SSCP Access Controls — 20 Questions

Question 1

A company is implementing a biometric authentication system for physical access to a data center. The system must minimize false acceptances. Which metric is most directly related to false acceptance rate (FAR)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threshold setting. FAR is the rate at which an unauthorized person is incorrectly accepted. The threshold setting directly impacts FAR; a higher (more stringent) threshold reduces FAR but may increase FRR.

Answer

Crossover error rate (CER)

Answer

Equal error rate (EER)

Answer

False rejection rate (FRR)

Question 2

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) uses labels for subjects (clearance) and objects (classification) to enforce access decisions, commonly used in government and military environments.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 3

Which access control model enforces the principle of least privilege by granting permissions based on job functions and requires separation of duties?

Accepted Answer

Role-Based Access Control (RBAC). RBAC assigns permissions to roles, and users are assigned to roles, enabling least privilege and separation of duties through role design.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 4

An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?

Accepted Answer

Time-based One-Time Password (TOTP). Time-based One-Time Password (TOTP) generates a temporary code that changes every 30-60 seconds, commonly used with mobile apps like Google Authenticator.

Answer

Smart card

Answer

Hardware token

Answer

Biometrics

Question 5

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 6

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

Accepted Answer

Just-in-Time (JIT) provisioning with session recording. Just-in-Time (JIT) provisioning grants temporary elevated privileges for specific tasks, reducing the attack surface. Session recording captures all actions for auditing.

Answer

Password vaulting

Answer

Role-based access control

Answer

Multi-factor authentication

Question 7

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

Accepted Answer

False Rejection Rate (FRR). False Rejection Rate (FRR) measures the likelihood that an authorized user is incorrectly denied access. A high FRR indicates many false rejections.

Answer

False Acceptance Rate (FAR)

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Question 8

A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?

Accepted Answer

Authentication. Authentication is the process of verifying the identity claimed by a user. Identification is the claim (e.g., username), and authentication is the verification (e.g., password).

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 9

An organization uses Kerberos for single sign-on. When a user logs in, they receive a Ticket Granting Ticket (TGT). What is the primary purpose of the TGT?

Accepted Answer

To obtain service tickets for accessing resources. The TGT is obtained from the Authentication Server (AS) and is used to request service tickets from the Ticket Granting Server (TGS) without re-entering credentials, enabling SSO.

Answer

To encrypt all network traffic

Answer

To provide a digital signature for emails

Answer

To authenticate the user to the network

Question 10

A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) uses policies that evaluate attributes of the subject, object, and environment to make access decisions, offering fine-grained and dynamic control.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 11

In a federated identity scenario, a user authenticates to their home domain and accesses a resource in a partner domain. The partner domain trusts the authentication performed by the home domain. What is the home domain's role in this trust relationship?

Accepted Answer

Identity Provider (IdP). In federated identity, the Identity Provider (IdP) is the home domain that authenticates the user and issues assertions. The Service Provider (SP) trusts the IdP's authentication.

Answer

Relying Party

Answer

Service Provider (SP)

Answer

Kerberos Distribution Center (KDC)

Question 12

A security engineer is designing a system that must ensure data integrity at all costs, even if it means sacrificing availability. Which access control model and corresponding principle should be applied?

Accepted Answer

Biba with no write-up and no read-down. Biba is a MAC model that focuses on integrity, preventing subjects from writing to higher integrity levels (no write-up) and preventing subjects from reading lower integrity levels (no read-down). This can impact availability.

Answer

Bell-LaPadula with no read-down

Answer

Biba with no read-up

Answer

Bell-LaPadula with no write-up

Question 13

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

Accepted Answer

Password history. Password history prevents users from reusing previous passwords, enforcing password uniqueness over time.

Answer

Password expiry

Answer

Password length

Answer

Password complexity

Question 14

A company is implementing an access control system for a high-security environment. Which TWO of the following are characteristics of Mandatory Access Control (MAC)?

Accepted Answer

Access rules are defined by the system, not users.. MAC uses labels for subjects and objects, and access decisions are based on clearance and classification. Users cannot change permissions.

Answer

Permissions are assigned to roles.

Answer

Users can grant access to other users.

Answer

Access is based on the owner's discretion.

Question 15

An organization is planning to implement a Single Sign-On (SSO) solution. Which THREE of the following are commonly associated with SSO technologies?

Accepted Answer

Kerberos. Kerberos uses tickets for SSO, SAML provides federated SSO with XML assertions, and OAuth 2.0 is an authorization framework often used for SSO. Biometrics and PKI are not SSO technologies themselves.

Answer

Biometrics

Answer

Public Key Infrastructure (PKI)

Question 16

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Accepted Answer

Preserve evidence for potential investigation. Immediate disabling prevents unauthorized access, and preserving evidence (logs, files) is essential for potential investigations. Deleting accounts immediately may hinder forensics, and notifying users is not required (they are leaving).

Answer

Change the user's password to a default

Answer

Notify the user that their account will be removed

Answer

Delete the account and all associated data

Question 17

A security administrator is implementing an access control system that uses sensitivity labels on subjects and objects. The policy dictates that a subject can only read objects with a label equal to or lower than the subject's clearance, and can only write to objects with a label equal to or higher than the subject's clearance. Which access control model and principle is being enforced?

Accepted Answer

MAC with Bell-LaPadula model. Bell-LaPadula model enforces confidentiality through the simple security property (no read up) and the *-property (no write down). The described rules match Bell-LaPadula's restrictions.

Answer

MAC with Biba model

Answer

DAC with owner-based permissions

Answer

RBAC with role hierarchy

Question 18

An organization uses Kerberos for SSO. A user reports that after entering their password, they receive a 'ticket expired' error when trying to access a network share. The system administrator checks the Kerberos configuration. Which ticket is most likely expired?

Accepted Answer

Ticket-Granting Ticket (TGT). The Ticket-Granting Ticket (TGT) has a limited lifetime (typically 8-10 hours). When it expires, the user must re-authenticate to get a new TGT.

Answer

Session key

Answer

Service ticket

Answer

Authentication Server (AS) reply

Question 19

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Accepted Answer

SAML. SAML uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 20

Which term describes the process of verifying the identity of a user, system, or entity?

Accepted Answer

Authentication. Authentication is the process of verifying that a claimed identity is valid, typically using factors like passwords, biometrics, or tokens.

Answer

Authorization

Answer

Identification

Answer

Accountability