SSCP Access Controls Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A security analyst reviews this AWS IAM policy and notices that delete operations on objects in the corporate-bucket are being denied unexpectedly. What is the most likely issue?

Accepted Answer

The Deny statement requires objects to be encrypted with AES256 for delete operations. Option A is correct because the Deny statement includes a condition that requires objects to be encrypted with AES256 for all operations, including delete. Since the condition is not limited to specific actions, any delete request on an object that is not encrypted with AES256 will be denied, even if the Allow statement grants s3:DeleteObject permissions. This is a common misconfiguration where encryption requirements inadvertently block operations that do not involve encryption checks.

Answer

The Allow statement is being overridden by the Deny, but the cause is the encryption requirement

Answer

The condition on the Deny statement is not matching any objects

Answer

The policy has a syntax error in the Condition element

Question 2

A system administrator needs to assign permissions to a new employee who will be performing database backups. The employee should only be able to execute the backup command but not read or modify the data. Which access control principle should be applied?

Accepted Answer

Least privilege. The least privilege principle dictates that a user should be granted only the minimum permissions necessary to perform their job function. In this scenario, the employee needs only the ability to execute the backup command (e.g., using a tool like `pg_dump` or `mysqldump` with a read-only snapshot), not read or modify the underlying data files. Applying least privilege ensures the backup process can run without granting broader SELECT or FILE privileges that would allow data access or alteration.

Answer

Need to know

Answer

Separation of duties

Answer

Defense in depth

Question 3

An organization uses role-based access control (RBAC). An employee transfers from the Sales department to the Marketing department. What is the most secure way to update the employee's access?

Accepted Answer

Remove the Sales role and then add the Marketing role. In RBAC, access is determined by the roles assigned to a user. The most secure method is to remove the old role (Sales) first to eliminate any residual permissions, then add the new role (Marketing). This ensures the employee does not retain access to Sales resources during the transition, adhering to the principle of least privilege.

Answer

Add the Marketing role and remove the Sales role after 30 days

Answer

Modify the Sales role to include Marketing permissions

Answer

Create a new custom role with combined permissions

Question 4

A security analyst notices that a user’s account has been used to access sensitive files at 3:00 AM from an IP address outside the company’s country. The analyst suspects a compromised account. Which action should be taken FIRST?

Accepted Answer

Disable the user account immediately. The first step in incident response is to isolate the threat. Disabling the account prevents further unauthorized access while the investigation proceeds.

Answer

Block the external IP address in the firewall

Answer

Reset the user’s password and force a logout

Answer

Contact the user to verify if they were working late

Question 5

A company implements mandatory access control (MAC) on its classified document system. A user with a security clearance of Secret attempts to read a document labeled Top Secret. What happens?

Accepted Answer

The access is denied by the system. In a mandatory access control (MAC) system, access decisions are based on comparing the user's security clearance (Secret) with the document's classification label (Top Secret). Since the clearance level is lower than the document's classification, the system automatically denies the read operation. This is a fundamental property of MAC, where the system enforces the Bell-LaPadula model's simple security property (no read up).

Answer

The user is prompted to request a temporary upgrade

Answer

The document is downgraded to Secret for the user

Answer

The user can read the document because they have a valid clearance

Question 6

An administrator configures a Kerberos authentication system. After implementation, users are able to authenticate but cannot access network resources. The administrator verifies that the client time is synchronized with the KDC. What is the most likely cause?

Accepted Answer

The service principal name (SPN) is not registered. The most likely cause is that the service principal name (SPN) is not registered. In Kerberos, the SPN uniquely identifies a network service instance and is required for the KDC to issue a service ticket. Even though users can authenticate (obtain a TGT), without a properly registered SPN, the KDC cannot grant a ticket for the target service, preventing access to network resources.

Answer

The user’s password is expired

Answer

The firewall blocks port 88

Answer

The TGT lifetime has expired

Question 7

A healthcare organization must comply with HIPAA and requires that access to electronic protected health information (ePHI) be logged and audited. They consider using an identity management system that supports single sign-on (SSO). What is the PRIMARY security concern with SSO in this environment?

Accepted Answer

Single credential compromise leads to broad access. In a healthcare environment subject to HIPAA, the primary security concern with SSO is that a single compromised credential (e.g., a password or smart card PIN) grants an attacker immediate access to all applications and ePHI systems that the user is authorized to use. This creates a single point of failure, dramatically increasing the blast radius of a credential theft incident. Unlike separate per-application credentials, SSO eliminates the need for repeated authentication, so an attacker who obtains the SSO token or password can move laterally across the entire application portfolio without additional authentication barriers.

Answer

Increased complexity of password policies

Answer

Lack of detailed audit logs for each application

Answer

User inconvenience due to multiple logins

Question 8

An organization uses attribute-based access control (ABAC) for its cloud storage. The policy states that a user can read a document only if the user’s department attribute matches the document’s department attribute AND the current time is within business hours (9AM-5PM). A user from Engineering tries to read a document classified for Engineering at 8:55 AM. What is the expected result?

Accepted Answer

Access denied because the time is outside business hours. The ABAC policy requires both conditions to be true: department match AND time within business hours (9AM-5PM). At 8:55 AM, the time condition is false, so access is denied regardless of the department match. This is a classic example of a conjunctive (AND) policy in ABAC where all attributes must satisfy the rules.

Answer

Access granted because the department matches

Answer

Access denied because the department does not match

Answer

Access granted because the user is in Engineering

Question 9

A company wants to implement a policy where no single individual can approve a purchase order and also receive the goods. Which access control principle does this enforce?

Accepted Answer

Separation of duties. This policy enforces separation of duties by ensuring that no single individual has the authority to both approve a purchase order and receive the goods. This control prevents fraud and errors by requiring two different people to complete related but conflicting tasks, which is a fundamental access control principle in financial and operational systems.

Answer

Rotation of duties

Answer

Need to know

Answer

Least privilege

Question 10

During an audit, it is discovered that a contractor’s account has read access to a financial database even though the contractor’s project ended six months ago. Which type of access control failure is this?

Accepted Answer

Poor account management. The correct answer is D because the contractor's account retained access privileges after the project ended, which is a failure of the account lifecycle management process. Proper account management requires disabling or removing accounts when a user's role or affiliation changes, such as when a contract terminates. This is not an authorization or authentication issue, as the access was originally granted correctly but was not revoked in a timely manner.

Answer

Inadequate authorization

Answer

Insufficient authentication

Answer

Weak password policy

Question 11

Which TWO of the following are characteristics of mandatory access control (MAC)?

Accepted Answer

The system enforces access decisions based on policies. Mandatory access control (MAC) enforces access decisions based on centrally defined policies, not at the discretion of individual users. The system compares security labels assigned to subjects (e.g., users, processes) and objects (e.g., files, resources) to determine if access is allowed. This ensures that even the owner of an object cannot override the policy, which is a core characteristic of MAC.

Answer

Access decisions are based on the user’s discretion

Answer

It is commonly used in commercial environments

Answer

Users can grant access to other users

Question 12

Which TWO of the following are best practices for password management?

Accepted Answer

Implement account lockout after a few failed attempts. Password complexity and account lockout are standard best practices. Storing passwords in plaintext and reusing passwords are poor practices.

Answer

Allow reuse of the last 5 passwords

Answer

Store passwords in plaintext for quick recovery

Answer

Share passwords via email for convenience

Question 13

Which THREE of the following are common methods for implementing multifactor authentication (MFA)?

Accepted Answer

Password and SMS code. Option B is correct because it combines something you know (password) with something you have (SMS code sent to a registered device). This satisfies the MFA requirement of using at least two distinct authentication factors, making it significantly more secure than single-factor password-only authentication.

Answer

Retina scan and facial recognition

Answer

Password and security question

Question 14

You are the security administrator for a mid-sized financial services company. The company uses Active Directory (AD) for identity management and has implemented role-based access control (RBAC) for its core banking application. Recently, the company acquired a smaller firm and is integrating its employees into AD. During the integration, you notice that many of the new employees have been assigned multiple roles that grant them access to sensitive financial data, despite their job descriptions indicating they need only limited access. Additionally, some users who left the acquired company have not been disabled in AD. The company's security policy mandates the principle of least privilege and requires that access reviews be conducted quarterly, but no review has been performed in the past year. You have been tasked with remediating these issues. Which of the following approaches is the MOST effective initial step to address the immediate risk of excessive access?

Accepted Answer

Immediately disable all user accounts from the acquired company that have not been logged in within the last 90 days.. Option D is the most effective initial step because it immediately reduces the attack surface by disabling accounts that are likely orphaned (no login in 90 days), directly addressing the immediate risk of excessive access from former employees. This aligns with the principle of least privilege and is a quick, high-impact remediation that can be performed before a full access review or recertification.

Answer

Conduct a comprehensive access recertification review for all users in the acquired company.

Answer

Implement multifactor authentication (MFA) for all users in the acquired company.

Answer

Roll back all user permissions to the default role and then re-add each user based on their job function.

Question 15

A small business wants to implement an access control system where employees can access files based on their department (e.g., HR, Finance). They want simplicity and ease of administration. Which access control model is BEST suited?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is best suited because it maps access permissions directly to job functions (roles) such as HR or Finance, rather than to individual users. This simplifies administration: when an employee changes departments, the administrator simply updates their role assignment, and all associated permissions are automatically applied or revoked. RBAC is designed for environments where access decisions are based on organizational roles, providing a balance of security and ease of management.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

SSCP Access Controls Practice Test 4 — 15 Questions

Exhibit

SSCP Access Controls Practice Test 4 — 15 Questions

Exhibit