SSCP Access Controls Practice Test 4 — 15 Questions

Question 1

Which access control model allows the owner of a resource to determine who can access it and what privileges they have?

Accepted Answer

Discretionary Access Control (DAC). DAC (Discretionary Access Control) lets the owner control access permissions. Other models have different control mechanisms.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 2

An organization implements a policy requiring passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 60 days. Which password policy elements are being enforced?

Accepted Answer

Length, complexity, and expiry. The policy specifies length, complexity (character types), and expiry (change interval). History and lockout are not mentioned.

Answer

Complexity, expiry, and lockout

Answer

Length, complexity, and history

Answer

Length, complexity, and lockout

Question 3

In a biometric system, the point at which the false rejection rate (FRR) equals the false acceptance rate (FAR) is known as the:

Accepted Answer

Crossover error rate (CER). The crossover error rate (CER), also called the equal error rate (EER), is where FAR and FRR are equal, indicating overall accuracy.

Answer

False acceptance rate (FAR)

Answer

Failure to enroll rate

Answer

False rejection rate (FRR)

Question 4

An organization uses Kerberos for single sign-on (SSO) within its Windows domain. Which component issues ticket-granting tickets (TGTs) after verifying user credentials?

Accepted Answer

Authentication Service (AS). In Kerberos, the Authentication Service (AS) within the Key Distribution Center (KDC) authenticates users and issues TGTs. The Ticket Granting Service (TGS) issues service tickets later.

Answer

Ticket Granting Service (TGS)

Answer

Key Distribution Center (KDC)

Answer

Domain Controller

Question 5

Which access control model enforces security based on classification labels assigned to subjects and objects, commonly used for confidentiality?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is a MAC model that enforces confidentiality via labels, preventing read-up and write-down.

Answer

Clark-Wilson

Answer

Brewer-Nash

Answer

Biba

Question 6

A security administrator is configuring a system to enforce separation of duties. In which access control model is this principle most directly implemented?

Accepted Answer

RBAC. RBAC commonly enforces separation of duties by ensuring that conflicting roles are not assigned to the same user.

Answer

MAC

Answer

ABAC

Answer

DAC

Question 7

An organization uses smart cards with PKI certificates for authentication. Users must insert the card and enter a PIN. This is an example of which authentication method?

Accepted Answer

Two-factor authentication. Something you have (smart card) and something you know (PIN) constitute multi-factor authentication (MFA).

Answer

Three-factor authentication

Answer

Single-factor authentication

Answer

Biometric authentication

Question 8

Which federated identity protocol uses XML-based assertions and provides single sign-on across different security domains?

Accepted Answer

SAML. SAML uses XML assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 9

What is the primary purpose of account deprovisioning in the account lifecycle?

Accepted Answer

To immediately disable accounts and preserve evidence. Deprovisioning ensures that when an employee leaves, access is revoked immediately to prevent unauthorized use, and evidence is preserved for investigations.

Answer

To modify user roles and permissions

Answer

To enforce password policies

Answer

To create new user accounts

Question 10

An organization has implemented a PAM solution for managing privileged accounts. Which feature allows administrators to request temporary elevated access for a specific task?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning grants temporary privileges as needed, reducing the risk of standing privileges.

Answer

Session recording

Answer

Password vaulting

Answer

Role-based access control

Question 11

In an OAuth 2.0 authorization flow, a client application receives an access token. This token is used to:

Accepted Answer

Authorize access to protected resources at the resource server. The access token is sent to the resource server to authorize access to protected resources on behalf of the user.

Answer

Encrypt data between client and resource server

Answer

Identify the user across different applications

Answer

Authenticate the user to the authorization server

Question 12

A security analyst notices that a service account has been granted domain administrator privileges. Which principle of access control is being violated?

Accepted Answer

Least privilege. Least privilege means users and accounts should have only the minimum permissions necessary. Service accounts rarely need domain admin rights.

Answer

Need-to-know

Answer

Separation of duties

Answer

Accountability

Question 13

A company wants to implement multi-factor authentication (MFA) for remote access. Which THREE of the following are examples of different authentication factors? (Choose THREE.)

Accepted Answer

Hardware token and fingerprint. Multi-factor authentication requires two or more distinct factors from different categories: knowledge, possession, and inherence. Option A combines a hardware token (possession) and a fingerprint (inherence) - two different factors. Option C combines a smart card (possession) and a PIN (knowledge) - two different factors. Option E combines a password (knowledge) and a one-time passcode from a token (possession) - also two different factors. Options B and D each use factors from the same category: B uses two inherence factors, and D uses two knowledge factors. Therefore, the three correct answers are A, C, and E.

Answer

Retina scan and iris scan

Answer

Password and security question

Question 14

An organization is designing an access control policy for a new system. Which THREE of the following are fundamental principles that should be incorporated? (Choose THREE.)

Accepted Answer

Least privilege. Least privilege, separation of duties, and need-to-know are core access control principles. Defense in depth is a security strategy, not a principle of access control itself.

Answer

Fail-open

Answer

Defense in depth

Question 15

Which TWO of the following are characteristics of the Biba integrity model? (Choose TWO.)

Accepted Answer

No write-up. Biba is a MAC model for integrity with rules: no write-up (integrity levels) and no read-down (to prevent corruption).

Answer

No write-down

Answer

No read-up

Answer

Discretionary access