SSCP Access Controls Practice Question
A security architect is designing an access control system for a healthcare application. The system must ensure that a nurse can view patient records but cannot modify them, and that a doctor can both view and update records. Additionally, the system must prevent a single user from both ordering a medication and approving its administration. Which TWO access control principles are being applied? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties
Least privilege ensures users have only the permissions needed (nurse view, doctor view/update). Separation of duties prevents a single user from performing conflicting actions (order and approve).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Discretionary access control
Why it's wrong here
DAC allows owners to set permissions, not described.
- ✓
Separation of duties
Why this is correct
Ordering and approving medications are separated to prevent fraud or error.
- ✗
Need to know
Why it's wrong here
Need to know restricts access to data based on necessity, but the scenario focuses on permissions for actions.
- ✗
Mandatory access control
Why it's wrong here
MAC uses labels, not described here.
- ✓
Least privilege
Why this is correct
Nurses are limited to view only, doctors have necessary permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During an access control audit, you find that a user has been assigned to two mutually exclusive roles. Which TWO principles are most likely violated?
hard- A.Role hierarchy
- ✓ B.Least privilege
- ✓ C.Separation of duties
- D.Mandatory access control
- E.Accountability
Why B: Separation of duties is violated when a user has roles that could allow fraud; least privilege is violated if the user has more permissions than necessary.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.