Why do privileged accounts require stricter controls than standard user accounts?

Because they are less likely to be targeted by attackers

Because they are used more frequently than standard accounts

Because they have elevated permissions that can cause significant damage if compromised

Because they are easier to remember than standard accounts

Which practice is specifically important for managing privileged accounts?

Disabling logging for privileged account activity to protect privacy

Granting privileged access to all employees to simplify administration

Enforcing separation of duties to prevent a single person from having excessive control

Allowing the same password to be used for all privileged accounts

A company is implementing MFA for all users. However, a group of executives is resistant because they find MFA inconvenient. The security team must balance security with user satisfaction. What is the best approach?

Enforce MFA for all users but allow the use of a fast and convenient method such as push notifications or hardware security keys.

Exempt executives from MFA because of their seniority.

Delay MFA implementation until a more convenient technology is available.

Implement MFA only for users who access sensitive systems, and not for others.

How are access rights typically assigned to users in an organization?

Based on their role and need-to-know

Based on their length of employment

Based on their relationship with the IT administrator

Based on their personal preferences

A shared account is used by a team of five support technicians to access a ticketing system. The password is known to all team members. What is the best way to improve accountability and security?

Disable the shared account and have technicians use their personal email to access the ticketing system.

Keep the shared account but change the password monthly and share it only via a secure chat.

Keep the shared account and require all technicians to use a password manager to store the password.

Replace the shared account with individual accounts and assign the same role to each technician.

GIAC Critical Controls Certification

Domain 3Objective 2

Account Management GCCC Practice Questions (Page 5)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 21–25

21foundation · easy
Why do privileged accounts require stricter controls than standard user accounts?
Select an answer first
22foundation · easy
Which practice is specifically important for managing privileged accounts?
Select an answer first
23expert · hard
A company is implementing MFA for all users. However, a group of executives is resistant because they find MFA inconvenient. The security team must balance security with user satisfaction. What is the best approach?
Select an answer first
24foundation · easy
How are access rights typically assigned to users in an organization?
Select an answer first
25application · medium
A shared account is used by a team of five support technicians to access a ticketing system. The password is known to all team members. What is the best way to improve accountability and security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.