SSCP Practice Exam 54 — 20 Questions

Question 1

Which access control model allows the owner of a resource to grant access permissions to other users?

Accepted Answer

DAC (Discretionary Access Control). In DAC (Discretionary Access Control), the resource owner has discretion over who can access the resource. This contrasts with MAC, where access is based on labels, and RBAC/ABAC, where access is based on roles or attributes.

Answer

RBAC (Role-Based Access Control)

Answer

MAC (Mandatory Access Control)

Answer

ABAC (Attribute-Based Access Control)

Question 2

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

Controlling and monitoring access to privileged accounts. PAM solutions focus on securing, managing, and monitoring privileged accounts to reduce the risk of misuse.

Answer

Managing user password resets

Answer

Implementing single sign-on for all applications

Answer

Enforcing password complexity policies

Question 3

What is the primary purpose of account deprovisioning?

Accepted Answer

To revoke access and disable accounts when no longer needed. Deprovisioning ensures that when an employee leaves or changes roles, access is removed promptly to prevent unauthorized use.

Answer

To create new user accounts

Answer

To audit user activity

Answer

To modify user roles

Question 4

A security administrator is designing an identity federation solution. Which THREE of the following are commonly used federation standards?

Accepted Answer

Kerberos. SAML, OAuth/OIDC, and Kerberos (with extensions) are used for federation. LDAP is a directory protocol, not a federation standard.

Answer

LDAP

Answer

RADIUS

Question 5

A company is implementing single sign-on (SSO) for its internal applications. Which TWO of the following protocols are commonly used for SSO?

Accepted Answer

Kerberos. Kerberos and SAML are both widely used for SSO. Kerberos is common in Windows domains, while SAML is used for web-based federated SSO. LDAP is a directory protocol, OAuth is for authorization (though OIDC adds authentication), and RADIUS is for network access.

Answer

OAuth

Answer

LDAP

Answer

RADIUS

Question 6

A security administrator is implementing an access control system that uses sensitivity labels on subjects and objects. The policy dictates that a subject can only read objects with a label equal to or lower than the subject's clearance, and can only write to objects with a label equal to or higher than the subject's clearance. Which access control model and principle is being enforced?

Accepted Answer

MAC with Bell-LaPadula model. Bell-LaPadula model enforces confidentiality through the simple security property (no read up) and the *-property (no write down). The described rules match Bell-LaPadula's restrictions.

Answer

MAC with Biba model

Answer

DAC with owner-based permissions

Answer

RBAC with role hierarchy

Question 7

During a user offboarding process, the security team must ensure that the former employee's access is revoked immediately. However, the user's manager requests that the account remain active for a week to review files. What is the BEST practice?

Accepted Answer

Disable the account immediately and transfer ownership of files to the manager. Best practice is to disable the account immediately to prevent unauthorized access, then transfer ownership of necessary files to another user for review. Keeping the account active poses a security risk.

Answer

Change the account to a service account and keep it active

Answer

Keep the account active but change the password and share it with the manager

Answer

Leave the account as-is and monitor activity for the week

Question 8

A company is adopting a role-based access control (RBAC) model. Which TWO principles are fundamental to RBAC?

Accepted Answer

Roles can be organized in a hierarchy to inherit permissions. RBAC assigns permissions to roles, and users are members of roles. Least privilege and separation of duties are enforced through role design.

Answer

Access is controlled by the data owner

Answer

Permissions are assigned directly to users

Answer

Access decisions are based on subject and object attributes

Question 9

A company is migrating to a cloud-based SaaS application and wants to implement federated identity. Users will authenticate using their existing corporate Active Directory credentials. Which THREE components are essential for a SAML-based federation? (Select THREE.)

Accepted Answer

Identity Provider (IdP). SAML federation requires an Identity Provider (IdP), a Service Provider (SP), and trust between them. The IdP authenticates the user and sends an assertion to the SP via an HTTP redirect.

Answer

Ticket Granting Ticket (TGT)

Answer

Attribute Authority (AA)

Question 10

An organization is planning to implement a Single Sign-On (SSO) solution. Which THREE of the following are commonly associated with SSO technologies?

Accepted Answer

Kerberos. Kerberos uses tickets for SSO, SAML provides federated SSO with XML assertions, and OAuth 2.0 is an authorization framework often used for SSO. Biometrics and PKI are not SSO technologies themselves.

Answer

Biometrics

Answer

Public Key Infrastructure (PKI)

Question 11

An organization is planning to implement multi-factor authentication. Which TWO of the following are valid authentication factors?

Accepted Answer

Fingerprint. The three categories are something you know, something you have, and something you are. Fingerprint (something you are) and smart card (something you have) are valid factors.

Answer

Security question

Answer

Password

Answer

IP address

Question 12

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

Accepted Answer

Password history. Password history prevents users from reusing previous passwords, enforcing password uniqueness over time.

Answer

Password expiry

Answer

Password length

Answer

Password complexity

Question 13

Which of the following is the correct order of the access control process?

Accepted Answer

Identification, authentication, authorization, accountability. The sequence is: identification (user claims identity), authentication (verifies claim), authorization (determines access rights), and accountability (tracks actions).

Answer

Identification, authorization, authentication, accountability

Answer

Authorization, authentication, identification, accountability

Answer

Authentication, identification, authorization, accountability

Question 14

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) gives resource owners discretion to grant or deny access to others.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 15

Which of the following is a secure hash algorithm currently recommended by NIST?

Accepted Answer

SHA-256. SHA-256 is a member of the SHA-2 family of secure hash algorithms and is currently recommended by NIST for cryptographic use. It produces a 256-bit (32-byte) hash value and is widely deployed in protocols such as TLS, SSH, and IPsec, as well as in digital signatures and certificate validation.

Answer

SHA-1

Answer

RC4

Answer

MD5

Question 16

An IT administrator needs to deprovision a user who has been terminated. Which of the following actions should be performed first to ensure security?

Accepted Answer

Disable the user account. Immediately disabling the account prevents any further access. Evidence preservation can be done afterward, and deletion should be delayed until necessary.

Answer

Remove the user from all groups

Answer

Delete the user account

Answer

Change the user's password

Question 17

Which authentication method uses a time-based one-time password (TOTP) generated by a hardware or software token?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password) is defined in RFC 6238 and generates codes based on the current time. It is commonly used with authenticator apps or hardware tokens.

Answer

Kerberos ticket

Answer

Biometric fingerprint reader

Answer

Smart card with PKI certificate

Question 18

A security architect is designing an access control system for a healthcare application. The system must ensure that a nurse can view patient records but cannot modify them, and that a doctor can both view and update records. Additionally, the system must prevent a single user from both ordering a medication and approving its administration. Which TWO access control principles are being applied? (Select TWO.)

Accepted Answer

Separation of duties. Least privilege ensures users have only the permissions needed (nurse view, doctor view/update). Separation of duties prevents a single user from performing conflicting actions (order and approve).

Answer

Discretionary access control

Answer

Need to know

Answer

Mandatory access control

Question 19

An organization is implementing a privileged access management (PAM) solution. Which THREE of the following are common PAM capabilities?

Accepted Answer

Just-in-time (JIT) provisioning of privileged access. PAM includes password vaulting, session recording, and just-in-time provisioning to secure privileged accounts.

Answer

Single sign-on for all applications

Answer

Self-service password reset for end users

Question 20

A company is implementing an access control system for a high-security environment. Which TWO of the following are characteristics of Mandatory Access Control (MAC)?

Accepted Answer

Access rules are defined by the system, not users.. MAC uses labels for subjects and objects, and access decisions are based on clearance and classification. Users cannot change permissions.

Answer

Permissions are assigned to roles.

Answer

Users can grant access to other users.

Answer

Access is based on the owner's discretion.