SSCP Access Controls Practice Test 5 — 15 Questions

Question 1

Which access control model allows the owner of a resource to grant permissions to others?

Accepted Answer

Discretionary Access Control (DAC). DAC (Discretionary Access Control) allows the resource owner to decide who can access the resource and with what permissions.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 2

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Something you have (smart card) plus something you are (fingerprint) constitutes MFA using two different factors.

Answer

Password and security question

Answer

Smart card and PIN

Answer

Password and one-time passcode (OTP)

Question 3

In a Kerberos environment, what is the primary function of the Ticket Granting Ticket (TGT)?

Accepted Answer

To request service tickets from the Ticket Granting Service (TGS). The TGT is obtained after initial authentication and is used to request service tickets for various resources without re-authenticating.

Answer

To store the user's password hash securely

Answer

To provide a session key for encrypting communications

Answer

To authenticate the user to the Key Distribution Center (KDC)

Question 4

An organization implements a Privileged Access Management (PAM) solution. Which capability best describes granting temporary administrative rights just when needed?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning provides temporary elevated privileges that expire after use, reducing the attack surface.

Answer

Session recording

Answer

Password vaulting

Answer

Role mining

Question 5

What is the primary purpose of account deprovisioning?

Accepted Answer

To revoke access and disable accounts when no longer needed. Deprovisioning ensures that when an employee leaves or changes roles, access is removed promptly to prevent unauthorized use.

Answer

To create new user accounts

Answer

To audit user activity

Answer

To modify user roles

Question 6

In the Bell-LaPadula model, which property prevents a subject from reading an object at a higher classification level?

Accepted Answer

The Simple Security Property (no read up). The Simple Security Property (no read up) ensures subjects cannot access objects above their clearance level, protecting confidentiality.

Answer

The *-property (no write down)

Answer

The Discretionary Security Property

Answer

The Lattice Security Property

Question 7

An Identity Provider (IdP) sends an XML-based assertion to a Service Provider (SP) to grant access. Which federated identity standard is being used?

Accepted Answer

Security Assertion Markup Language (SAML). SAML uses XML assertions to exchange authentication and authorization data between an IdP and an SP.

Answer

OAuth 2.0

Answer

OpenID Connect (OIDC)

Answer

Kerberos

Question 8

A security analyst notices that a user's account was used to access sensitive files after the user had left the company. Which access control principle was most likely violated?

Accepted Answer

Accountability. Accountability requires that actions be traced to individuals. If an account is not disabled promptly, actions cannot be reliably attributed.

Answer

Identification

Answer

Least privilege

Answer

Separation of duties

Question 9

Which authentication method generates a one-time password that is valid for only a short time window?

Accepted Answer

Time-based One-Time Password (TOTP). Time-based One-Time Password (TOTP) uses the current time to generate a code that expires after a short interval (e.g., 30 seconds).

Answer

Biometric scan

Answer

HMAC-based One-Time Password (HOTP)

Answer

Static password

Question 10

In Role-Based Access Control (RBAC), what is the purpose of role hierarchy?

Accepted Answer

To inherit permissions from higher-level roles. Role hierarchy allows senior roles to inherit permissions from junior roles, simplifying permission management and reflecting organizational structure.

Answer

To enforce separation of duties

Answer

To allow users to have multiple roles

Answer

To reduce the number of roles

Question 11

An organization uses ABAC to control access to a document. Which attribute combination would be used to allow access only during business hours from a managed device?

Accepted Answer

User identity, time of day, and device compliance status. ABAC policies can combine subject (user), object (document), and environment (time, device management status) attributes to make access decisions.

Answer

User department and document creation date

Answer

User role and document classification

Answer

Document owner and file size

Question 12

What is the primary risk associated with service accounts in an enterprise?

Accepted Answer

They often have excessive privileges and infrequent password changes. Service accounts often have high privileges and are rarely changed, making them prime targets for attackers if compromised.

Answer

They are used by multiple users simultaneously

Answer

They are difficult to create

Answer

They are always tied to a specific user

Question 13

An organization is planning to implement multi-factor authentication. Which TWO of the following are valid authentication factors?

Accepted Answer

Fingerprint. The three categories are something you know, something you have, and something you are. Fingerprint (something you are) and smart card (something you have) are valid factors.

Answer

Security question

Answer

Password

Answer

IP address

Question 14

A security administrator is designing an identity federation solution. Which THREE of the following are commonly used federation standards?

Accepted Answer

Kerberos. SAML, OAuth/OIDC, and Kerberos (with extensions) are used for federation. LDAP is a directory protocol, not a federation standard.

Answer

LDAP

Answer

RADIUS

Question 15

During an access control audit, you find that a user has been assigned to two mutually exclusive roles. Which TWO principles are most likely violated?

Accepted Answer

Least privilege. Separation of duties is violated when a user has roles that could allow fraud; least privilege is violated if the user has more permissions than necessary.

Answer

Role hierarchy

Answer

Mandatory access control

Answer

Accountability