SSCP Access Controls — 10 Questions

Question 1

A company is implementing a biometric authentication system for physical access to a data center. The system must minimize false acceptances. Which metric is most directly related to false acceptance rate (FAR)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threshold setting. FAR is the rate at which an unauthorized person is incorrectly accepted. The threshold setting directly impacts FAR; a higher (more stringent) threshold reduces FAR but may increase FRR.

Answer

Crossover error rate (CER)

Answer

Equal error rate (EER)

Answer

False rejection rate (FRR)

Question 2

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) uses labels for subjects (clearance) and objects (classification) to enforce access decisions, commonly used in government and military environments.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 3

Which access control model enforces the principle of least privilege by granting permissions based on job functions and requires separation of duties?

Accepted Answer

Role-Based Access Control (RBAC). RBAC assigns permissions to roles, and users are assigned to roles, enabling least privilege and separation of duties through role design.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 4

An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?

Accepted Answer

Time-based One-Time Password (TOTP). Time-based One-Time Password (TOTP) generates a temporary code that changes every 30-60 seconds, commonly used with mobile apps like Google Authenticator.

Answer

Smart card

Answer

Hardware token

Answer

Biometrics

Question 5

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 6

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

Accepted Answer

Just-in-Time (JIT) provisioning with session recording. Just-in-Time (JIT) provisioning grants temporary elevated privileges for specific tasks, reducing the attack surface. Session recording captures all actions for auditing.

Answer

Password vaulting

Answer

Role-based access control

Answer

Multi-factor authentication

Question 7

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

Accepted Answer

False Rejection Rate (FRR). False Rejection Rate (FRR) measures the likelihood that an authorized user is incorrectly denied access. A high FRR indicates many false rejections.

Answer

False Acceptance Rate (FAR)

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Question 8

A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?

Accepted Answer

Authentication. Authentication is the process of verifying the identity claimed by a user. Identification is the claim (e.g., username), and authentication is the verification (e.g., password).

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 9

An organization uses Kerberos for single sign-on. When a user logs in, they receive a Ticket Granting Ticket (TGT). What is the primary purpose of the TGT?

Accepted Answer

To obtain service tickets for accessing resources. The TGT is obtained from the Authentication Server (AS) and is used to request service tickets from the Ticket Granting Server (TGS) without re-entering credentials, enabling SSO.

Answer

To encrypt all network traffic

Answer

To provide a digital signature for emails

Answer

To authenticate the user to the network

Question 10

A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) uses policies that evaluate attributes of the subject, object, and environment to make access decisions, offering fine-grained and dynamic control.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)