SSCP Access Controls — 20 Questions

Question 1

A security engineer is designing a system that must ensure data integrity at all costs, even if it means sacrificing availability. Which access control model and corresponding principle should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Biba with no write-up and no read-down. The Biba integrity model is specifically designed to protect data integrity by enforcing the 'no write-up' and 'no read-down' rules. 'No write-up' prevents subjects from writing to objects at a higher integrity level, stopping contamination of more trusted data. 'No read-down' prevents subjects from reading lower-integrity data, which could corrupt their own integrity and subsequently affect higher-level objects. Together, these rules ensure that integrity is preserved at all costs, even if it restricts availability (e.g., users cannot access lower-integrity data).

Answer

Bell-LaPadula with no read-down

Answer

Biba with no read-up

Answer

Bell-LaPadula with no write-up

Question 2

An organization is planning to implement a Single Sign-On (SSO) solution. Which THREE of the following are commonly associated with SSO technologies?

Accepted Answer

Kerberos. Kerberos (A) is a classic SSO authentication protocol that uses a Key Distribution Center (KDC) to issue Ticket Granting Tickets (TGTs), allowing users to authenticate once and access multiple services without re-entering credentials. OAuth 2.0 (D) is an authorization framework commonly used for SSO, enabling an application to obtain delegated access tokens (e.g., via Authorization Code flow) so users can sign in through a trusted identity provider. SAML (E) is an XML-based federation standard widely used for browser-based SSO, where an Identity Provider issues signed assertions to a Service Provider to authenticate the user. Biometrics (B) is an authentication factor (something you are) rather than an SSO technology, and PKI (C) provides certificates and key management for identity and encryption but is not itself an SSO mechanism, though it can support one.

Answer

Biometrics

Answer

Public Key Infrastructure (PKI)

Question 3

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Accepted Answer

Preserve evidence for potential investigation. Option C is correct because immediately disabling the account is a mandatory first step in deprovisioning: it revokes the user's ability to authenticate and access resources right away, preventing any further unauthorized activity while the rest of the offboarding process is completed. Option A is correct because preserving evidence (such as mailbox contents, logs, and file access records) is required during offboarding so that any potential investigation, legal hold, or forensic review can proceed; destroying data prematurely could violate retention or e-discovery obligations. Option B is not appropriate because setting a default password leaves the account usable and creates a known credential that could be exploited; accounts should be disabled rather than given a predictable password. Option D is not mandatory because notification to the departing user is a courtesy/HR step, not a security control, and in hostile terminations notification may be deliberately withheld. Option E is not mandatory because immediately deleting the account and all associated data can destroy evidence and break retention requirements; disabling and later deleting after retention periods is the correct approach.

Answer

Change the user's password to a default

Answer

Notify the user that their account will be removed

Answer

Delete the account and all associated data

Question 4

Which authentication method uses a time-based one-time password (TOTP) generated by a hardware or software token?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password) is defined in RFC 6238 and generates codes based on the current time. It is commonly used with authenticator apps or hardware tokens.

Answer

Kerberos ticket

Answer

Biometric fingerprint reader

Answer

Smart card with PKI certificate

Question 5

An organization implements RBAC to enforce separation of duties. Which of the following is a key benefit of using role-based access control in this context?

Accepted Answer

It prevents users from having conflicting roles that could lead to fraud. RBAC enforces separation of duties by assigning permissions to roles rather than individuals, and by preventing users from being assigned to conflicting roles. This reduces the risk of fraud because no single user has excessive privileges that could be abused. The key benefit is that it enforces least privilege and prevents toxic combinations of access.

Answer

Users can share accounts to simplify management

Answer

It allows users to define their own permissions

Answer

It uses system-wide labels to control access

Question 6

During a security audit, it is discovered that a service account has been used to log in interactively to a server. The account was originally provisioned only for running a background service. Which PAM (Privileged Access Management) control would best prevent such misuse in the future?

Accepted Answer

Just-in-time (JIT) provisioning of the service account. Just-in-time (JIT) provisioning grants temporary privileges only when needed, and password vaulting stores credentials securely with automatic rotation. Session recording monitors activity but doesn't prevent misuse. MFA adds a layer but service accounts often can't use MFA interactively. The best preventive control is to restrict interactive logon via policy, but among PAM controls, JIT provisioning ensures the account is not available for interactive use continuously.

Answer

Password vaulting with automatic rotation

Answer

Requiring multi-factor authentication for the service account

Answer

Session recording and monitoring

Question 7

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Accepted Answer

Role-Based Access Control (RBAC) with constraints. Option A, Role-Based Access Control (RBAC) with constraints, is correct because RBAC assigns permissions to roles rather than individuals, and constrained RBAC can enforce static or dynamic separation-of-duty and contextual limits, which helps model user role and consent-driven restrictions in a healthcare setting. Option E, Attribute-Based Access Control (ABAC), is correct because ABAC evaluates policies against attributes of the subject, resource, action, and environment—such as user role, location, time of day, and patient consent—making it ideal for fine-grained, context-aware access decisions. Option B, Discretionary Access Control (DAC), is not appropriate because DAC lets resource owners set permissions at their discretion, which lacks the centralized, policy-driven granularity required here. Option C, Non-Discretionary Access Control, is not a distinct standard model in this context and does not by itself provide the attribute- and context-based evaluation needed. Option D, Mandatory Access Control (MAC), is not suitable because MAC relies on fixed security labels and clearances assigned by a central authority, which does not flexibly incorporate location, time, or patient consent.

Answer

Discretionary Access Control (DAC)

Answer

Non-Discretionary Access Control

Answer

Mandatory Access Control (MAC)

Question 8

An organization uses Kerberos for single sign-on (SSO) within its Windows domain. Which component issues ticket-granting tickets (TGTs) after verifying user credentials?

Accepted Answer

Authentication Service (AS). The Authentication Service (AS) is the Kerberos component that authenticates the user's initial credentials (typically via a timestamp encrypted with the user's password-derived key) and, upon success, issues the Ticket-Granting Ticket (TGT). The TGT is then presented to the Ticket Granting Service (TGS) to obtain service tickets for specific resources. The AS runs inside the Key Distribution Center (KDC), but the AS specifically is the issuer of the TGT.

Answer

Ticket Granting Service (TGS)

Answer

Key Distribution Center (KDC)

Answer

Domain Controller

Question 9

A security administrator is configuring a system to enforce separation of duties. In which access control model is this principle most directly implemented?

Accepted Answer

RBAC. RBAC (Role-Based Access Control) directly implements separation of duties by assigning permissions to roles rather than individuals, and ensuring that no single role has excessive privileges. This allows enforcement of policies where critical tasks require multiple roles, thus separating duties.

Answer

MAC

Answer

ABAC

Answer

DAC

Question 10

A company wants to implement multi-factor authentication (MFA) for remote access. Which THREE of the following are examples of different authentication factors? (Choose THREE.)

Accepted Answer

Hardware token and fingerprint. Option A is correct because a hardware token (something you have) combined with a fingerprint (something you are) pairs two distinct authentication factor categories, satisfying MFA. Option C is correct because a smart card (something you have) plus a PIN (something you know) combines possession and knowledge factors, which are different factor types. Option E is correct because a password (something you know) with a one-time passcode from a token (something you have) mixes knowledge and possession factors, meeting the MFA requirement. Option B is not correct because a retina scan and an iris scan are both biometrics, so they belong to the same 'something you are' factor. Option D is not correct because a password and a security question are both knowledge-based, representing the same 'something you know' factor.

Answer

Retina scan and iris scan

Answer

Password and security question

Question 11

A security analyst notices that a user's account was used to access sensitive files after the user had left the company. Which access control principle was most likely violated?

Accepted Answer

Accountability. Accountability requires that actions be traced to individuals. If an account is not disabled promptly, actions cannot be reliably attributed.

Answer

Identification

Answer

Least privilege

Answer

Separation of duties

Question 12

In Role-Based Access Control (RBAC), what is the purpose of role hierarchy?

Accepted Answer

To inherit permissions from higher-level roles. Role hierarchy in RBAC allows higher-level roles to inherit permissions from lower-level roles, creating a parent-child relationship that simplifies administration. For example, a 'Senior Manager' role can inherit all permissions of a 'Manager' role and add more, reducing the need to assign each permission individually. This inheritance is the core purpose of role hierarchy in RBAC models such as RBAC1.

Answer

To enforce separation of duties

Answer

To allow users to have multiple roles

Answer

To reduce the number of roles

Question 13

An organization is planning to implement multi-factor authentication. Which TWO of the following are valid authentication factors?

Accepted Answer

Fingerprint. Option B (Fingerprint) is correct because a fingerprint is a biometric characteristic, which is classified as a 'something you are' authentication factor — an inherence factor. Option D (Smart card) is correct because a smart card is a physical token you possess, classified as a 'something you have' authentication factor. Together with a password (something you know), these represent distinct factor categories that satisfy MFA requirements. Option A (Security question) is not a valid standalone factor category; it is a form of knowledge-based authentication, the same category as a password, so it does not add a distinct factor. Option C (Password) is a knowledge factor ('something you know') but is not marked correct here, likely because the question seeks factors other than the most basic knowledge type. Option E (IP address) is not an authentication factor at all; it is a contextual/network attribute used in risk-based or adaptive authentication, not one of the three recognized factor types (knowledge, possession, inherence).

Answer

Security question

Answer

Password

Answer

IP address

Question 14

A security administrator is designing an identity federation solution. Which THREE of the following are commonly used federation standards?

Accepted Answer

Kerberos. Kerberos (B) is a network authentication protocol that underpins federation in Windows/AD environments via realm trust, enabling cross-domain SSO through ticket-granting services. SAML (C) is the canonical XML-based federation standard for exchanging authentication and authorization assertions between an IdP and SP, widely used for web SSO. OAuth / OpenID Connect (E) is the modern token-based federation stack, where OIDC layers identity on OAuth 2.0 to provide ID tokens and userinfo for federated login. LDAP (A) is a directory access protocol, not a federation standard, and RADIUS (D) is an AAA protocol for network access, not identity federation.

Answer

LDAP

Answer

RADIUS

Question 15

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Accepted Answer

Authentication service (AS) logs with timestamps and IP addresses. Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.

Answer

Password hash history

Answer

Ticket-Granting Ticket (TGT) expiration time

Answer

Service ticket session keys

Question 16

A security engineer is designing a federated identity solution for cross-domain authentication. Which THREE of the following technologies are commonly used?

Accepted Answer

OpenID Connect (OIDC). OpenID Connect (OIDC), SAML, and Active Directory forest trusts are all commonly used for federated identity and cross-domain authentication. OIDC is a modern identity layer on OAuth 2.0, SAML is an XML-based standard for exchanging authentication and authorization data, and AD forest trusts enable authentication across Windows domains.

Answer

Kerberos

Answer

Lightweight Directory Access Protocol (LDAP)

Question 17

A security administrator is reviewing access logs and notices that a user was able to access a file after only providing a username and password, even though the file contains highly sensitive data. The organization's policy requires that access to sensitive files be based on the user's job role and that users should not have direct control over permissions. Which access control model is most likely in use, and what is the primary weakness?

Accepted Answer

Role-based access control (RBAC); the weakness is that roles may be misconfigured or users assigned to overly permissive roles.. The policy requires access based on job role and prohibits users from controlling permissions, which aligns with role-based access control (RBAC). In RBAC, users are assigned to roles that carry permissions; if a user can access a sensitive file with just credentials, it indicates their role has excessive privileges or the file is misclassified. The primary weakness is role misconfiguration or improper role assignments, making RBAC the model in use.

Answer

Mandatory access control (MAC); the weakness is that labels are not enforced.

Answer

Discretionary access control (DAC); the weakness is that users can grant access to others.

Answer

Attribute-based access control (ABAC); the weakness is that policies are too complex to evaluate correctly.

Question 18

A security administrator is designing an attribute-based access control (ABAC) policy for a cloud environment. The policy must evaluate multiple types of attributes to make access decisions. Which TWO of the following are categories of attributes that ABAC typically evaluates? (Choose two.)

Accepted Answer

Object attributes. ABAC policies typically evaluate attributes from four categories: subject, object, action, and environment. The two most fundamental and commonly cited categories are subject attributes (who is requesting) and object attributes (what is being accessed). These are essential for building any ABAC policy. While action and environmental attributes are also used, the question specifically asks for two categories, and subject and object are the core ones.

Answer

Network topology attributes

Answer

Environmental attributes

Answer

Action attributes

Question 19

An administrator is configuring a Linux server and wants file access to be governed by the permissions of the directory in which the file resides, rather than by the file's own permission bits. Which permission should the administrator apply to the directory to achieve this behavior?

Accepted Answer

The default ACL inheritance on the directory. Access control lists extend the traditional owner-group-other permission model. When a default ACL is set on a directory, new files and subdirectories created inside it receive those access control entries automatically, so the directory's defined permissions influence how the files can be accessed. This is the mechanism that makes directory-level rules govern file access, which the sticky, setgid, and setuid bits do not provide.

Answer

The sticky bit

Answer

The setuid bit

Answer

The setgid bit

Question 20

A financial services firm runs a quarterly access review. The security team discovers that a payroll administrator can also approve vendor invoices in the ERP system, and that the same individual can modify their own expense reimbursements. The CISO asks which access control principle is being violated so it can be documented as a finding.

Accepted Answer

Separation of duties. The core issue is that a single identity can both approve vendor invoices and modify its own reimbursements, which is the classic definition of an incompatible duty combination. Separation of duties exists precisely to require two or more people to complete such transactions, reducing fraud risk and enabling detection. Framing the finding this way points remediation toward role redesign and compensating review controls rather than password or permission tuning.

Answer

Implicit deny

Answer

Least privilege

Answer

Mandatory access control