SSCP Access Controls Practice Test 2 — 15 Questions

Question 1

Match each authentication factor to its category.

Question 2

A help desk technician needs to reset a user's password but should not be able to modify other user attributes. Which access control principle should be applied to enforce this restriction?

Accepted Answer

Least privilege. Least privilege ensures that a user or process is granted only the minimum permissions necessary to perform their job function. In this scenario, the help desk technician needs the ability to reset passwords but must be restricted from modifying other user attributes, such as group membership or account expiration. By applying least privilege, the technician's account is assigned a role or permission set that specifically allows password reset operations (e.g., via Active Directory delegated permissions or a custom RBAC role) while explicitly denying write access to other user object properties.

Answer

Need-to-know

Answer

Separation of duties

Answer

Mandatory access control

Question 3

A company uses role-based access control (RBAC). A user is assigned to the 'Sales' role, which grants access to CRM and reporting, and also to the 'Sales Manager' role, which grants additional access to team reports. However, the user cannot access team reports. What is the most likely cause?

Accepted Answer

RBAC role hierarchy is not configured. In RBAC, role hierarchy allows roles to inherit permissions from other roles. Without a configured hierarchy, the 'Sales Manager' role does not automatically inherit permissions from the 'Sales' role, and the user may not have direct permission to access team reports if that permission is only assigned to the 'Sales Manager' role but the user's effective permissions are not properly combined. The most likely cause is that the RBAC role hierarchy is not configured, so the user's membership in both roles does not result in the union of their permissions.

Answer

An access control list on the report folder explicitly denies the 'Sales' role

Answer

The user account has been disabled

Answer

The user's session is not properly managed

Question 4

An organization implements an attribute-based access control (ABAC) system with the following policy: if user.role == 'doctor' and resource.type == 'patient_record' and environment.time between 08:00-18:00 then permit. A doctor tries to access a patient record at 20:00. What is the result?

Accepted Answer

Deny. The ABAC policy requires the environment.time to be between 08:00 and 18:00 for access to be permitted. Since the doctor attempts access at 20:00, which falls outside this time window, the condition is not met, and the policy evaluates to 'deny' by default in a closed-system ABAC model. The correct result is Deny (option D).

Answer

Permit

Answer

Indeterminate

Answer

Not applicable

Question 5

Which access control model is best suited for a military environment where data classification (Unclassified, Confidential, Secret, Top Secret) and subject clearance levels are the primary factors for access decisions?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access based on labels (classification and clearance) and is used in military and government settings. Option B is correct. Option A (DAC) allows owners to set permissions, which is unsuitable for classified environments. Option C (RBAC) uses roles, not classification levels. Option D (ABAC) is flexible but not the traditional model for military-grade security.

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 6

A user reports they can now access files in a shared drive that were previously denied. Upon investigation, the IT team discovers the user was added to a new group that has read/write permissions to the drive. This situation is best described as:

Accepted Answer

Privilege creep. Privilege creep occurs when users accumulate more permissions over time than they need for their current role, often through group memberships. In this scenario, the user was added to a new group that granted read/write access to a shared drive, resulting in unintended elevated access. This is a classic example of privilege creep because the user's access rights expanded beyond what was originally authorized, violating the principle of least privilege.

Answer

Separation of duties violation

Answer

Inconsistent access control list

Answer

Role explosion

Question 7

A company uses a federated identity system where partner employees access internal applications via SAML assertions. Recently, a partner employee who should have been terminated was still able to log in. Which missing control is the most likely root cause?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning is the missing control because it ensures that user accounts are created and, more critically, disabled or removed in real-time based on the identity provider's (IdP) authoritative directory. Without JIT provisioning, the partner employee's account in the service provider (SP) remains active even after termination in the IdP, allowing continued access via valid SAML assertions. JIT provisioning would synchronize the account lifecycle by checking the IdP's user status at each authentication attempt and disabling the local account when the user is deactivated.

Answer

Identity proofing

Answer

Session timeout

Answer

Single sign-on logout

Question 8

An administrator wants to ensure that users cannot share passwords. Which control is most effective at reducing the risk of password sharing?

Accepted Answer

Multifactor authentication. Multifactor authentication (MFA) is the most effective control because it requires users to present two or more distinct factors (e.g., something you know, something you have, something you are) to authenticate. Even if a user shares their password (something you know), an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or biometric). This directly reduces the risk of password sharing by making the shared credential insufficient for access.

Answer

Account lockout policies

Answer

Password complexity

Answer

Password history

Question 9

A database audit log shows that a user ran a query retrieving all customer records. The user's job role only requires access to view their own assigned customers. Which access control concept has been violated?

Accepted Answer

Need-to-know. The need-to-know principle restricts data access to only the information necessary for a user to perform their job duties. In this case, the user retrieved all customer records, but their role only requires access to their own assigned customers, meaning they accessed data beyond what is necessary. This directly violates the need-to-know concept, which is a subset of access control that limits access to specific data elements rather than entire datasets.

Answer

Job rotation

Answer

Separation of duties

Answer

Least privilege

Question 10

An organization uses mandatory access control (MAC) with the Bell-LaPadula model. A subject has a clearance of 'Secret' and an object has a classification of 'Top Secret'. What is the result if the subject attempts to read the object?

Accepted Answer

Read denied. In the Bell-LaPadula model, the Simple Security Property (no read up) prohibits a subject from reading an object with a higher classification. Since the subject has a clearance of 'Secret' and the object is classified as 'Top Secret', the read attempt is denied. This enforces mandatory access control (MAC) by preventing information flow from higher to lower security levels.

Answer

Write denied

Answer

Write allowed

Answer

Read allowed

Question 11

Which TWO of the following are examples of multifactor authentication? (Choose two.)

Accepted Answer

Smart card and PIN. Multifactor authentication (MFA) requires at least two distinct factors from different categories: something you know, something you have, and something you are. A smart card is 'something you have,' and a PIN is 'something you know,' so combining them satisfies MFA requirements. This is a classic example used in access control systems like Common Access Cards (CAC) or Personal Identity Verification (PIV) cards.

Answer

SMS code and password

Answer

Password and security question

Answer

Voice recognition and iris scan

Question 12

Which TWO are valid reasons to revoke a user's access? (Choose two.)

Accepted Answer

User is terminated. Option A is correct because when a user is terminated, their access must be immediately revoked to prevent unauthorized access to systems and data. This is a fundamental principle of access control, ensuring that former employees cannot exploit their credentials. Revocation typically involves disabling the user account, removing group memberships, and invalidating any active sessions or tokens.

Answer

User password expires

Answer

User completes quarterly training

Answer

User updates personal information

Question 13

Which THREE are required components of a core role-based access control (RBAC) system according to NIST? (Choose three.)

Accepted Answer

Users. Option B (Users) is correct because in NIST's RBAC model (INCITS 359-2012), users are the human actors who are assigned to roles. The core components of RBAC are users, roles, and permissions; users are the subjects that ultimately receive permissions through their role membership. Without users, there is no entity to which roles and permissions can be assigned.

Answer

Constraints

Answer

Sessions

Question 14

Based on the exhibit, what type of attack is most likely occurring?

Accepted Answer

Password spraying attack. The exhibit shows a single username being targeted with multiple passwords from a list, which is characteristic of a dictionary attack. However, the correct answer is password spraying attack because the scenario likely involves trying a single common password against many usernames, not many passwords against one user. In password spraying, the attacker uses a small set of common passwords across many accounts to avoid account lockout thresholds, which matches the exhibit's pattern of low-and-slow attempts.

Answer

Brute-force attack

Answer

Pass-the-hash attack

Answer

Dictionary attack

Question 15

Which access control mechanism most likely failed to prevent this unauthorized privilege escalation?

Accepted Answer

Account lockout policy. An account lockout policy is designed to prevent brute-force attacks by locking an account after a specified number of failed login attempts. In the context of unauthorized privilege escalation, a lockout policy would not prevent a user who already has valid credentials from escalating privileges through other means, such as exploiting a misconfigured sudoers file or a kernel vulnerability. Therefore, the failure of the account lockout policy is the most likely mechanism that allowed the escalation, as it does not control what an authenticated user can do after login.

Answer

Sudoers configuration

Answer

Password policy

Answer

SELinux