A company is deploying a new VPN for remote employees. They want to require users to provide something they know and something they have. Which authentication method should they implement?

Password plus a one-time code from a hardware token

Biometric fingerprint scan only

An organization wants to implement multi-factor authentication for its remote access solution. They already use smart cards for physical building access. Which additional factor would BEST satisfy the 'something you have' category for remote access?

A one-time password generated by a mobile app

An organization uses an attribute-based access control (ABAC) system to govern access to a document management platform. A user requests access to a confidential project document. The policy engine evaluates the user's department, security clearance, and the document's classification label. Which statement best describes how authorization is determined in this scenario?

The system compares the user's security clearance to the document's classification label using mandatory access control rules

The policy engine grants access if the user's attributes match the conditions defined in the access policy for that document

The user's role determines access, and the document's classification is ignored

The document owner manually approves or denies each access request

An employee is leaving the company. The security team wants to ensure that all access to corporate systems is removed promptly and that a record of the removal is preserved. Which process should be followed?

Disable the account but leave it in the directory for 30 days

Change the password and keep the account active

Delete the account without logging the action

Deprovision the account and archive the access logs

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 9)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 41–45

41foundation · easy
Which authorization mechanism uses a set of rules that evaluate attributes such as user role, resource type, and environmental conditions to grant or deny access?
Select an answer first
42application · medium
A company is deploying a new VPN for remote employees. They want to require users to provide something they know and something they have. Which authentication method should they implement?
Select an answer first
43application · medium
An organization wants to implement multi-factor authentication for its remote access solution. They already use smart cards for physical building access. Which additional factor would BEST satisfy the 'something you have' category for remote access?
Select an answer first
44application · medium
An organization uses an attribute-based access control (ABAC) system to govern access to a document management platform. A user requests access to a confidential project document. The policy engine evaluates the user's department, security clearance, and the document's classification label. Which statement best describes how authorization is determined in this scenario?
Select an answer first
45application · medium
An employee is leaving the company. The security team wants to ensure that all access to corporate systems is removed promptly and that a record of the removal is preserved. Which process should be followed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Access Control Management GCCC Practice Questions (Page 9)

Questions 41–45

Which authorization mechanism uses a set of rules that evaluate attributes such as user role, resource type, and environmental conditions to grant or deny access?

A company is deploying a new VPN for remote employees. They want to require users to provide something they know and something they have. Which authentication method should they implement?

An organization wants to implement multi-factor authentication for its remote access solution. They already use smart cards for physical building access. Which additional factor would BEST satisfy the 'something you have' category for remote access?

An employee is leaving the company. The security team wants to ensure that all access to corporate systems is removed promptly and that a record of the removal is preserved. Which process should be followed?

Keep studying — Access and Identity Management