SSCP Access Controls Practice Test 7 — 15 Questions

Question 1

A hospital is deploying a new electronic health records (EHR) system. The security team wants to ensure that access decisions are based on the user's assigned job function rather than on the user's identity or resource ownership. Which access control model best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is designed to assign permissions to roles, and users are then assigned to roles according to their job responsibilities. This directly satisfies the hospital's requirement that access be based on job function rather than individual identity or resource ownership. The other models either rely on ownership, labels, or global rules, which do not meet the stated need.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Rule-Based Access Control

Question 2

A company uses discretionary access control (DAC) for its file shares. A project manager creates a folder and wants to grant a team member read-only access. Which of the following best describes how access is determined in this model?

Accepted Answer

The project manager, as the owner of the folder, can set the permissions for the team member.. Discretionary access control (DAC) is characterized by the owner of the resource having the ability to determine who can access it and with what permissions. In this scenario, the project manager owns the folder and can grant read-only access to the team member. The other options describe characteristics of MAC, RBAC, or administrative approval processes, which are not inherent to DAC.

Answer

The team member must request access through a centralized approval workflow.

Answer

The team member's access is determined by their role in the organization.

Answer

The system administrator must assign a label to the folder and the user's clearance.

Question 3

A security administrator at a financial firm is configuring access control for a new document management system. The system must enforce access decisions based on the sensitivity labels of documents and the clearance levels of employees, and it must prevent users from delegating their access to others. Which access control model should the administrator implement?

Accepted Answer

Mandatory access control (MAC). Mandatory access control (MAC) is the only model that uses system-enforced labels for both subjects and objects, and it prohibits users from changing or delegating access. The scenario requires sensitivity labels, clearance levels, and no delegation, which are defining characteristics of MAC. DAC, RBAC, and ABAC do not provide these mandatory, non-delegable controls by default.

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Answer

Role-based access control (RBAC)

Question 4

A security team is reviewing access control models for a new document management system. The system must support discretionary sharing where document owners can grant access to other users, but it must also enforce a mandatory rule that any document labeled 'Confidential' cannot be accessed by users without a 'Confidential' clearance, regardless of owner intent. Which access control model best satisfies both requirements?

Accepted Answer

A hybrid approach combining DAC and MAC. The scenario requires both discretionary sharing by owners and mandatory enforcement of confidentiality labels. DAC provides the former but not the latter, while MAC provides the latter but not the former. A hybrid approach that layers MAC enforcement over DAC permissions meets both requirements simultaneously, which is why it is the correct choice.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 5

A security administrator is configuring access controls for a shared file server. The administrator wants to grant permissions based on the sensitivity labels of the files and the clearance levels of the users, ensuring that users cannot change these permissions. Which access control model should be implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the only model that enforces access using sensitivity labels on objects and clearances on subjects, with permissions managed centrally so users cannot change them. This precisely matches the administrator's requirement. The other models either rely on roles, owner discretion, or flexible attributes, none of which provide the same mandatory, label-based enforcement.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Question 6

A small business owner wants to implement access control for a shared folder on a Windows server. The owner wants to grant different permissions to individual employees based on their specific job duties, without creating groups. Which access control model is most appropriate?

Accepted Answer

Discretionary access control (DAC). Discretionary access control (DAC) is the model where the owner of a resource determines who can access it and with what permissions. In this scenario, the small business owner wants to grant individual permissions to employees based on their job duties without creating groups. DAC allows this flexibility. RBAC would require roles, MAC uses labels, and ABAC uses attributes, all of which are more complex or not aligned with the owner's direct control.

Answer

Attribute-based access control (ABAC)

Answer

Role-based access control (RBAC)

Answer

Mandatory access control (MAC)

Question 7

A security team is designing an access control system for a research facility. They need a model that supports fine-grained, dynamic access decisions based on user department, project assignment, time of day, and the sensitivity of the resource. The model must also allow policies to be expressed in a human-readable language and evaluated at runtime. Which access control model best fits these requirements?

Accepted Answer

Attribute-based access control (ABAC). Attribute-based access control (ABAC) is designed to evaluate multiple attributes—user, resource, and environmental—at runtime, enabling dynamic and fine-grained decisions. It supports policy languages such as XACML, which are human-readable. RBAC, MAC, and DAC do not offer this combination of dynamic attribute evaluation and expressive policy language, so ABAC is the correct choice.

Answer

Role-based access control (RBAC)

Answer

Mandatory access control (MAC)

Answer

Discretionary access control (DAC)

Question 8

A security analyst is reviewing authentication logs and notices that a user account was used to log in from two different geographic locations within a five-minute window. The organization uses a centralized RADIUS server for authentication. Which of the following should the analyst investigate FIRST to determine if this is a legitimate concurrent session or a compromise?

Accepted Answer

Check the RADIUS server's accounting logs for session start and stop records.. RADIUS accounting logs provide session start and stop records, including the network access server and assigned IP address. These details allow the analyst to verify whether two sessions were truly concurrent and from which locations. Other options relate to policy or authorization and do not provide session-specific evidence needed to investigate the suspicious logins.

Answer

Examine the firewall rules governing RADIUS traffic.

Answer

Check the user's group membership in Active Directory.

Answer

Review the user's password complexity policy.

Question 9

A financial institution uses a centralized authentication system. An auditor notes that when an employee is terminated, their access to several critical applications remains active for up to 24 hours because each application maintains its own local user database. Which of the following is the MOST effective control to reduce this window of exposure?

Accepted Answer

Deploy a centralized identity management system with automated provisioning and deprovisioning.. The core issue is that each application maintains its own user database, causing manual and delayed deprovisioning. A centralized identity management system with automated provisioning and deprovisioning solves this by integrating with applications and immediately disabling accounts upon termination. The other options do not address the root cause of decentralized, delayed account revocation.

Answer

Require employees to sign a security awareness policy acknowledging immediate termination of access.

Answer

Implement a mandatory password change every 30 days for all users.

Answer

Implement network access control (NAC) to restrict terminated employees' devices from connecting to the network.

Question 10

A healthcare organization must enforce access control based on a combination of the user's assigned department, the classification of the data being accessed, and the time of day. Users in the cardiology department may view patient records only during their scheduled shift, and only if the record belongs to a patient currently admitted to cardiology. Which access control model BEST supports these requirements?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control is designed for policy decisions that combine multiple characteristics of the user, the resource, and the environment. Department, data classification, shift time, and a patient's current admission status are all attributes that can be evaluated in a single rule, so access is granted only when every condition is satisfied. The other models rely on ownership, static labels, or roles that cannot express these dynamic, contextual constraints together.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 11

A hospital uses a MAC-based system where data labels carry classifications such as Restricted and Public, and user clearances are assigned by the security office. A nurse with a Secret-equivalent clearance attempts to read a patient record labeled with a higher classification. According to the Bell-LaPadula model, what should occur?

Accepted Answer

The read is denied because no-read-up prevents reading higher-classified data. Bell-LaPadula enforces confidentiality through the simple security property, which forbids a subject from reading an object at a higher classification than the subject's clearance. Since the nurse's clearance is below the record's label, the read is denied. Business need, logging, and encryption do not alter the mandatory clearance comparison that drives the access decision.

Answer

The read is permitted because the nurse is accessing the record over an encrypted channel

Answer

The read is allowed but only if the nurse first writes a justification to the audit log

Answer

The read is allowed because the nurse has a legitimate business need

Question 12

A security administrator is implementing a biometric access control system for a data center. The organization wants to minimize the chance that an unauthorized person is granted access, even if it means legitimate users occasionally have to retry. Which metric should the administrator tune to achieve this goal?

Accepted Answer

False Acceptance Rate (FAR). The goal is to minimize unauthorized access, which means reducing the False Acceptance Rate. Lowering FAR makes the system stricter, accepting fewer impostors, though it may increase false rejections. CER and EER represent balanced points and do not prioritize security, while FRR relates to rejecting legitimate users, which is not the primary concern here.

Answer

Crossover Error Rate (CER)

Answer

False Rejection Rate (FRR)

Answer

Equal Error Rate (EER)

Question 13

A small business wants employees to authenticate to the corporate VPN using a hardware token that generates a time-based one-time code in addition to their password. Which authentication factor category does the hardware token represent?

Accepted Answer

Something you have. Authentication factors fall into categories including knowledge, possession, inherence, and location. A hardware token that generates time-based one-time codes must be physically held by the user, making it a possession factor. Pairing it with a password, which is a knowledge factor, satisfies multi-factor authentication because two different categories are required, rather than two instances of the same category.

Answer

Something you are

Answer

Something you know

Answer

Somewhere you are

Question 14

A company deploys a RADIUS server for wireless 802.1X authentication. Users report that after a password change, their devices still authenticate successfully for several hours using cached credentials. Which RADIUS behavior most likely explains this?

Accepted Answer

The authenticator caches the successful authentication and continues to authorize the supplicant until reauthentication is triggered. In 802.1X, the authenticator keeps a supplicant in an authorized state after a successful RADIUS exchange and only reauthenticates at defined intervals or on session events. A password change does not tear down existing authorized sessions, so devices continue to work until reauthentication is forced. Transport protocol and local authentication do not explain the observed delay.

Answer

RADIUS encrypts only the password field and relies on a shared secret, so cached credentials are replayed

Answer

RADIUS uses UDP and therefore cannot immediately propagate a password change to the client

Answer

The wireless controller performs local authentication and never contacts the RADIUS server

Question 15

A security consultant is reviewing an organization's identity and access management (IAM) architecture. The organization wants to implement a system where users can authenticate once and access multiple independent systems without re-entering credentials, while also enabling centralized session termination. Which TWO of the following are appropriate components or protocols to meet these requirements? (Choose two.)

Accepted Answer

Security Assertion Markup Language (SAML). SAML and OpenID Connect are both federation protocols that enable single sign-on across independent systems. SAML uses XML assertions, while OIDC uses JSON Web Tokens and builds on OAuth 2.0. Both support centralized session management, allowing an identity provider to terminate sessions. OAuth 2.0 is for authorization, and RADIUS and LDAP are not designed for web-based SSO or centralized session termination.

Answer

OAuth 2.0

Answer

Remote Authentication Dial-In User Service (RADIUS)

Answer

Lightweight Directory Access Protocol (LDAP)