecycle activity involves periodically reviewing user access rights to ensure they are still appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.