Study ISC2 CC logical access controls: least privilege, separation of duties, DAC, MAC, RBAC, MFA, and identity lifecycle.
Logical access controls decide what identities can do in systems and data stores. CC questions reward clean separation between authentication, authorization, accountability, and lifecycle management.
| Principle | Exam meaning |
|---|---|
| Least privilege | grant only required access |
| Need to know | access depends on job need, not curiosity or status |
| Separation of duties | split sensitive work to reduce fraud or error |
| Account review | verify access remains appropriate |
| Deprovisioning | remove access when role or employment changes |
| Model | Basic idea |
|---|---|
| DAC | owner has discretion over access |
| MAC | system/enforced classification controls access |
| RBAC | permissions follow role membership |
MFA combines different factor categories:
Two passwords are not MFA because they are the same factor category.
ISC2 includes foundational AI access concerns in the current CC outline. Treat AI bots and automated service accounts like any other identity: provision deliberately, grant least privilege, monitor use, and remove access when no longer needed.