SSCP Access Controls Practice Test 3 — 15 Questions

Question 1

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password history. The requirement that users cannot reuse any of the last 10 passwords is specifically addressing password history, which prevents users from cycling back to previous passwords. This element enforces a memory of past passwords to avoid reuse.

Answer

Password expiry

Answer

Password length

Answer

Password complexity

Question 2

A company is implementing an access control system for a high-security environment. Which TWO of the following are characteristics of Mandatory Access Control (MAC)?

Accepted Answer

Access rules are defined by the system, not users.. MAC uses labels for subjects and objects, and access decisions are based on clearance and classification. Users cannot change permissions.

Answer

Permissions are assigned to roles.

Answer

Users can grant access to other users.

Answer

Access is based on the owner's discretion.

Question 3

A security administrator is implementing an access control system that uses sensitivity labels on subjects and objects. The policy dictates that a subject can only read objects with a label equal to or lower than the subject's clearance, and can only write to objects with a label equal to or higher than the subject's clearance. Which access control model and principle is being enforced?

Accepted Answer

MAC with Bell-LaPadula model. The Bell-LaPadula model is a mandatory access control (MAC) model focused on confidentiality. Its two core rules are the Simple Security Property (no read up: a subject can only read objects at or below its clearance) and the Star Property (no write down: a subject can only write to objects at or above its clearance). The scenario describes exactly these two rules, so MAC with Bell-LaPadula is the correct answer.

Answer

MAC with Biba model

Answer

DAC with owner-based permissions

Answer

RBAC with role hierarchy

Question 4

An organization uses Kerberos for SSO. A user reports that after entering their password, they receive a 'ticket expired' error when trying to access a network share. The system administrator checks the Kerberos configuration. Which ticket is most likely expired?

Accepted Answer

Ticket-Granting Ticket (TGT). The Ticket-Granting Ticket (TGT) has a limited lifetime (typically 8-10 hours). When it expires, the user must re-authenticate to get a new TGT.

Answer

Session key

Answer

Service ticket

Answer

Authentication Server (AS) reply

Question 5

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider, enabling single sign-on. It is specifically designed for federated identity scenarios where users authenticate with their corporate credentials to access partner cloud applications. The requirement for XML-based assertions directly points to SAML.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 6

Which term describes the process of verifying the identity of a user, system, or entity?

Accepted Answer

Authentication. Authentication is the process of verifying a claimed identity — typically by validating credentials such as passwords, biometrics, or tokens against stored data. It answers the question 'Are you who you say you are?' Identification is the prior step of claiming an identity, and authorization determines what that identity can do.

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 7

A company is implementing a biometric authentication system for physical access to a data center. The system must minimize false acceptances. Which metric is most directly related to false acceptance rate (FAR)?

Accepted Answer

Threshold setting. FAR is the rate at which an unauthorized person is incorrectly accepted. The threshold setting directly impacts FAR; a higher (more stringent) threshold reduces FAR but may increase FRR.

Answer

Crossover error rate (CER)

Answer

Equal error rate (EER)

Answer

False rejection rate (FRR)

Question 8

A security analyst is reviewing access controls for a database server. The database administrator has granted all users in the 'sales' role SELECT, INSERT, UPDATE, and DELETE permissions on the 'orders' table. Which access control principle is being violated?

Accepted Answer

Least privilege. Granting every user in the 'sales' role full SELECT, INSERT, UPDATE, and DELETE on the orders table violates least privilege, which requires granting only the minimum permissions needed for each user's job function. Most sales users likely need only SELECT (or limited INSERT), not DELETE or UPDATE. Broad role-wide grants exceed what any individual requires.

Answer

Accountability

Answer

Separation of duties

Answer

Need to know

Question 9

An organization uses an ABAC system to control access to documents. Policies are defined using attributes such as user department, document classification, and time of day. Which of the following is an example of an ABAC policy rule?

Accepted Answer

If user.department == 'HR' AND doc.classification == 'Confidential' AND time.business_hours == true then permit read.. ABAC (Attribute-Based Access Control) evaluates policies built from multiple attributes — user, resource, action, and environment — combined with Boolean logic. The rule 'user.department == HR AND doc.classification == Confidential AND time.business_hours == true then permit read' explicitly combines a subject attribute (department), a resource attribute (classification), and an environmental attribute (time of day), which is the defining characteristic of an ABAC policy. NIST SP 800-162 defines ABAC as evaluating attributes of the subject, object, operation, and environment to make access decisions.

Answer

The owner of a document can grant read access to any other user.

Answer

Users in the 'HR' role can read documents classified as 'Confidential'.

Answer

All users with security clearance 'Secret' can read documents labeled 'Secret'.

Question 10

Which of the following is a common method for implementing multi-factor authentication (MFA) using something you have and something you know?

Accepted Answer

Smart card and PIN. A smart card (something you have) combined with a PIN (something you know) satisfies the two-factor requirement using two distinct authentication factor categories. This is the classic possession-plus-knowledge MFA pairing and is widely deployed in PIV/CAC and physical access systems. The other options either use two factors from the same category or only one factor.

Answer

Fingerprint and retina scan

Answer

Password and security question

Answer

Username and password

Question 11

An IT administrator needs to deprovision a user who has been terminated. Which of the following actions should be performed first to ensure security?

Accepted Answer

Disable the user account. Immediately disabling the account prevents any further access. Evidence preservation can be done afterward, and deletion should be delayed until necessary.

Answer

Remove the user from all groups

Answer

Delete the user account

Answer

Change the user's password

Question 12

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) gives resource owners discretion to grant or deny access to others.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 13

A company implements a password policy requiring a minimum length of 12 characters, including uppercase, lowercase, digits, and special characters. Passwords must be changed every 90 days, and the last 10 passwords cannot be reused. After a brute-force attack, several accounts were compromised despite the policy. Which additional control would most effectively mitigate such attacks?

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a small number of failed attempts directly defeats brute-force attacks by halting the attack after a threshold, regardless of password complexity. Even a 12-character complex password can eventually be brute-forced given unlimited attempts; lockout removes that unlimited-attempt advantage. This is the most effective additional control because it targets the attack mechanism itself rather than the password's guessability.

Answer

Use a password blacklist

Answer

Increase minimum password length to 16 characters

Answer

Require password change every 30 days

Question 14

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

Controlling and monitoring access to privileged accounts. A Privileged Access Management (PAM) solution is specifically designed to secure, control, and monitor the use of privileged accounts (e.g., root, administrator, service accounts) that have elevated permissions. It provides features like credential vaulting, session recording, just-in-time access, and approval workflows to prevent misuse and detect malicious activity. Unlike general identity management, PAM focuses on the high-risk accounts that can alter system configurations, access sensitive data, or disrupt operations. Thus, controlling and monitoring access to privileged accounts is its primary purpose.

Answer

Managing user password resets

Answer

Implementing single sign-on for all applications

Answer

Enforcing password complexity policies

Question 15

A security architect is designing an access control system for a healthcare application. The system must ensure that a nurse can view patient records but cannot modify them, and that a doctor can both view and update records. Additionally, the system must prevent a single user from both ordering a medication and approving its administration. Which TWO access control principles are being applied? (Select TWO.)

Accepted Answer

Separation of duties. Least privilege ensures users have only the permissions needed (nurse view, doctor view/update). Separation of duties prevents a single user from performing conflicting actions (order and approve).

Answer

Discretionary access control

Answer

Need to know

Answer

Mandatory access control