SSCP Access Controls Practice Test 4 — 15 Questions

Question 1

A company is migrating to a cloud-based SaaS application and wants to implement federated identity. Users will authenticate using their existing corporate Active Directory credentials. Which THREE components are essential for a SAML-based federation? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity Provider (IdP). In a SAML-based federation, the Identity Provider (IdP) is essential because it is the entity that authenticates users against the corporate Active Directory and issues signed SAML assertions containing authentication and attribute statements (Option A). The Service Provider (SP) is equally essential as the SaaS application that consumes those SAML assertions to grant access, making it the relying party in the federation (Option E). A trust relationship between the IdP and SP is also required, since the SP must trust the IdP's signing certificate and the two parties exchange metadata (entityID, ACS URL, SSO URL, X.509 certificate) to validate assertions and establish the federation (Option B). Option C is incorrect because a Ticket Granting Ticket is a Kerberos construct issued by a Key Distribution Center, not a SAML federation component. Option D is incorrect because an Attribute Authority is a separate SAML role that issues attribute assertions and is not one of the three essential components for basic SAML federation between an IdP and SP.

Answer

Ticket Granting Ticket (TGT)

Answer

Attribute Authority (AA)

Question 2

An organization is reviewing its account lifecycle management process. Which TWO activities are part of the provisioning phase? (Select TWO.)

Accepted Answer

Creating user accounts in the identity store. Option A is correct because provisioning begins with creating the user account (identity) in the identity store, such as an LDAP directory or IdP, so the user has a unique identity to authenticate with. Option D is correct because provisioning also includes granting the initial entitlements — assigning the baseline role memberships and permissions the user needs on day one. Option B is not part of provisioning; modifying roles after a job change is a re-provisioning/change (mover) activity in the lifecycle. Option C is not part of provisioning; archiving user data for compliance belongs to the deprovisioning/retention phase. Option E is not part of provisioning; disabling accounts on termination is a deprovisioning (leaver) activity.

Answer

Modifying user roles due to job change

Answer

Archiving user data for compliance

Answer

Disabling accounts upon termination

Question 3

Which access control model allows the owner of a resource to grant access permissions to other users?

Accepted Answer

DAC (Discretionary Access Control). DAC (Discretionary Access Control) is defined by the resource owner having discretion to grant or revoke access to other subjects, typically via ACLs or Unix file permissions. The owner decides who gets access, which is the defining characteristic of discretionary control. This is contrasted with MAC, where the system enforces access based on labels and clearances, not owner choice.

Answer

RBAC (Role-Based Access Control)

Answer

MAC (Mandatory Access Control)

Answer

ABAC (Attribute-Based Access Control)

Question 4

A security administrator is configuring password policies to meet compliance. Which combination of settings provides the strongest protection against brute-force attacks?

Accepted Answer

Minimum 12 characters, complexity required, lockout after 5 attempts, history of 10. The strongest brute-force protection combines a long minimum length (12 characters), complexity requirements, a tight lockout threshold (5 attempts), and a deep password history (10) to prevent reuse. Length exponentially increases the search space, complexity widens the character set, lockout throttles online guessing, and history blocks cycling back to old passwords.

Answer

Minimum 10 characters, no complexity, lockout after 3 attempts, history of 1

Answer

Minimum 6 characters, complexity required, lockout after 10 attempts, history of 5

Answer

Minimum 8 characters, no complexity, no lockout, password history of 3

Question 5

In a Bell-LaPadula model implementation, a user with a Secret clearance attempts to read a document classified as Top Secret. Additionally, they try to write to a document classified as Unclassified. What are the results of these actions?

Accepted Answer

Read denied, write denied. Under Bell-LaPadula, the Simple Security Property (no read up) denies a Secret-cleared user from reading a Top Secret document. The *-Property (no write down) denies the same user from writing to an Unclassified document. Therefore, both the read and the write are denied.

Answer

Read denied, write allowed

Answer

Read allowed, write allowed

Answer

Read allowed, write denied

Question 6

Which of the following best describes the concept of accountability in access controls?

Accepted Answer

Users must be uniquely identified and their actions logged. Accountability in access control means that every action can be traced back to a uniquely identified individual, which requires both unique identification (no shared accounts) and logging of activity. This is what allows an organization to hold a specific person responsible for what was done with their credentials. It is distinct from authentication (proving identity) and authorization (what you're allowed to do).

Answer

Users must present multiple factors to gain access

Answer

The system must verify the user's identity before granting access

Answer

The resource owner can delegate access to others

Question 7

A biometric system has a high false rejection rate (FRR). Which of the following is a likely consequence?

Accepted Answer

Legitimate users may be denied access, leading to frustration. A high false rejection rate (FRR) means the biometric system incorrectly rejects legitimate users. This leads to frustration and potential productivity loss as authorized individuals are denied access. FRR is a key performance metric; a high FRR indicates the system is too strict.

Answer

The system will require less frequent calibration

Answer

Unauthorized users are more likely to gain access

Answer

The system's crossover error rate (CER) will be very low

Question 8

In a federated identity environment using SAML, what is the role of the Identity Provider (IdP) when a user requests access to a service provider (SP)?

Accepted Answer

The IdP authenticates the user and issues a SAML assertion to the SP. The IdP authenticates the user and issues a SAML assertion containing identity attributes and authorization claims. The SP trusts this assertion to grant access without re-authenticating the user.

Answer

The IdP hosts the application and enforces access control policies

Answer

The IdP validates the user's OTP token

Answer

The IdP generates a Kerberos ticket for the user

Question 9

Which of the following is the correct order of the access control process?

Accepted Answer

Identification, authentication, authorization, accountability. The access control process begins with identification, where a subject claims an identity (e.g., username). Next is authentication, verifying that identity (e.g., password). Then authorization determines what resources the authenticated subject can access. Finally, accountability involves logging and auditing actions to hold the subject responsible. This sequence is fundamental in security models.

Answer

Identification, authorization, authentication, accountability

Answer

Authorization, authentication, identification, accountability

Answer

Authentication, identification, authorization, accountability

Question 10

An organization uses OAuth 2.0 for delegated access to a cloud storage API. A third-party application requests an access token to read user files. What is the primary purpose of the access token in OAuth?

Accepted Answer

To authorize the client to access the resource server on behalf of the user. The access token represents the authorized scope of access granted by the resource owner (user). It is used by the client to access the protected resource (e.g., API) without exposing user credentials.

Answer

To encrypt the user's data in transit

Answer

To store the user's credentials in the client application

Answer

To authenticate the user to the authorization server

Question 11

During a user offboarding process, the security team must ensure that the former employee's access is revoked immediately. However, the user's manager requests that the account remain active for a week to review files. What is the BEST practice?

Accepted Answer

Disable the account immediately and transfer ownership of files to the manager. Best practice for offboarding is to disable the account immediately upon termination to eliminate the risk of unauthorized access, while preserving the account for audit and file-ownership purposes. File ownership and access to needed data should be transferred to the manager or another designated employee, satisfying the business need without keeping credentials live. This balances security with operational continuity.

Answer

Change the account to a service account and keep it active

Answer

Keep the account active but change the password and share it with the manager

Answer

Leave the account as-is and monitor activity for the week

Question 12

A company is implementing single sign-on (SSO) for its internal applications. Which TWO of the following protocols are commonly used for SSO?

Accepted Answer

Kerberos. Kerberos (A) is a network authentication protocol that uses ticket-granting tickets (TGTs) and service tickets issued by a Key Distribution Center (KDC), enabling transparent single sign-on within a Windows/Active Directory domain environment. SAML (E) is an XML-based federation standard in which an identity provider (IdP) issues signed assertions to a service provider (SP), which is the classic browser-based SSO mechanism for internal and cloud applications. OAuth (B) is an authorization delegation framework (access tokens for APIs), not an authentication/SSO protocol by itself, so it does not fit the SSO requirement here. LDAP (C) is a directory access protocol used to query and authenticate against a directory, but it does not provide cross-application SSO. RADIUS (D) is an AAA protocol for network access (VPN, Wi-Fi, 802.1X), not for application-level SSO.

Answer

OAuth

Answer

LDAP

Answer

RADIUS

Question 13

An organization wants to implement separation of duties to reduce the risk of fraud. Which THREE of the following are common techniques used to enforce separation of duties?

Accepted Answer

Audit logging and monitoring of privileged actions. Option A (audit logging and monitoring of privileged actions) is correct because separation of duties requires accountability: recording and reviewing who did what (e.g., via SIEM, Windows Event Log, or syslog) deters and detects fraud by ensuring no single actor can act unobserved. Option B (role-based access control with mutually exclusive roles) is correct because RBAC assigns permissions to roles rather than individuals, and defining mutually exclusive roles (e.g., a user cannot hold both 'accounts payable' and 'accounts receivable' roles) technically prevents one person from controlling an entire transaction lifecycle. Option E (requiring two or more people to approve a transaction) is correct because dual control / two-person integrity (also called the four-eyes principle) splits a critical action across multiple parties, so no single individual can authorize a fraudulent transaction alone. Option C (enforcing complex password policies) is not a separation-of-duties technique; it strengthens authentication against guessing/brute-force but does nothing to divide duties among people. Option D (using biometric authentication) is also not a separation-of-duties control; it improves identity assurance for a single user but does not prevent that user from holding conflicting responsibilities.

Answer

Enforcing complex password policies

Answer

Using biometric authentication

Question 14

Which access control model allows the owner of a resource to determine who can access it and what privileges they have?

Accepted Answer

Discretionary Access Control (DAC). DAC (Discretionary Access Control) is defined by the resource owner having discretion over who can access the resource and what permissions they receive. In DAC systems, ownership is the basis for control — the owner can grant, revoke, or modify access rights at will, typically via ACLs. This owner-driven discretion is the defining characteristic that separates DAC from the other models.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 15

An organization implements a policy requiring passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 60 days. Which password policy elements are being enforced?

Accepted Answer

Length, complexity, and expiry. The policy specifies three elements: a minimum length of 12 characters (length), a requirement for uppercase, lowercase, digits, and special characters (complexity), and a 60-day change interval (expiry). Lockout and history are not mentioned in the policy, so they are not being enforced. The correct answer is length, complexity, and expiry.

Answer

Complexity, expiry, and lockout

Answer

Length, complexity, and history

Answer

Length, complexity, and lockout