SSCP Access Controls Practice Test 8 — 15 Questions

Question 1

A security administrator is designing an access control scheme for a research lab where data sensitivity varies widely and the organization wants the operating system itself to enforce access decisions based on labels, independent of user discretion. Which TWO of the following characteristics apply to mandatory access control (MAC)? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The operating system enforces access decisions through a reference monitor. MAC is defined by centralized assignment of labels and clearances and by OS-level enforcement through a reference monitor. Users cannot alter labels or grant access at their discretion, and access is not determined by role membership. These two traits together satisfy the lab's need for label-based decisions that the operating system enforces independently of user choice.

Answer

Access is granted based on the user's role within the organization rather than on labels

Answer

Users may change the classification label of files they own to share them more easily

Answer

Resource owners can grant access at their discretion to any user they choose

Question 2

A hospital wants clinicians to reach patient records from any ward workstation without signing in repeatedly, but it also wants a single authoritative source of identity so that disabling an employee in the human resources system immediately removes clinical access. The identity team proposes using the Lightweight Directory Access Protocol (LDAP) as that authoritative store. Which statement best describes what LDAP provides in this design?

Accepted Answer

LDAP is a hierarchical directory that can serve as the authoritative identity store and support authentication binds, but it does not by itself provide single sign-on or session management. The design needs an authoritative account repository plus a separate mechanism for cross-workstation session continuity. LDAP supplies the hierarchical directory and the bind operation that validates credentials, and disabling an account in that directory can take effect immediately. Single sign-on and session handling must come from an additional service, so the option that separates those responsibilities is the accurate description.

Answer

LDAP provides the ticket-granting service that lets users obtain service tickets for clinical applications

Answer

LDAP issues signed assertions that workstations present to each other to establish single sign-on sessions

Answer

LDAP synchronizes credentials to each workstation so that local validation removes the need for a central authority

Question 3

A company is implementing a new access control system and wants to ensure that users are granted only the minimum permissions necessary to perform their job functions. Which principle is being applied?

Accepted Answer

Least privilege. The principle of least privilege states that users should be given only the minimum access rights required to perform their job functions. This exactly matches the company's goal of granting minimum necessary permissions. The other options represent different security concepts: separation of duties divides tasks, need to know focuses on information access, and defense in depth layers controls.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 4

A security auditor is evaluating a company's implementation of mandatory access control (MAC) using a commercial trusted operating system. The auditor needs to verify that the MAC implementation correctly enforces the no read up and no write down rules for confidentiality. Which TWO of the following are essential characteristics the auditor should confirm? (Choose two.)

Accepted Answer

Subjects with a lower clearance cannot read objects with a higher classification.. The no read up rule prevents subjects from reading objects with higher classifications, and the no write down rule prevents subjects from writing to objects with lower classifications. These two rules are essential for enforcing confidentiality in MAC. The auditor must confirm that subjects with lower clearance cannot read higher-classified objects and that subjects with higher clearance cannot write to lower-classified objects.

Answer

Users can change the classification of objects they own.

Answer

Access decisions are based on the principle of least privilege.

Answer

The system enforces a strict need-to-know policy for all users.

Question 5

A small business wants to implement single sign-on so employees can authenticate once and reach several internal web applications without re-entering credentials. The applications support SAML 2.0. Which component issues the signed assertion that the applications consume to establish the user's identity?

Accepted Answer

The identity provider. SAML 2.0 separates the identity provider, which authenticates users and issues signed assertions, from the service provider, which consumes and trusts them. The business needs one authentication event to reach multiple applications, so the identity provider is the issuing component. Certificate authorities and browsers support the exchange but do not create assertions.

Answer

The user agent (browser)

Answer

The service provider

Answer

The certificate authority

Question 6

A small business owner wants to implement access control for a shared file server. The owner wants each department manager to be able to decide which of their employees can access specific folders, without involving the IT department for every change. Which access control model is most appropriate for this requirement?

Accepted Answer

Discretionary access control (DAC). Discretionary access control (DAC) lets resource owners decide who can access their resources, which directly supports the requirement for department managers to control access to their folders without IT involvement. MAC, RBAC, and ABAC are more centralized or policy-driven and do not offer this level of delegated, owner-controlled discretion.

Answer

Mandatory access control (MAC)

Answer

Attribute-based access control (ABAC)

Answer

Role-based access control (RBAC)

Question 7

A security team is hardening a centralized authentication service and wants to reduce the risk of credential replay and lateral movement if a password is compromised. Which TWO of the following controls directly support this goal? (Choose two.)

Accepted Answer

Implement just-in-time privileged access with short-lived credentials. Reducing replay and lateral movement risk requires controls that make a stolen password insufficient on its own and that limit how long any credential remains usable. Multi-factor authentication forces an additional factor beyond the password, and just-in-time privileged access with short-lived credentials ensures captured secrets expire quickly. Together they directly counter replay and constrain an attacker's ability to move through the environment.

Answer

Enforce a maximum password age of 60 days

Answer

Increase the minimum password length to 16 characters

Answer

Publish a quarterly security awareness newsletter

Question 8

A retail chain issues each cashier a badge containing a photograph and a scannable code. At the start of every shift, a supervisor visually compares the badge photograph to the person and scans the code into the point-of-sale terminal. Which two access control components are being combined in this process?

Accepted Answer

Identification by the badge code and authentication by the supervisor's visual comparison. The badge code is an assertion of who the cashier claims to be, and the supervisor's check that the face matches the photograph validates that assertion. Identification precedes authentication, and both precede the authorization decision the terminal makes about which functions the cashier may use.

Answer

Authorization by the badge code and accounting by the supervisor's visual comparison

Answer

Identification by the supervisor's visual comparison and authentication by the badge code

Answer

Authentication by the badge code and authorization by the supervisor's visual comparison

Question 9

A financial services firm is deploying a centralized access control server that will make authorization decisions for dozens of internal applications. The architects want the applications to query a single decision point instead of embedding their own permission logic. Which two characteristics should the chosen model exhibit? (Choose two.)

Accepted Answer

Authorization decisions are expressed as policy that can be updated centrally and take effect without redeploying applications. Centralized authorization requires a shared decision point that evaluates rich context and a policy store that can be changed without touching application code. Attribute-based access control delivers both by evaluating subject, object, and environmental attributes in a central engine, and by expressing rules as centrally managed policy rather than as logic embedded in each application.

Answer

Each application maintains its own copy of the permission tables so decisions can be made without network calls

Answer

Permissions are baked into each application's source code during development and released through the change management pipeline

Answer

The decision point grants access based solely on the user's job title stored in the human resources system

Question 10

A financial firm is designing access controls for a trading application. The firm wants to prevent any single employee from both initiating a large funds transfer and approving it, and it also wants to ensure that access rights are automatically revoked when an employee changes departments. Which combination of principles is the firm applying?

Accepted Answer

Separation of duties and role-based access control with lifecycle management. The requirement that one employee cannot both initiate and approve a transfer is the classic definition of separation of duties, which splits a sensitive process across multiple people. Automatically revoking or adjusting rights when an employee changes departments reflects role-based access control combined with lifecycle management, where access follows the current role rather than persisting indefinitely. Applying both principles together satisfies the firm's objectives.

Answer

Zero trust and continuous authentication

Answer

Defense in depth and mandatory access control

Answer

Least privilege and need to know

Question 11

A hospital uses a discretionary access control model on its file shares. A department head grants a colleague read access to a folder containing protected health information so they can cover a vacation. Months later an audit finds the access still active after the coverage ended. Which characteristic of discretionary access control most directly explains why this happened?

Accepted Answer

Resource owners can grant access at their own discretion, and no central authority automatically removes it.. Discretionary access control places grant authority with resource owners, which is flexible but creates lifecycle risk because nothing forces revocation when the original justification disappears. The stale protected health information access persisted until an audit surfaced it. Recognizing this characteristic explains why the hospital needs centralized entitlement review, time-bound access requests, and automated revocation rather than simply retraining the department head.

Answer

Permissions are derived from the user's job role rather than from individual grants.

Answer

Access decisions are enforced by system-wide labels that owners cannot override.

Answer

The system enforces a strict need-to-know policy using centralized administration.

Question 12

A defense contractor runs an air-gapped laboratory where removable media are used to move engineering data between isolated enclaves. Policy requires that a workstation be usable only when a specific approved removable device is inserted, and that the workstation become unusable the instant that device is removed. Which access control approach best enforces this behavior?

Accepted Answer

Implement a hardware token interlock that permits operation only while the approved device is physically engaged. The policy couples system availability to the physical presence of one approved object, which is a property of a hardware interlock rather than of any logical permission scheme. Interlocks act at the level of the machine itself, so the workstation cannot operate without the device and cannot continue operating after the device is removed, regardless of who is logged on.

Answer

Require multifactor authentication with a smart card before any user may log on to the workstation

Answer

Deploy a role-based policy that grants laboratory staff access to the enclave during working hours

Answer

Apply discretionary access control so that file owners may share engineering data only with vetted colleagues

Question 13

A security administrator is configuring a network access control deployment that must authenticate employee laptops before they receive an IP address on the corporate VLAN. The administrator wants to use the IEEE 802.1X framework. Which two components are required for this framework to function? (Choose two.)

Accepted Answer

An authenticator that controls the port until authentication succeeds. The framework defines three roles, and the question asks for the two that the administrator must supply beyond the endpoint itself: the authenticator, which enforces port state on the switch or access point, and the authentication server, which validates credentials and returns authorization attributes. Together they hold the laptop in a pre-authentication state until the decision is rendered, which is what prevents an unauthenticated device from obtaining a corporate address.

Answer

A certificate revocation list published by the endpoint vendor

Answer

A domain name system server that resolves the switch management address

Answer

A mandatory captive portal that collects user consent before authentication

Question 14

A retail company issues contactless smart cards to employees for physical entry to its data center. The security manager wants to ensure that a lost card cannot be used by someone who finds it, without adding a fingerprint reader at every door. Which access control enhancement best meets this requirement?

Accepted Answer

Require a personal identification number entered on the door keypad in addition to presenting the card. The requirement is to stop a finder from using a lost card, which calls for adding a second authentication factor tied to the person rather than the token. A personal identification number supplies that knowledge factor at low cost and without new biometric hardware at every door. Cryptography, expiration, and anti-passback all strengthen the credential system in different ways but none of them verifies who is presenting the card.

Answer

Increase the encryption key length used by the card's contactless interface

Answer

Enable anti-passback so the system rejects a card presented twice without an intervening exit

Answer

Shorten the card's validity period and require reissuance every quarter

Question 15

A software company wants outside contractors to reach a single internal source code repository without creating accounts in the company directory. The identity team proposes using the Security Assertion Markup Language so that contractors authenticate against their own employer's identity provider. Which statement describes the trust relationship that must exist for this to work?

Accepted Answer

The company's service provider must trust assertions signed by the contractor's identity provider.. Federated authentication succeeds only when the relying party trusts the assertions issued by the partner identity provider, typically established by exchanging metadata and trusting the provider's signing certificate. Once that trust exists, contractors authenticate at their own employer and the repository consumes the signed assertion, so no local accounts are needed. This design keeps user lifecycle management with the employer while giving the company a verifiable basis for granting access.

Answer

Both organizations must share a single directory database that is replicated between their networks.

Answer

The contractor's identity provider must create shadow accounts for each user in the company directory.

Answer

The repository must issue a client certificate to each contractor before any assertion is accepted.