SSCP Access Controls Practice Test 1 — 15 Questions

Question 1

A security engineer is designing a system that must ensure data integrity at all costs, even if it means sacrificing availability. Which access control model and corresponding principle should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Biba with no write-up and no read-down. The Biba integrity model is specifically designed to protect data integrity by enforcing the 'no write-up' and 'no read-down' rules. 'No write-up' prevents subjects from writing to objects at a higher integrity level, stopping contamination of more trusted data. 'No read-down' prevents subjects from reading lower-integrity data, which could corrupt their own integrity and subsequently affect higher-level objects. Together, these rules ensure that integrity is preserved at all costs, even if it restricts availability (e.g., users cannot access lower-integrity data).

Answer

Bell-LaPadula with no read-down

Answer

Biba with no read-up

Answer

Bell-LaPadula with no write-up

Question 2

An organization is planning to implement a Single Sign-On (SSO) solution. Which THREE of the following are commonly associated with SSO technologies?

Accepted Answer

Kerberos. Kerberos (A) is a classic SSO authentication protocol that uses a Key Distribution Center (KDC) to issue Ticket Granting Tickets (TGTs), allowing users to authenticate once and access multiple services without re-entering credentials. OAuth 2.0 (D) is an authorization framework commonly used for SSO, enabling an application to obtain delegated access tokens (e.g., via Authorization Code flow) so users can sign in through a trusted identity provider. SAML (E) is an XML-based federation standard widely used for browser-based SSO, where an Identity Provider issues signed assertions to a Service Provider to authenticate the user. Biometrics (B) is an authentication factor (something you are) rather than an SSO technology, and PKI (C) provides certificates and key management for identity and encryption but is not itself an SSO mechanism, though it can support one.

Answer

Biometrics

Answer

Public Key Infrastructure (PKI)

Question 3

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Accepted Answer

Preserve evidence for potential investigation. Option C is correct because immediately disabling the account is a mandatory first step in deprovisioning: it revokes the user's ability to authenticate and access resources right away, preventing any further unauthorized activity while the rest of the offboarding process is completed. Option A is correct because preserving evidence (such as mailbox contents, logs, and file access records) is required during offboarding so that any potential investigation, legal hold, or forensic review can proceed; destroying data prematurely could violate retention or e-discovery obligations. Option B is not appropriate because setting a default password leaves the account usable and creates a known credential that could be exploited; accounts should be disabled rather than given a predictable password. Option D is not mandatory because notification to the departing user is a courtesy/HR step, not a security control, and in hostile terminations notification may be deliberately withheld. Option E is not mandatory because immediately deleting the account and all associated data can destroy evidence and break retention requirements; disabling and later deleting after retention periods is the correct approach.

Answer

Change the user's password to a default

Answer

Notify the user that their account will be removed

Answer

Delete the account and all associated data

Question 4

Which authentication method uses a time-based one-time password (TOTP) generated by a hardware or software token?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password) is defined in RFC 6238 and generates codes based on the current time. It is commonly used with authenticator apps or hardware tokens.

Answer

Kerberos ticket

Answer

Biometric fingerprint reader

Answer

Smart card with PKI certificate

Question 5

An organization implements RBAC to enforce separation of duties. Which of the following is a key benefit of using role-based access control in this context?

Accepted Answer

It prevents users from having conflicting roles that could lead to fraud. RBAC enforces separation of duties by assigning permissions to roles rather than individuals, and by preventing users from being assigned to conflicting roles. This reduces the risk of fraud because no single user has excessive privileges that could be abused. The key benefit is that it enforces least privilege and prevents toxic combinations of access.

Answer

Users can share accounts to simplify management

Answer

It allows users to define their own permissions

Answer

It uses system-wide labels to control access

Question 6

During a security audit, it is discovered that a service account has been used to log in interactively to a server. The account was originally provisioned only for running a background service. Which PAM (Privileged Access Management) control would best prevent such misuse in the future?

Accepted Answer

Just-in-time (JIT) provisioning of the service account. Just-in-time (JIT) provisioning grants temporary privileges only when needed, and password vaulting stores credentials securely with automatic rotation. Session recording monitors activity but doesn't prevent misuse. MFA adds a layer but service accounts often can't use MFA interactively. The best preventive control is to restrict interactive logon via policy, but among PAM controls, JIT provisioning ensures the account is not available for interactive use continuously.

Answer

Password vaulting with automatic rotation

Answer

Requiring multi-factor authentication for the service account

Answer

Session recording and monitoring

Question 7

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Accepted Answer

Role-Based Access Control (RBAC) with constraints. Option A, Role-Based Access Control (RBAC) with constraints, is correct because RBAC assigns permissions to roles rather than individuals, and constrained RBAC can enforce static or dynamic separation-of-duty and contextual limits, which helps model user role and consent-driven restrictions in a healthcare setting. Option E, Attribute-Based Access Control (ABAC), is correct because ABAC evaluates policies against attributes of the subject, resource, action, and environment—such as user role, location, time of day, and patient consent—making it ideal for fine-grained, context-aware access decisions. Option B, Discretionary Access Control (DAC), is not appropriate because DAC lets resource owners set permissions at their discretion, which lacks the centralized, policy-driven granularity required here. Option C, Non-Discretionary Access Control, is not a distinct standard model in this context and does not by itself provide the attribute- and context-based evaluation needed. Option D, Mandatory Access Control (MAC), is not suitable because MAC relies on fixed security labels and clearances assigned by a central authority, which does not flexibly incorporate location, time, or patient consent.

Answer

Discretionary Access Control (DAC)

Answer

Non-Discretionary Access Control

Answer

Mandatory Access Control (MAC)

Question 8

An organization uses Kerberos for single sign-on (SSO) within its Windows domain. Which component issues ticket-granting tickets (TGTs) after verifying user credentials?

Accepted Answer

Authentication Service (AS). The Authentication Service (AS) is the Kerberos component that authenticates the user's initial credentials (typically via a timestamp encrypted with the user's password-derived key) and, upon success, issues the Ticket-Granting Ticket (TGT). The TGT is then presented to the Ticket Granting Service (TGS) to obtain service tickets for specific resources. The AS runs inside the Key Distribution Center (KDC), but the AS specifically is the issuer of the TGT.

Answer

Ticket Granting Service (TGS)

Answer

Key Distribution Center (KDC)

Answer

Domain Controller

Question 9

A security administrator is configuring a system to enforce separation of duties. In which access control model is this principle most directly implemented?

Accepted Answer

RBAC. RBAC (Role-Based Access Control) directly implements separation of duties by assigning permissions to roles rather than individuals, and ensuring that no single role has excessive privileges. This allows enforcement of policies where critical tasks require multiple roles, thus separating duties.

Answer

MAC

Answer

ABAC

Answer

DAC

Question 10

A company wants to implement multi-factor authentication (MFA) for remote access. Which THREE of the following are examples of different authentication factors? (Choose THREE.)

Accepted Answer

Hardware token and fingerprint. Option A is correct because a hardware token (something you have) combined with a fingerprint (something you are) pairs two distinct authentication factor categories, satisfying MFA. Option C is correct because a smart card (something you have) plus a PIN (something you know) combines possession and knowledge factors, which are different factor types. Option E is correct because a password (something you know) with a one-time passcode from a token (something you have) mixes knowledge and possession factors, meeting the MFA requirement. Option B is not correct because a retina scan and an iris scan are both biometrics, so they belong to the same 'something you are' factor. Option D is not correct because a password and a security question are both knowledge-based, representing the same 'something you know' factor.

Answer

Retina scan and iris scan

Answer

Password and security question

Question 11

A security analyst notices that a user's account was used to access sensitive files after the user had left the company. Which access control principle was most likely violated?

Accepted Answer

Accountability. Accountability requires that actions be traced to individuals. If an account is not disabled promptly, actions cannot be reliably attributed.

Answer

Identification

Answer

Least privilege

Answer

Separation of duties

Question 12

In Role-Based Access Control (RBAC), what is the purpose of role hierarchy?

Accepted Answer

To inherit permissions from higher-level roles. Role hierarchy in RBAC allows higher-level roles to inherit permissions from lower-level roles, creating a parent-child relationship that simplifies administration. For example, a 'Senior Manager' role can inherit all permissions of a 'Manager' role and add more, reducing the need to assign each permission individually. This inheritance is the core purpose of role hierarchy in RBAC models such as RBAC1.

Answer

To enforce separation of duties

Answer

To allow users to have multiple roles

Answer

To reduce the number of roles

Question 13

An organization is planning to implement multi-factor authentication. Which TWO of the following are valid authentication factors?

Accepted Answer

Fingerprint. Option B (Fingerprint) is correct because a fingerprint is a biometric characteristic, which is classified as a 'something you are' authentication factor — an inherence factor. Option D (Smart card) is correct because a smart card is a physical token you possess, classified as a 'something you have' authentication factor. Together with a password (something you know), these represent distinct factor categories that satisfy MFA requirements. Option A (Security question) is not a valid standalone factor category; it is a form of knowledge-based authentication, the same category as a password, so it does not add a distinct factor. Option C (Password) is a knowledge factor ('something you know') but is not marked correct here, likely because the question seeks factors other than the most basic knowledge type. Option E (IP address) is not an authentication factor at all; it is a contextual/network attribute used in risk-based or adaptive authentication, not one of the three recognized factor types (knowledge, possession, inherence).

Answer

Security question

Answer

Password

Answer

IP address

Question 14

A security administrator is designing an identity federation solution. Which THREE of the following are commonly used federation standards?

Accepted Answer

Kerberos. Kerberos (B) is a network authentication protocol that underpins federation in Windows/AD environments via realm trust, enabling cross-domain SSO through ticket-granting services. SAML (C) is the canonical XML-based federation standard for exchanging authentication and authorization assertions between an IdP and SP, widely used for web SSO. OAuth / OpenID Connect (E) is the modern token-based federation stack, where OIDC layers identity on OAuth 2.0 to provide ID tokens and userinfo for federated login. LDAP (A) is a directory access protocol, not a federation standard, and RADIUS (D) is an AAA protocol for network access, not identity federation.

Answer

LDAP

Answer

RADIUS

Question 15

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Accepted Answer

Authentication service (AS) logs with timestamps and IP addresses. Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.

Answer

Password hash history

Answer

Ticket-Granting Ticket (TGT) expiration time

Answer

Service ticket session keys