1. Home
2. All questions
3. Access management

CompTIA Security+ study material: Access management

64 questions of the 611 in the CompTIA Security+ quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 274. A login arrives from an unexpected country, so the system prompts for an extra check. Does the geolocation signal count as an authentication factor?
2. 291. Which two security benefits does federation give a relying party? Choose two.
3. 298. Which protocol is preferred for administering network devices because it separates authentication, authorisation and accounting and encrypts the whole payload?
4. 299. Which server usually sits behind 802.1X port-based network access control?
5. 300. An employee leaves and their accounts remain active for six weeks. Which process failed?
6. 302. Which activity is designed to discover privilege creep?
7. 320. What distinguishes attribute-based access control from a permission list?
8. 321. NIST describes access control lists and role-based access control as narrow cases of the attribute model. Which attribute does each key off?
9. 322. A new contractor needs access to project records the moment they join, without an administrator granting it. Which model supports this directly?
10. 323. Which two inputs, besides the rules and the subject's attributes, does an ABAC mechanism weigh on each request? Choose two.
11. 324. An access requirement changes and the team struggles to find every place it was implemented. Which models does NIST warn about for this reason?
12. 325. Two ABAC policies produce contradictory verdicts for the same request. What must the design have addressed?
13. 326. An employee moves from finance to procurement. Under role-based access control, how is their access changed?
14. 327. On a file share, the creator of a document can grant anyone else access to it. Which access control model is in use, and what is its weakness?
15. 328. In a classified environment, no user may reclassify a document to a lower level, and access is decided by comparing clearance with label. Which model is this?
16. 329. An administrator configures that no account may access the finance system outside 07:00 to 19:00, regardless of role. Which model does this illustrate?
17. 330. What does applying least privilege achieve when an account is compromised?
18. 331. A payments process is split so that one person raises a payment and another approves it. Which control is this, and what does it force an attacker to do?
19. 332. Why are job rotation and mandatory vacation classed as detective rather than preventive controls?
20. 333. What does a privileged access management platform change about how administrators work?
21. 334. An engineer holds an administrator role only for the duration of an approved task, after which it is removed automatically. What is this called?
22. 335. Which two controls should surround an emergency break-glass account? Choose two.
23. 336. Which control closes the gap left when an offboarding notification never reaches the IT team?
24. 337. What is the principal security problem with a shared administrator account used by four engineers?
25. 338. Which control protects an unattended workstation without ending the user's work?
26. 339. What does limiting the number of concurrent sessions per account achieve?
27. 340. Which two requirements does NIST place on remote access? Choose two.
28. 341. Which control governs where data may travel between systems and domains, as distinct from whether a subject may read an object?
29. 342. What does zero trust replace as the basis for granting access?
30. 343. In a zero trust architecture, which component sits in the data path and applies the verdict?
31. 344. A user is granted access to the finance application under zero trust. What does this imply about the reporting database next door?
32. 345. Why is "we have implemented zero trust" a poor summary of an organisation's position under the CISA maturity model?
33. 346. An attacker compromises a workstation in the marketing VLAN. Which control most directly limits how far they can reach?
34. 347. Two application servers sit on the same subnet but cannot communicate unless policy permits it. Which technique is in use?
35. 348. An application hides the delete button from non-administrators but the delete endpoint performs no check. What is wrong?
36. 349. Changing the invoice number in a URL shows another customer's invoice. What is this flaw called?
37. 350. A standard user reads another standard user's records. How is this escalation classified?
38. 351. An authorisation layer is deployed with a deny-by-default posture. What happens when a new endpoint is added and no rule is written for it?
39. 352. In an 802.1X deployment, which role does the switch or wireless access point play?
40. 353. A laptop fails a posture check because its endpoint agent is disabled. What should network access control do?
41. 354. Which physical control defeats tailgating through a badge-controlled door?
42. 355. A user's device falls out of compliance halfway through an authenticated session. Under zero trust, what should happen?
43. 356. A relying party requests the full user profile when it only needs a department name. What principle does this violate?
44. 357. Why does the order of entries in a firewall access list matter?
45. 358. Which control corrects privilege creep, and why does the joiner process not?
46. 359. An organisation grants access through security groups rather than per-user entitlements. What problem does this introduce over time?
47. 360. An ABAC deployment produces wrong decisions even though its rules are correct. What should be examined first?
48. 361. Which external inputs may a zero trust policy engine consult when scoring a request?
49. 362. What is the purpose of a jump server for administrative access?
50. 363. With credential vaulting and automatic rotation, why can an administrator not reuse the password they just used?
51. 364. Which capability does a secrets platform give that a shared static password cannot?
52. 365. An organisation enables split tunnelling on its VPN to reduce bandwidth. What is the security trade-off?
53. 366. Why should authorisation be checked on every request rather than cached for the session?
54. 367. Which requirement can attribute-based rules express that roles cannot?
55. 368. What should be set when a contractor account is created?
56. 369. Which description of zero trust's effect on the perimeter is most accurate?
57. 370. Why does MITRE list privileged account management as a mitigation in its own right?
58. 371. NIST's Access Control family treats access enforcement, account management, least privilege and separation of duties as separate controls. Why does that matter?
59. 441. Which control does CISA recommend for remote desktop services that must remain available?
60. 490. An attacker abuses a legitimate elevation mechanism rather than exploiting a software flaw. How does MITRE classify this?
61. 602. What must a defined account management lifecycle specify?
62. 603. Which two ATT&CK mitigations limit what an adversary can run or elevate to? Choose two.
63. 604. Why are badge readers and visitor logs treated as part of access management rather than facilities work?
64. 605. Why should a secret be scoped to the smallest set of workloads that need it?