SSCP Access Controls — 15 Questions

Question 1

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) uses labels for subjects (clearance) and objects (classification) to enforce access decisions, commonly used in government and military environments.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 2

Which access control model enforces the principle of least privilege by granting permissions based on job functions and requires separation of duties?

Accepted Answer

Role-Based Access Control (RBAC). RBAC assigns permissions to roles, and users are assigned to roles, enabling least privilege and separation of duties through role design.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 3

An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?

Accepted Answer

Time-based One-Time Password (TOTP). Time-based One-Time Password (TOTP) generates a temporary code that changes every 30-60 seconds, commonly used with mobile apps like Google Authenticator.

Answer

Smart card

Answer

Hardware token

Answer

Biometrics

Question 4

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 5

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

Accepted Answer

Just-in-Time (JIT) provisioning with session recording. Just-in-Time (JIT) provisioning grants temporary elevated privileges for specific tasks, reducing the attack surface. Session recording captures all actions for auditing.

Answer

Password vaulting

Answer

Role-based access control

Answer

Multi-factor authentication

Question 6

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

Accepted Answer

False Rejection Rate (FRR). False Rejection Rate (FRR) measures the likelihood that an authorized user is incorrectly denied access. A high FRR indicates many false rejections.

Answer

False Acceptance Rate (FAR)

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Question 7

A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?

Accepted Answer

Authentication. Authentication is the process of verifying the identity claimed by a user. Identification is the claim (e.g., username), and authentication is the verification (e.g., password).

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 8

An organization uses Kerberos for single sign-on. When a user logs in, they receive a Ticket Granting Ticket (TGT). What is the primary purpose of the TGT?

Accepted Answer

To obtain service tickets for accessing resources. The TGT is obtained from the Authentication Server (AS) and is used to request service tickets from the Ticket Granting Server (TGS) without re-entering credentials, enabling SSO.

Answer

To encrypt all network traffic

Answer

To provide a digital signature for emails

Answer

To authenticate the user to the network

Question 9

A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) uses policies that evaluate attributes of the subject, object, and environment to make access decisions, offering fine-grained and dynamic control.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 10

In a federated identity scenario, a user authenticates to their home domain and accesses a resource in a partner domain. The partner domain trusts the authentication performed by the home domain. What is the home domain's role in this trust relationship?

Accepted Answer

Identity Provider (IdP). In federated identity, the Identity Provider (IdP) is the home domain that authenticates the user and issues assertions. The Service Provider (SP) trusts the IdP's authentication.

Answer

Relying Party

Answer

Service Provider (SP)

Answer

Kerberos Distribution Center (KDC)

Question 11

A security engineer is designing a system that must ensure data integrity at all costs, even if it means sacrificing availability. Which access control model and corresponding principle should be applied?

Accepted Answer

Biba with no write-up and no read-down. Biba is a MAC model that focuses on integrity, preventing subjects from writing to higher integrity levels (no write-up) and preventing subjects from reading lower integrity levels (no read-down). This can impact availability.

Answer

Bell-LaPadula with no read-down

Answer

Biba with no read-up

Answer

Bell-LaPadula with no write-up

Question 12

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

Accepted Answer

Password history. Password history prevents users from reusing previous passwords, enforcing password uniqueness over time.

Answer

Password expiry

Answer

Password length

Answer

Password complexity

Question 13

A company is implementing an access control system for a high-security environment. Which TWO of the following are characteristics of Mandatory Access Control (MAC)?

Accepted Answer

Access rules are defined by the system, not users.. MAC uses labels for subjects and objects, and access decisions are based on clearance and classification. Users cannot change permissions.

Answer

Permissions are assigned to roles.

Answer

Users can grant access to other users.

Answer

Access is based on the owner's discretion.

Question 14

An organization is planning to implement a Single Sign-On (SSO) solution. Which THREE of the following are commonly associated with SSO technologies?

Accepted Answer

Kerberos. Kerberos uses tickets for SSO, SAML provides federated SSO with XML assertions, and OAuth 2.0 is an authorization framework often used for SSO. Biometrics and PKI are not SSO technologies themselves.

Answer

Biometrics

Answer

Public Key Infrastructure (PKI)

Question 15

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Accepted Answer

Preserve evidence for potential investigation. Immediate disabling prevents unauthorized access, and preserving evidence (logs, files) is essential for potential investigations. Deleting accounts immediately may hinder forensics, and notifying users is not required (they are leaving).

Answer

Change the user's password to a default

Answer

Notify the user that their account will be removed

Answer

Delete the account and all associated data