SSCP Access Controls Practice Test 6 — 15 Questions

Question 1

In the Bell-LaPadula model, which property prevents a subject from reading an object at a higher classification level?

Accepted Answer

The Simple Security Property (no read up). The Simple Security Property (also called the no-read-up rule) in the Bell-LaPadula model states that a subject at a given security level cannot read an object at a higher classification level. This prevents unauthorized disclosure of classified information and is the foundational confidentiality rule of the model.

Answer

The *-property (no write down)

Answer

The Discretionary Security Property

Answer

The Lattice Security Property

Question 2

An Identity Provider (IdP) sends an XML-based assertion to a Service Provider (SP) to grant access. Which federated identity standard is being used?

Accepted Answer

Security Assertion Markup Language (SAML). SAML (Security Assertion Markup Language) is the standard that uses XML-based assertions to exchange authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP). The IdP sends a SAML assertion to the SP to grant access, which is exactly the scenario described.

Answer

OAuth 2.0

Answer

OpenID Connect (OIDC)

Answer

Kerberos

Question 3

Which authentication method generates a one-time password that is valid for only a short time window?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password, RFC 6238) generates a one-time password derived from a shared secret and the current time step (typically 30 seconds), so the code is valid only within a short time window. This time-bound validity is exactly what the question describes.

Answer

Biometric scan

Answer

HMAC-based One-Time Password (HOTP)

Answer

Static password

Question 4

An organization uses ABAC to control access to a document. Which attribute combination would be used to allow access only during business hours from a managed device?

Accepted Answer

User identity, time of day, and device compliance status. ABAC (Attribute-Based Access Control) evaluates policies against attributes of the subject, resource, action, and environment. To allow access only during business hours from a managed device, the policy must combine a time-of-day environmental attribute with a device compliance attribute, plus the user identity to identify the subject. Option B lists exactly these three: user identity, time of day, and device compliance status.

Answer

User department and document creation date

Answer

User role and document classification

Answer

Document owner and file size

Question 5

What is the primary risk associated with service accounts in an enterprise?

Accepted Answer

They often have excessive privileges and infrequent password changes. Service accounts are non-human accounts used by applications, daemons, or scheduled tasks to run processes and access resources. Because they must operate without interactive logon, they are frequently granted broad privileges (e.g., domain admin, local system) to ensure the service functions correctly. Additionally, their passwords are often set once and never rotated, or are hard-coded in scripts, making them a prime target for credential theft and lateral movement. Thus, the primary risk is the combination of excessive privileges and infrequent password changes.

Answer

They are used by multiple users simultaneously

Answer

They are difficult to create

Answer

They are always tied to a specific user

Question 6

During an access control audit, you find that a user has been assigned to two mutually exclusive roles. Which TWO principles are most likely violated?

Accepted Answer

Least privilege. Option B (Least privilege) is correct because assigning a user to two mutually exclusive roles grants them more permissions than their job function requires, violating the principle that users should receive only the minimum access necessary to perform their duties. Option C (Separation of duties) is correct because mutually exclusive roles are specifically designed to prevent one person from holding conflicting responsibilities (e.g., initiating and approving a transaction), and assigning both to a single user directly defeats that control. Option A (Role hierarchy) is not necessarily violated, since a hierarchy merely organizes roles by inheritance and does not inherently prohibit holding two roles. Option D (Mandatory access control) is unrelated, as MAC relies on system-enforced labels and clearances rather than conflicting role assignments. Option E (Accountability) concerns traceability of actions to an individual, which is not directly breached by holding two mutually exclusive roles.

Answer

Role hierarchy

Answer

Mandatory access control

Answer

Accountability

Question 7

A security administrator is configuring a new system and wants to enforce a mandatory access control model to ensure confidentiality of classified data. Which access control model should the administrator implement?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model designed to enforce confidentiality using the 'no read up, no write down' rules (simple security property and *-property). It assigns security labels to subjects and objects and prevents lower-cleared subjects from reading higher-classified data, directly meeting the requirement to protect classified information.

Answer

Discretionary Access Control (DAC)

Answer

Biba

Answer

Role-Based Access Control (RBAC)

Question 8

An organization is implementing a privileged access management (PAM) solution. Which THREE of the following are common PAM capabilities?

Accepted Answer

Just-in-time (JIT) provisioning of privileged access. PAM includes password vaulting, session recording, and just-in-time provisioning to secure privileged accounts.

Answer

Single sign-on for all applications

Answer

Self-service password reset for end users

Question 9

A company is adopting a role-based access control (RBAC) model. Which TWO principles are fundamental to RBAC?

Accepted Answer

Roles can be organized in a hierarchy to inherit permissions. Option A is correct because RBAC supports role hierarchies, where a senior role (e.g., Manager) inherits the permissions of a junior role (e.g., Employee), which is a core RBAC capability for structuring permissions efficiently. Option B is correct because the defining characteristic of RBAC is assigning users to roles according to their job functions or responsibilities, and permissions are then granted to those roles rather than to individual users. Option C is incorrect because control by the data owner describes discretionary access control (DAC), not RBAC. Option D is incorrect because assigning permissions directly to users is the opposite of RBAC, which assigns permissions to roles. Option E is incorrect because access decisions based on subject and object attributes describe attribute-based access control (ABAC), not RBAC.

Answer

Access is controlled by the data owner

Answer

Permissions are assigned directly to users

Answer

Access decisions are based on subject and object attributes

Question 10

An organization is implementing multi-factor authentication (MFA). Which TWO of the following are examples of something you have?

Accepted Answer

Smart card. Something you have includes physical tokens like smart cards and hardware tokens. Biometrics are something you are, and passwords are something you know.

Answer

Answer

Retina scan

Answer

Fingerprint

Question 11

A healthcare organization deploys a new electronic records system. Clinicians may access patient records only while assigned to the cardiology department, and access is automatically revoked when they rotate to oncology. Which access control model best supports this requirement?

Accepted Answer

Role-based access control (RBAC). The requirement ties access to a clinician's current department and revokes it upon rotation, which is precisely how role-based access control operates. Permissions are grouped into roles, and users receive access only through their assigned roles. When the cardiology role assignment is removed during rotation, access ends automatically, while the oncology role grants the appropriate new access. This makes RBAC the most natural and administratively efficient fit.

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Answer

Mandatory access control (MAC)

Question 12

A financial services firm wants to let customers authorize a third-party budgeting application to read their account transaction history without sharing their banking password. Which technology should the firm deploy?

Accepted Answer

OAuth 2.0. The scenario requires delegated authorization: a customer lets a third-party budgeting app read transaction history without revealing the banking password. OAuth 2.0 is built for this purpose, issuing scoped access tokens that the application presents to the resource server. The customer authenticates with the bank, approves specific scopes, and the app operates within those limits, so credentials are never shared and access can be revoked.

Answer

Remote Authentication Dial-In User Service (RADIUS)

Answer

Security Assertion Markup Language (SAML)

Answer

Kerberos

Question 13

A healthcare organization uses a mandatory access control (MAC) system to protect patient records. A nurse with a Secret clearance attempts to access a file classified as Top Secret. According to the Bell-LaPadula model, what will happen?

Accepted Answer

The access will be denied because the nurse's clearance is lower than the file's classification.. The Bell-LaPadula model is a mandatory access control model designed to protect confidentiality. Its no-read-up property states that a subject cannot read an object with a higher classification than the subject's clearance. Therefore, a nurse with Secret clearance cannot read a Top Secret file. The other options either misunderstand the need-to-know principle, incorrectly assume that an NDA or temporary upgrade can bypass the rule, or misstate the model's behavior.

Answer

The access will be allowed but the nurse will be required to sign an additional non-disclosure agreement.

Answer

The access will be denied because the nurse does not have Top Secret clearance, but the nurse can request a temporary upgrade.

Answer

The access will be allowed because the nurse has a legitimate need to know for patient care.

Question 14

A financial institution uses a RADIUS server for centralized authentication of its VPN users. A security administrator notices that authentication requests from a new VPN concentrator are being rejected, while requests from other devices work fine. The RADIUS server logs show that the shared secret does not match. What is the most likely cause?

Accepted Answer

The VPN concentrator is configured with the wrong shared secret.. RADIUS uses a shared secret between the client (VPN concentrator) and the server to authenticate and encrypt certain attributes. When the shared secret does not match, the server rejects requests from that client. The logs explicitly indicate a shared secret mismatch, so the most likely cause is that the new VPN concentrator has been configured with an incorrect shared secret. Other options would produce different symptoms or logs.

Answer

The RADIUS server's certificate has expired.

Answer

The user accounts are not configured with the correct password policy.

Answer

The VPN concentrator is not included in the RADIUS server's list of authorized clients.

Question 15

A security administrator is configuring a Linux server that hosts a shared project directory. The requirement is that new files created in the directory /projects/team must automatically inherit the group owner of the parent directory rather than the primary group of the user who created them. The administrator wants the setting to apply only to that directory. Which command should the administrator use?

Accepted Answer

chmod g+s /projects/team. The setgid bit on a directory is the standard Unix mechanism for ensuring that files and subdirectories created within it inherit the directory's group ownership. This is commonly used for shared project directories where collaboration among group members is required. Other options either alter permissions without affecting ownership, change only the directory's group, or set the sticky bit, which controls deletion rather than ownership inheritance.

Answer

chmod +t /projects/team

Answer

setfacl -d -m g:team:rwx /projects/team

Answer

chown :team /projects/team