SSCP Access Controls Practice Test 5 — 15 Questions

Question 1

In a biometric system, the point at which the false rejection rate (FRR) equals the false acceptance rate (FAR) is known as the:

Accepted Answer

Crossover error rate (CER). The crossover error rate (CER), also called the equal error rate (EER), is the point on the biometric operating curve where the false rejection rate equals the false acceptance rate. It is the standard metric for comparing the accuracy of different biometric systems — a lower CER indicates a more accurate system. The other options name individual rates or a different concept, not the crossover point.

Answer

False acceptance rate (FAR)

Answer

Failure to enroll rate

Answer

False rejection rate (FRR)

Question 2

Which access control model enforces security based on classification labels assigned to subjects and objects, commonly used for confidentiality?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is a mandatory access control (MAC) model designed for confidentiality. It enforces the 'no read up, no write down' rules: a subject cannot read an object at a higher classification level, and cannot write to an object at a lower level. This prevents unauthorized disclosure of classified information and is widely used in government and military systems.

Answer

Clark-Wilson

Answer

Brewer-Nash

Answer

Biba

Question 3

An organization uses smart cards with PKI certificates for authentication. Users must insert the card and enter a PIN. This is an example of which authentication method?

Accepted Answer

Two-factor authentication. Two-factor authentication requires two different categories of authentication factors. The smart card (something you have) plus the PIN (something you know) combine two distinct factor types, so this is two-factor authentication. The certificate on the card provides cryptographic proof of possession, while the PIN unlocks the card and proves knowledge.

Answer

Three-factor authentication

Answer

Single-factor authentication

Answer

Biometric authentication

Question 4

Which federated identity protocol uses XML-based assertions and provides single sign-on across different security domains?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based federated identity protocol that uses assertions to convey authentication and authorization information between identity providers and service providers. It enables single sign-on across different security domains by allowing a user authenticated at one domain to access resources in another without re-authenticating.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 5

What is the primary purpose of account deprovisioning in the account lifecycle?

Accepted Answer

To immediately disable accounts and preserve evidence. Deprovisioning is the formal process of removing a user's access when they leave or change roles. Its primary purpose is to immediately disable accounts to prevent unauthorized access while preserving the account and associated data as evidence for audits, investigations, or legal holds.

Answer

To modify user roles and permissions

Answer

To enforce password policies

Answer

To create new user accounts

Question 6

An organization has implemented a PAM solution for managing privileged accounts. Which feature allows administrators to request temporary elevated access for a specific task?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning in a PAM solution grants elevated privileges only for the duration of a specific task and then automatically revokes them, which is exactly the 'temporary elevated access' described. It minimizes standing privileges and reduces the attack surface. Other PAM features like vaulting and session recording support security but do not provide on-demand, time-bound elevation.

Answer

Session recording

Answer

Password vaulting

Answer

Role-based access control

Question 7

In an OAuth 2.0 authorization flow, a client application receives an access token. This token is used to:

Accepted Answer

Authorize access to protected resources at the resource server. In OAuth 2.0, an access token is a credential that grants the client application delegated authorization to access specific protected resources on the resource server on behalf of the resource owner. It is presented to the resource server (typically as a Bearer token in the Authorization header) to prove the client has been authorized. The token does not authenticate the user to the authorization server, nor does it encrypt data — it authorizes API access.

Answer

Encrypt data between client and resource server

Answer

Identify the user across different applications

Answer

Authenticate the user to the authorization server

Question 8

A security analyst notices that a service account has been granted domain administrator privileges. Which principle of access control is being violated?

Accepted Answer

Least privilege. Granting a service account domain administrator privileges violates the principle of least privilege, which states that accounts should have only the minimum permissions necessary to perform their required tasks. A service account typically needs limited, specific permissions, not full domain admin rights. This over-provisioning increases the attack surface and risk.

Answer

Need-to-know

Answer

Separation of duties

Answer

Accountability

Question 9

An organization is designing an access control policy for a new system. Which THREE of the following are fundamental principles that should be incorporated? (Choose THREE.)

Accepted Answer

Least privilege. Option B (Least privilege) is correct because users and processes should be granted only the minimum access rights necessary to perform their assigned tasks, reducing the attack surface and limiting damage from compromised accounts. Option C (Need-to-know) is correct because access to specific information should be restricted to individuals who require it to fulfill their job responsibilities, which is a foundational access control principle closely tied to least privilege. Option D (Separation of duties) is correct because splitting critical tasks among multiple users prevents any single person from having enough control to commit fraud or cause significant harm without detection, a core principle in access control policy design. Option A (Fail-open) is not a fundamental access control principle; fail-open means a system defaults to allowing access when it fails, which is generally a security weakness rather than a policy principle. Option E (Defense in depth) is a valid security architecture concept involving layered controls, but it is not one of the three fundamental access control principles being asked for here.

Answer

Fail-open

Answer

Defense in depth

Question 10

Which TWO of the following are characteristics of the Biba integrity model? (Choose TWO.)

Accepted Answer

No write-up. Option A, 'No write-up,' is correct because the Biba integrity model's *-integrity axiom (the write-up rule) forbids a subject from writing to an object of higher integrity level, preventing low-integrity data from contaminating higher-integrity data. Option E, 'No read-down,' is correct because Biba's simple integrity axiom forbids a subject from reading an object of lower integrity level, preventing a high-integrity subject from being corrupted by low-integrity data. Option B, 'No write-down,' actually belongs to the Bell-LaPadula confidentiality model (the *-property), which restricts writing to lower or equal sensitivity levels, not to Biba. Option C, 'No read-up,' is also a Bell-LaPadula rule (the simple security property), prohibiting reading data at a higher classification, so it is not a Biba characteristic. Option D, 'Discretionary access,' describes discretionary access control (DAC) mechanisms such as owner-controlled ACLs, which are independent of the Biba mandatory integrity model and therefore not one of its defining characteristics.

Answer

No write-down

Answer

No read-up

Answer

Discretionary access

Question 11

Which access control model allows the owner of a resource to grant permissions to others?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is defined by the owner of an object having the discretion to grant or revoke access to other subjects, typically via ACLs on files or resources. This owner-controlled permission model is the defining characteristic of DAC, as opposed to MAC where the system enforces labels and RBAC where roles determine access.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 12

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. A smart card is a physical token the user possesses (something you have), and a fingerprint is a biometric trait inherent to the user (something you are). Combining them satisfies the requirement for two different MFA factor categories. This is a classic possession-plus-inherence pairing used in high-assurance environments.

Answer

Password and security question

Answer

Smart card and PIN

Answer

Password and one-time passcode (OTP)

Question 13

In a Kerberos environment, what is the primary function of the Ticket Granting Ticket (TGT)?

Accepted Answer

To request service tickets from the Ticket Granting Service (TGS). The TGT is obtained after initial authentication and is used to request service tickets for various resources without re-authenticating.

Answer

To store the user's password hash securely

Answer

To provide a session key for encrypting communications

Answer

To authenticate the user to the Key Distribution Center (KDC)

Question 14

An organization implements a Privileged Access Management (PAM) solution. Which capability best describes granting temporary administrative rights just when needed?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning grants elevated privileges only for the duration they are needed, then automatically revokes them. This directly matches the requirement of temporary administrative rights granted on demand. It reduces standing privilege and the window of exposure if credentials are compromised.

Answer

Session recording

Answer

Password vaulting

Answer

Role mining

Question 15

What is the primary purpose of account deprovisioning?

Accepted Answer

To revoke access and disable accounts when no longer needed. Account deprovisioning is the process of removing or disabling user accounts and revoking associated access rights when they are no longer required, such as when an employee leaves the organization or changes roles. The primary goal is to ensure that former users cannot access systems, data, or resources, thereby reducing the attack surface and preventing unauthorized access. This is a fundamental control in identity and access management (IAM) and is required by regulations like SOX, HIPAA, and PCI DSS.

Answer

To create new user accounts

Answer

To audit user activity

Answer

To modify user roles