SSCP Access Controls Practice Test 3 — 15 Questions

Question 1

Which access control model allows the owner of a resource to grant access permissions to other users?

Accepted Answer

DAC (Discretionary Access Control). In DAC (Discretionary Access Control), the resource owner has discretion over who can access the resource. This contrasts with MAC, where access is based on labels, and RBAC/ABAC, where access is based on roles or attributes.

Answer

RBAC (Role-Based Access Control)

Answer

MAC (Mandatory Access Control)

Answer

ABAC (Attribute-Based Access Control)

Question 2

A security administrator is configuring password policies to meet compliance. Which combination of settings provides the strongest protection against brute-force attacks?

Accepted Answer

Minimum 12 characters, complexity required, lockout after 5 attempts, history of 10. Longer passwords with complexity and account lockout significantly increase the time required for brute-force attacks, while history prevents reuse. Short expiry (e.g., 30 days) also helps, but length and lockout are most effective.

Answer

Minimum 10 characters, no complexity, lockout after 3 attempts, history of 1

Answer

Minimum 6 characters, complexity required, lockout after 10 attempts, history of 5

Answer

Minimum 8 characters, no complexity, no lockout, password history of 3

Question 3

In a Bell-LaPadula model implementation, a user with a Secret clearance attempts to read a document classified as Top Secret. Additionally, they try to write to a document classified as Unclassified. What are the results of these actions?

Accepted Answer

Read denied, write denied. Bell-LaPadula enforces *no read up* (simple security property) and *no write down* (*-property). Thus reading Top Secret is denied, and writing to Unclassified is also denied to prevent leakage.

Answer

Read denied, write allowed

Answer

Read allowed, write allowed

Answer

Read allowed, write denied

Question 4

Which authentication method uses a time-based one-time password (TOTP) generated by a hardware or software token?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password) is defined in RFC 6238 and generates codes based on the current time. It is commonly used with authenticator apps or hardware tokens.

Answer

Kerberos ticket

Answer

Biometric fingerprint reader

Answer

Smart card with PKI certificate

Question 5

An organization implements RBAC to enforce separation of duties. Which of the following is a key benefit of using role-based access control in this context?

Accepted Answer

It prevents users from having conflicting roles that could lead to fraud. RBAC naturally supports separation of duties by assigning permissions to roles and ensuring that conflicting roles (e.g., approving and executing payments) are not assigned to the same user. This reduces fraud risk.

Answer

Users can share accounts to simplify management

Answer

It allows users to define their own permissions

Answer

It uses system-wide labels to control access

Question 6

During a security audit, it is discovered that a service account has been used to log in interactively to a server. The account was originally provisioned only for running a background service. Which PAM (Privileged Access Management) control would best prevent such misuse in the future?

Accepted Answer

Just-in-time (JIT) provisioning of the service account. Just-in-time (JIT) provisioning grants temporary privileges only when needed, and password vaulting stores credentials securely with automatic rotation. Session recording monitors activity but doesn't prevent misuse. MFA adds a layer but service accounts often can't use MFA interactively. The best preventive control is to restrict interactive logon via policy, but among PAM controls, JIT provisioning ensures the account is not available for interactive use continuously.

Answer

Password vaulting with automatic rotation

Answer

Requiring multi-factor authentication for the service account

Answer

Session recording and monitoring

Question 7

Which of the following best describes the concept of accountability in access controls?

Accepted Answer

Users must be uniquely identified and their actions logged. Accountability ensures that actions can be traced back to a specific user, typically through logging and audit trails. This relies on identification and authentication to uniquely identify users.

Answer

Users must present multiple factors to gain access

Answer

The system must verify the user's identity before granting access

Answer

The resource owner can delegate access to others

Question 8

A biometric system has a high false rejection rate (FRR). Which of the following is a likely consequence?

Accepted Answer

Legitimate users may be denied access, leading to frustration. False rejection means legitimate users are denied access, causing inconvenience. This is often a trade-off when trying to lower false acceptance rate (FAR).

Answer

The system will require less frequent calibration

Answer

Unauthorized users are more likely to gain access

Answer

The system's crossover error rate (CER) will be very low

Question 9

In a federated identity environment using SAML, what is the role of the Identity Provider (IdP) when a user requests access to a service provider (SP)?

Accepted Answer

The IdP authenticates the user and issues a SAML assertion to the SP. The IdP authenticates the user and issues a SAML assertion containing identity attributes and authorization claims. The SP trusts this assertion to grant access without re-authenticating the user.

Answer

The IdP hosts the application and enforces access control policies

Answer

The IdP validates the user's OTP token

Answer

The IdP generates a Kerberos ticket for the user

Question 10

Which of the following is the correct order of the access control process?

Accepted Answer

Identification, authentication, authorization, accountability. The sequence is: identification (user claims identity), authentication (verifies claim), authorization (determines access rights), and accountability (tracks actions).

Answer

Identification, authorization, authentication, accountability

Answer

Authorization, authentication, identification, accountability

Answer

Authentication, identification, authorization, accountability

Question 11

An organization uses OAuth 2.0 for delegated access to a cloud storage API. A third-party application requests an access token to read user files. What is the primary purpose of the access token in OAuth?

Accepted Answer

To authorize the client to access the resource server on behalf of the user. The access token represents the authorized scope of access granted by the resource owner (user). It is used by the client to access the protected resource (e.g., API) without exposing user credentials.

Answer

To encrypt the user's data in transit

Answer

To store the user's credentials in the client application

Answer

To authenticate the user to the authorization server

Question 12

During a user offboarding process, the security team must ensure that the former employee's access is revoked immediately. However, the user's manager requests that the account remain active for a week to review files. What is the BEST practice?

Accepted Answer

Disable the account immediately and transfer ownership of files to the manager. Best practice is to disable the account immediately to prevent unauthorized access, then transfer ownership of necessary files to another user for review. Keeping the account active poses a security risk.

Answer

Change the account to a service account and keep it active

Answer

Keep the account active but change the password and share it with the manager

Answer

Leave the account as-is and monitor activity for the week

Question 13

A company is implementing single sign-on (SSO) for its internal applications. Which TWO of the following protocols are commonly used for SSO?

Accepted Answer

Kerberos. Kerberos and SAML are both widely used for SSO. Kerberos is common in Windows domains, while SAML is used for web-based federated SSO. LDAP is a directory protocol, OAuth is for authorization (though OIDC adds authentication), and RADIUS is for network access.

Answer

OAuth

Answer

LDAP

Answer

RADIUS

Question 14

An organization wants to implement separation of duties to reduce the risk of fraud. Which THREE of the following are common techniques used to enforce separation of duties?

Accepted Answer

Audit logging and monitoring of privileged actions. Separation of duties is enforced through role-based access control (assigning conflicting roles to different users), requiring dual authorization for critical actions, and audit logging for accountability. Password complexity and biometrics are authentication, not separation of duties.

Answer

Enforcing complex password policies

Answer

Using biometric authentication

Question 15

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Accepted Answer

Role-Based Access Control (RBAC) with constraints. ABAC (Attribute-Based Access Control) is designed for fine-grained policies using multiple attributes. RBAC can also be extended with constraints (e.g., time-of-day, location) to achieve similar results, though ABAC is more flexible. MAC is too rigid, DAC is too coarse, and non-discretionary is a broad term.

Answer

Discretionary Access Control (DAC)

Answer

Non-Discretionary Access Control

Answer

Mandatory Access Control (MAC)