SSCP Access Controls Practice Test 2 — 15 Questions

Question 1

A security engineer is designing a federated identity solution for cross-domain authentication. Which THREE of the following technologies are commonly used?

Accepted Answer

OpenID Connect (OIDC). OpenID Connect (OIDC), SAML, and Active Directory forest trusts are all commonly used for federated identity and cross-domain authentication. OIDC is a modern identity layer on OAuth 2.0, SAML is an XML-based standard for exchanging authentication and authorization data, and AD forest trusts enable authentication across Windows domains.

Answer

Kerberos

Answer

Lightweight Directory Access Protocol (LDAP)

Question 2

A security administrator is reviewing access logs and notices that a user was able to access a file after only providing a username and password, even though the file contains highly sensitive data. The organization's policy requires that access to sensitive files be based on the user's job role and that users should not have direct control over permissions. Which access control model is most likely in use, and what is the primary weakness?

Accepted Answer

Role-based access control (RBAC); the weakness is that roles may be misconfigured or users assigned to overly permissive roles.. The policy requires access based on job role and prohibits users from controlling permissions, which aligns with role-based access control (RBAC). In RBAC, users are assigned to roles that carry permissions; if a user can access a sensitive file with just credentials, it indicates their role has excessive privileges or the file is misclassified. The primary weakness is role misconfiguration or improper role assignments, making RBAC the model in use.

Answer

Mandatory access control (MAC); the weakness is that labels are not enforced.

Answer

Discretionary access control (DAC); the weakness is that users can grant access to others.

Answer

Attribute-based access control (ABAC); the weakness is that policies are too complex to evaluate correctly.

Question 3

A security administrator is designing an attribute-based access control (ABAC) policy for a cloud environment. The policy must evaluate multiple types of attributes to make access decisions. Which TWO of the following are categories of attributes that ABAC typically evaluates? (Choose two.)

Accepted Answer

Object attributes. ABAC policies typically evaluate attributes from four categories: subject, object, action, and environment. The two most fundamental and commonly cited categories are subject attributes (who is requesting) and object attributes (what is being accessed). These are essential for building any ABAC policy. While action and environmental attributes are also used, the question specifically asks for two categories, and subject and object are the core ones.

Answer

Network topology attributes

Answer

Environmental attributes

Answer

Action attributes

Question 4

An administrator is configuring a Linux server and wants file access to be governed by the permissions of the directory in which the file resides, rather than by the file's own permission bits. Which permission should the administrator apply to the directory to achieve this behavior?

Accepted Answer

The default ACL inheritance on the directory. Access control lists extend the traditional owner-group-other permission model. When a default ACL is set on a directory, new files and subdirectories created inside it receive those access control entries automatically, so the directory's defined permissions influence how the files can be accessed. This is the mechanism that makes directory-level rules govern file access, which the sticky, setgid, and setuid bits do not provide.

Answer

The sticky bit

Answer

The setuid bit

Answer

The setgid bit

Question 5

A financial services firm runs a quarterly access review. The security team discovers that a payroll administrator can also approve vendor invoices in the ERP system, and that the same individual can modify their own expense reimbursements. The CISO asks which access control principle is being violated so it can be documented as a finding.

Accepted Answer

Separation of duties. The core issue is that a single identity can both approve vendor invoices and modify its own reimbursements, which is the classic definition of an incompatible duty combination. Separation of duties exists precisely to require two or more people to complete such transactions, reducing fraud risk and enabling detection. Framing the finding this way points remediation toward role redesign and compensating review controls rather than password or permission tuning.

Answer

Implicit deny

Answer

Least privilege

Answer

Mandatory access control

Question 6

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the only model where access decisions are based on comparing the subject's security clearance with the object's classification label, as defined by a central authority. In MAC, the system enforces these labels and users cannot alter them, making it mandatory rather than discretionary. This matches the scenario of assigning permissions based on clearance and classification, which are core components of MAC (e.g., Bell-LaPadula or Biba models).

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 7

Which access control model enforces the principle of least privilege by granting permissions based on job functions and requires separation of duties?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) grants permissions based on job functions or roles, enforcing least privilege by giving users only the access their role requires. RBAC also supports separation of duties by ensuring no single role has excessive privileges, and by requiring multiple roles for sensitive operations. This matches the question's description precisely.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 8

An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?

Accepted Answer

Time-based One-Time Password (TOTP). A password combined with a one-time code generated by a mobile app is the textbook definition of Time-based One-Time Password (TOTP), where the code is derived from a shared secret and the current time (typically 30-second windows, per RFC 6238). This is a form of multi-factor authentication combining something you know (password) with something you have (the app/device).

Answer

Smart card

Answer

Hardware token

Answer

Biometrics

Question 9

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It uses XML assertions to convey user identity and attributes, making it the correct protocol for this scenario.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 10

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

Accepted Answer

Just-in-Time (JIT) provisioning with session recording. Just-in-Time (JIT) provisioning grants privileged access only when needed and for a limited time, and session recording captures all activities for audit. Together, they directly satisfy the requirement that privileged accounts are used only when needed and all activities are recorded. JIT eliminates standing privileges, reducing the attack surface, while session recording provides non-repudiation and forensic evidence.

Answer

Password vaulting

Answer

Role-based access control

Answer

Multi-factor authentication

Question 11

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

Accepted Answer

False Rejection Rate (FRR). The false rejection rate (FRR) is the metric that directly measures the proportion of legitimate users incorrectly rejected by a biometric system. A high number of false rejections is by definition a high FRR, so FRR is the metric most directly related to the reported issue. The other options describe different accuracy metrics or crossover points.

Answer

False Acceptance Rate (FAR)

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Question 12

A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?

Accepted Answer

Authentication. Authentication is the process of verifying a claimed identity — here, validating that the password provided matches the stored credential for 'jsmith'. Identification is the act of claiming an identity (e.g., entering a username), while authentication proves it. The question explicitly describes verification of the password, which is authentication.

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 13

An organization uses Kerberos for single sign-on. When a user logs in, they receive a Ticket Granting Ticket (TGT). What is the primary purpose of the TGT?

Accepted Answer

To obtain service tickets for accessing resources. The TGT is obtained from the Authentication Server (AS) and is used to request service tickets from the Ticket Granting Server (TGS) without re-entering credentials, enabling SSO.

Answer

To encrypt all network traffic

Answer

To provide a digital signature for emails

Answer

To authenticate the user to the network

Question 14

A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?

Accepted Answer

Attribute-Based Access Control (ABAC). ABAC is the correct answer because it evaluates access decisions dynamically using policy rules that combine attributes of the subject (user), the object (resource), and the environment (context such as time or location). This multi-attribute, policy-driven evaluation is the defining characteristic of ABAC, typically implemented via XACML or similar policy engines. MAC, DAC, and RBAC do not natively incorporate environmental or arbitrary resource attributes into their access decisions.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 15

In a federated identity scenario, a user authenticates to their home domain and accesses a resource in a partner domain. The partner domain trusts the authentication performed by the home domain. What is the home domain's role in this trust relationship?

Accepted Answer

Identity Provider (IdP). In a federated identity trust, the home domain that authenticates the user and issues the security token is the Identity Provider (IdP). The partner domain that consumes that assertion and grants access is the Relying Party (or Service Provider). The IdP is trusted because it vouches for the user's identity.

Answer

Relying Party

Answer

Service Provider (SP)

Answer

Kerberos Distribution Center (KDC)