A hospital wants to ensure that only nurses and doctors can access patient records, based on their job function. Which access control model is most appropriate?

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

Discretionary Access Control (DAC)

What is the primary benefit of multi-factor authentication (MFA) over single-factor authentication?

It eliminates the need for passwords

It is only used for remote access

It reduces the risk of unauthorized access by requiring multiple independent factors

A financial analyst needs access to customer account data to prepare reports, but should not be able to modify the data or view other employees' salaries. Which authorization principle should the access control system enforce?

Least privilege, granting only read access to customer account data and no access to salary data

Role-based access, granting the analyst the same permissions as all other analysts in the company

Need-to-know, granting access to all data in the customer database because the analyst works with customers

Mandatory access, granting access based on the analyst's security clearance level

A company has a network with a public-facing web server and an internal database. The security team wants to ensure that if the web server is compromised, the attacker cannot easily access the database. Which network security control should they implement?

Configure a firewall to allow all traffic from the web server to the database

Deploy an IDS to monitor traffic between the web server and the database

Use a VPN for all traffic between the web server and the database

Place the web server in a DMZ and the database in a separate internal network segment

In which access control model does the owner of a resource decide who can access it?

Attribute-Based Access Control (ABAC)

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

Certified Cybersecurity Operations Analyst

Domain 5Objective 2

Controls and Techniques CCOA Practice Questions (Page 7)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

11%of the exam

Questions 31–35

31foundation · easy
A hospital wants to ensure that only nurses and doctors can access patient records, based on their job function. Which access control model is most appropriate?
Select an answer first
32foundation · easy
What is the primary benefit of multi-factor authentication (MFA) over single-factor authentication?
Select an answer first
33application · medium
A financial analyst needs access to customer account data to prepare reports, but should not be able to modify the data or view other employees' salaries. Which authorization principle should the access control system enforce?
Select an answer first
34expert · hard
A company has a network with a public-facing web server and an internal database. The security team wants to ensure that if the web server is compromised, the attacker cannot easily access the database. Which network security control should they implement?
Select an answer first
35foundation · easy
In which access control model does the owner of a resource decide who can access it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.