An employee is transferred from the sales department to the marketing department. The IT admin needs to update the employee's access rights. What is the best practice?

Remove the employee's sales department access and grant only the marketing department permissions required for the new role

Grant the employee the same permissions as the marketing manager to ensure full access

Disable the employee's account and create a new one with marketing permissions

Keep the sales access and add marketing access to avoid disrupting the employee's work

Which access control model is most appropriate for an organization that must enforce a security policy where access decisions are based on the sensitivity labels of data and the clearance levels of users, regardless of the data owner's preferences?

Discretionary Access Control (DAC)

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

Which of the following is an example of the 'something you have' authentication factor?

A one-time passcode generated by a hardware token

In which access control model does the owner of a resource have the discretion to grant or revoke access to that resource for other users?

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

Attribute-Based Access Control (ABAC)

A company wants to implement MFA for remote workers. They are considering SMS codes, a mobile authenticator app, and hardware security keys. Which factor should they choose to balance security and usability?

Security questions because they are familiar

SMS codes because they are easy to use

Mobile authenticator app because it is more secure than SMS and easy to use

Hardware security keys because they are the most secure

GIAC Security Essentials

Domain 1Objective 1

Access Control & Password Management GSEC Practice Questions (Page 1)

Part of the Foundations of Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 1–5

1application · medium
An employee is transferred from the sales department to the marketing department. The IT admin needs to update the employee's access rights. What is the best practice?
Select an answer first
2foundation · easy
Which access control model is most appropriate for an organization that must enforce a security policy where access decisions are based on the sensitivity labels of data and the clearance levels of users, regardless of the data owner's preferences?
Select an answer first
3foundation · easy
Which of the following is an example of the 'something you have' authentication factor?
Select an answer first
4foundation · easy
In which access control model does the owner of a resource have the discretion to grant or revoke access to that resource for other users?
Select an answer first
5expert · medium
A company wants to implement MFA for remote workers. They are considering SMS codes, a mobile authenticator app, and hardware security keys. Which factor should they choose to balance security and usability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.