SSCP Access Controls Practice Test 2 — 15 Questions

Question 1

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Accepted Answer

Preserve evidence for potential investigation. Immediate disabling prevents unauthorized access, and preserving evidence (logs, files) is essential for potential investigations. Deleting accounts immediately may hinder forensics, and notifying users is not required (they are leaving).

Answer

Change the user's password to a default

Answer

Notify the user that their account will be removed

Answer

Delete the account and all associated data

Question 2

A security administrator is implementing an access control system that uses sensitivity labels on subjects and objects. The policy dictates that a subject can only read objects with a label equal to or lower than the subject's clearance, and can only write to objects with a label equal to or higher than the subject's clearance. Which access control model and principle is being enforced?

Accepted Answer

MAC with Bell-LaPadula model. Bell-LaPadula model enforces confidentiality through the simple security property (no read up) and the *-property (no write down). The described rules match Bell-LaPadula's restrictions.

Answer

MAC with Biba model

Answer

DAC with owner-based permissions

Answer

RBAC with role hierarchy

Question 3

An organization uses Kerberos for SSO. A user reports that after entering their password, they receive a 'ticket expired' error when trying to access a network share. The system administrator checks the Kerberos configuration. Which ticket is most likely expired?

Accepted Answer

Ticket-Granting Ticket (TGT). The Ticket-Granting Ticket (TGT) has a limited lifetime (typically 8-10 hours). When it expires, the user must re-authenticate to get a new TGT.

Answer

Session key

Answer

Service ticket

Answer

Authentication Server (AS) reply

Question 4

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Accepted Answer

SAML. SAML uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 5

Which term describes the process of verifying the identity of a user, system, or entity?

Accepted Answer

Authentication. Authentication is the process of verifying that a claimed identity is valid, typically using factors like passwords, biometrics, or tokens.

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 6

A security analyst is reviewing access controls for a database server. The database administrator has granted all users in the 'sales' role SELECT, INSERT, UPDATE, and DELETE permissions on the 'orders' table. Which access control principle is being violated?

Accepted Answer

Least privilege. Least privilege means users should have only the minimum permissions necessary to perform their job. Sales staff likely need to read and perhaps insert orders, but not delete them.

Answer

Accountability

Answer

Separation of duties

Answer

Need to know

Question 7

An organization uses an ABAC system to control access to documents. Policies are defined using attributes such as user department, document classification, and time of day. Which of the following is an example of an ABAC policy rule?

Accepted Answer

If user.department == 'HR' AND doc.classification == 'Confidential' AND time.business_hours == true then permit read.. ABAC policies use conditions based on subject, object, and environment attributes. The rule combines department, classification, and time.

Answer

The owner of a document can grant read access to any other user.

Answer

Users in the 'HR' role can read documents classified as 'Confidential'.

Answer

All users with security clearance 'Secret' can read documents labeled 'Secret'.

Question 8

Which of the following is a common method for implementing multi-factor authentication (MFA) using something you have and something you know?

Accepted Answer

Smart card and PIN. A smart card (something you have) combined with a PIN (something you know) is a classic MFA implementation.

Answer

Fingerprint and retina scan

Answer

Password and security question

Answer

Username and password

Question 9

An IT administrator needs to deprovision a user who has been terminated. Which of the following actions should be performed first to ensure security?

Accepted Answer

Disable the user account. Immediately disabling the account prevents any further access. Evidence preservation can be done afterward, and deletion should be delayed until necessary.

Answer

Remove the user from all groups

Answer

Delete the user account

Answer

Change the user's password

Question 10

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) gives resource owners discretion to grant or deny access to others.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 11

A company implements a password policy requiring a minimum length of 12 characters, including uppercase, lowercase, digits, and special characters. Passwords must be changed every 90 days, and the last 10 passwords cannot be reused. After a brute-force attack, several accounts were compromised despite the policy. Which additional control would most effectively mitigate such attacks?

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a number of failed attempts prevents brute-force attacks by limiting the number of guesses an attacker can make.

Answer

Use a password blacklist

Answer

Increase minimum password length to 16 characters

Answer

Require password change every 30 days

Question 12

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

Controlling and monitoring access to privileged accounts. PAM solutions focus on securing, managing, and monitoring privileged accounts to reduce the risk of misuse.

Answer

Managing user password resets

Answer

Implementing single sign-on for all applications

Answer

Enforcing password complexity policies

Question 13

A security architect is designing an access control system for a healthcare application. The system must ensure that a nurse can view patient records but cannot modify them, and that a doctor can both view and update records. Additionally, the system must prevent a single user from both ordering a medication and approving its administration. Which TWO access control principles are being applied? (Select TWO.)

Accepted Answer

Separation of duties. Least privilege ensures users have only the permissions needed (nurse view, doctor view/update). Separation of duties prevents a single user from performing conflicting actions (order and approve).

Answer

Discretionary access control

Answer

Need to know

Answer

Mandatory access control

Question 14

A company is migrating to a cloud-based SaaS application and wants to implement federated identity. Users will authenticate using their existing corporate Active Directory credentials. Which THREE components are essential for a SAML-based federation? (Select THREE.)

Accepted Answer

Identity Provider (IdP). SAML federation requires an Identity Provider (IdP), a Service Provider (SP), and trust between them. The IdP authenticates the user and sends an assertion to the SP via an HTTP redirect.

Answer

Ticket Granting Ticket (TGT)

Answer

Attribute Authority (AA)

Question 15

An organization is reviewing its account lifecycle management process. Which TWO activities are part of the provisioning phase? (Select TWO.)

Accepted Answer

Creating user accounts in the identity store. Provisioning involves creating accounts and assigning initial roles/permissions upon onboarding. Modifying roles is a change, not initial provisioning. Disabling is deprovisioning.

Answer

Modifying user roles due to job change

Answer

Archiving user data for compliance

Answer

Disabling accounts upon termination