SSCP Access Controls Practice Test 3 — 15 Questions

Question 1

Based on the exhibit, if the user attempts to upload (put) a file to the S3 bucket corporate-data, what is the result?

Accepted Answer

Denied because the explicit deny overrides any allow. The correct answer is B because the bucket policy includes an explicit deny statement that denies s3:PutObject for the user's principal. In AWS IAM and resource-based policies, an explicit deny always overrides any allow, regardless of other permissions. Therefore, even if other statements allow PutObject, the explicit deny blocks the upload.

Answer

Allowed because the bucket policy likely allows public puts

Answer

Denied because PutObject is not explicitly allowed

Answer

Allowed because the policy also allows GetObject

Question 2

A healthcare organization is implementing an access control system to ensure that employees can only access patient records necessary for their job functions. Which model best enforces this principle?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct model because it assigns permissions based on job roles, ensuring employees only access patient records necessary for their duties. In healthcare, RBAC aligns with the principle of least privilege by mapping roles (e.g., nurse, doctor, billing) to specific data access, as defined in standards like NIST SP 800-53. This directly enforces the requirement that access is tied to job functions, not individual discretion or system-wide rules.

Answer

Rule-Based Access Control (RuBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 3

A Linux server administrator configures SSH key-based authentication for user 'admin'. The authentication fails with the error 'Authentication refused: bad permissions' in the logs. What is the most likely cause?

Accepted Answer

The private key file has permissions set to 644 (world-readable). Option B is correct because SSH key-based authentication requires the private key file to have restrictive permissions (typically 600 or 640) to prevent unauthorized access. When the private key is world-readable (e.g., 644), the SSH daemon refuses to use it for security reasons, logging 'Authentication refused: bad permissions'. This is a direct check performed by OpenSSH to protect against key disclosure.

Answer

The SSH service is not running

Answer

The public key is not in the ~/.ssh/authorized_keys file

Answer

The passphrase on the private key is incorrect

Question 4

An organization uses smart cards combined with a PIN to access secure facilities. This is an example of which type of authentication factor?

Accepted Answer

Two-factor authentication. Smart cards are a possession factor (something you have), and the PIN is a knowledge factor (something you know). Combining both satisfies the requirement for two distinct authentication factors, making this a textbook example of two-factor authentication (2FA). This is not single-factor because two separate categories of credentials are used, and it is not biometric because no physical characteristic is measured.

Answer

Token-based authentication

Answer

Single-factor authentication

Answer

Biometric authentication

Question 5

The security team discovers that a user in the finance department can read files in the human resources share. The share permissions on the HR folder are set to deny all except the HR group, and the user is not a member of HR. What is the most likely cause?

Accepted Answer

The user is logging on locally to the server where the files are stored. When a user logs on locally to the file server, Windows evaluates NTFS permissions directly, bypassing share permissions entirely. Share permissions only apply to network access via SMB, so a local logon allows the user to read files if NTFS permissions grant access, even if share permissions deny all except the HR group.

Answer

The user is an administrator on the file server

Answer

The user is using a different file server for HR files

Answer

The user's token includes a group that has been explicitly denied

Question 6

A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?

Accepted Answer

Authentication will fail because the time difference exceeds the default Kerberos clock skew limit. Kerberos authentication relies on timestamps to prevent replay attacks. The default maximum clock skew allowed between a client and a domain controller is 5 minutes (as defined in RFC 4120). Since the workstation is exactly 5 minutes ahead, it meets the threshold, but any additional delay or network latency can cause the timestamp to exceed the limit, resulting in authentication failure. Therefore, the user will be unable to authenticate.

Answer

The user would be prompted for credentials but authentication would proceed

Answer

Only NTLM authentication would be affected

Answer

No impact; Kerberos can tolerate up to 10 minutes of skew

Question 7

In which access control model does the owner of a resource have full discretion over who can access it and with what permissions?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the model where the resource owner has full authority to grant or deny access to other subjects and to set the permissions (e.g., read, write, execute) on the object. This is typically implemented through Access Control Lists (ACLs) on files or objects, as seen in Windows NTFS or Linux file permissions, where the owner can change permissions using commands like `chmod` or through GUI properties.

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Question 8

A military system uses mandatory access control with classifications Unclassified, Confidential, Secret, and Top Secret. A user with Secret clearance attempts to read a file labeled Top Secret. What will occur?

Accepted Answer

Access is denied because the subject's clearance is lower than the object's classification. In a mandatory access control (MAC) system, access decisions are based on comparing the subject's clearance level with the object's classification label. Since the user has a Secret clearance and the file is classified Top Secret, the subject's clearance is lower than the object's classification, so read access is denied per the Bell-LaPadula model's Simple Security Property (no read up).

Answer

Access is granted because the user has write permission

Answer

Access is granted if the user is the owner of the file

Answer

Access is granted because the user has a need-to-know

Question 9

An organization implements a policy that the same individual cannot both create a purchase order and approve it in the financial system. Which security principle does this control primarily enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from performing conflicting tasks, such as creating and approving a purchase order. By splitting these responsibilities, the organization reduces the risk of fraud, errors, and unauthorized transactions, ensuring that no single person has unchecked control over a critical financial process.

Answer

Job rotation

Answer

Least privilege

Answer

Need-to-know

Question 10

A cloud application uses OAuth 2.0 to authorize a third-party app to access user data. What is the primary purpose of the access token issued by the authorization server?

Accepted Answer

To grant the client application limited access to user's resources. In OAuth 2.0, the access token is a credential that represents the authorization granted to the client application by the resource owner. Its primary purpose is to allow the client to access specific, scoped resources on the resource server on behalf of the user, without exposing the user's credentials. This is defined in RFC 6749, where the token encapsulates the granted permissions and scope.

Answer

To revoke the user's access to the client application

Answer

To encrypt data exchanged between client and resource server

Answer

To authenticate the user to the resource server

Question 11

Which two commands can be used to modify existing file permissions on a Linux system? (Select TWO)

Accepted Answer

setfacl. B is correct because `setfacl` is used to modify Access Control Lists (ACLs) on a file or directory, which are an extended mechanism for setting permissions beyond the standard owner/group/others model. E is correct because `chmod` is the standard command for changing the read, write, and execute permissions for the file owner, group, and others using symbolic or octal notation.

Answer

chattr

Answer

umask

Answer

chown

Question 12

Which three statements are true regarding mandatory access control (MAC) systems? (Select THREE)

Accepted Answer

Multilevel security is enforced. Mandatory Access Control (MAC) enforces system-wide policy based on security labels assigned to subjects and objects. Multilevel security (MLS) is a core MAC property where data at different classification levels (e.g., Secret, Top Secret) is isolated and access is governed by the system, not users. Subjects (users/processes) are assigned clearance levels, and objects have security labels; access decisions compare these labels using rules like the Bell-LaPadula model (no read up, no write down).

Answer

The owner of an object can change its security label

Answer

Users can grant permissions to other users

Question 13

Which two components are integral to a Kerberos authentication system? (Select TWO)

Accepted Answer

Key Distribution Center (KDC). The Key Distribution Center (KDC) is the core component of a Kerberos authentication system, responsible for issuing tickets and managing session keys. The Ticket Granting Ticket (TGT) is a temporary credential obtained from the Authentication Server (AS) within the KDC, used to request service tickets without re-entering credentials. Both are integral to the Kerberos protocol (RFC 4120) for secure, ticket-based authentication.

Answer

Authentication Server (AS)

Answer

Certificate Authority (CA)

Answer

Security Assertion Markup Language (SAML)

Question 14

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Accepted Answer

The user does not have the 'Allow log on through Remote Desktop Services' user right. The event log shows an 'An account failed to log on' event (ID 4625) with a failure reason indicating 'The user has not been granted the requested logon type at this machine.' For Remote Desktop connections, the required logon type is 'Remote Interactive' (logon type 10). This specific error means the user lacks the 'Allow log on through Remote Desktop Services' user right, which is assigned via Local Security Policy or Group Policy. Without this right, the RDP session is denied at the authentication stage, even if the username and password are correct.

Answer

The user account is locked out

Answer

The server is not a member of the domain

Answer

The user's Kerberos ticket has expired

Question 15

Refer to the exhibit. User bob, a member of the projectdev group, attempts to create a new file in /data/project but gets 'Permission denied'. What is the most likely reason?

Accepted Answer

The group permission (r-x) and the mask (rwx) combine to limit bob to read and execute only. The directory /data/project has group permissions set to r-x (read and execute) for the projectdev group, and the umask is set to rwx (000), meaning no bits are masked. However, the group permission explicitly denies write access. Since bob is a member of projectdev, his effective permissions are limited to read and execute, preventing file creation.

Answer

Bob is not the owner of the directory

Answer

Bob's effective permissions are limited by the user:alice entry

Answer

The 'other' permission is '---', blocking all access for users not in the file's user or group

SSCP Access Controls Practice Test 3 — 15 Questions

Exhibit

SSCP Access Controls Practice Test 3 — 15 Questions

Exhibit