SSCP Access Controls Practice Question

A security team is hardening a centralized authentication service and wants to reduce the risk of credential replay and lateral movement if a password is compromised. Which TWO of the following controls directly support this goal? (Choose two.)

⚠ Common exam trap

The trap here is treating password length or rotation as defenses against replay, when those controls only affect guessing and cracking difficulty, not the reuse of an already-valid credential.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Implement just-in-time privileged access with short-lived credentials

Reducing replay and lateral movement risk requires controls that make a stolen password insufficient on its own and that limit how long any credential remains usable. Multi-factor authentication forces an additional factor beyond the password, and just-in-time privileged access with short-lived credentials ensures captured secrets expire quickly. Together they directly counter replay and constrain an attacker's ability to move through the environment.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enforce a maximum password age of 60 days
Why it's wrong here
Forcing periodic password changes limits how long a stolen credential remains valid, but it does not prevent an attacker who has already captured a valid password from replaying it immediately. It also encourages weaker, predictable password patterns. This control addresses credential lifetime rather than replay or lateral movement, so it does not directly satisfy the stated goal.
✓
Implement just-in-time privileged access with short-lived credentials
Why this is correct
Just-in-time privileged access issues credentials only when needed and for a brief window, so a captured credential quickly becomes useless and cannot be replayed later. This shrinks the attack surface for lateral movement because standing privileges do not persist across the environment. It directly supports the goal of reducing replay risk and containing a compromised password.
✗
Increase the minimum password length to 16 characters
Why it's wrong here
Longer passwords raise the cost of offline cracking and brute-force guessing, which strengthens resistance to password guessing attacks. However, length does nothing to stop an attacker who already possesses a valid password from replaying it or using it to move laterally. This control improves password strength but does not directly address the scenario's replay and lateral movement concerns.
✗
Publish a quarterly security awareness newsletter
Why it's wrong here
Awareness communications can reduce risky user behavior over time, such as phishing susceptibility, but they provide no technical barrier to credential replay. An attacker with a valid password can still authenticate and pivot regardless of how well-informed users are. This is a supporting cultural control, not a direct technical mitigation for the stated goal.
✓
Require multi-factor authentication for all interactive logins
Why this is correct
Requiring multi-factor authentication means a stolen password alone is insufficient to authenticate, because the attacker also needs the second factor. This directly blocks credential replay using only a compromised password and limits an attacker's ability to move laterally with harvested credentials. It is one of the two controls that most directly addresses the scenario's objective.

Go deeper

SSCP Access Controls Practice Question

Why each option matters

Option-by-option breakdown

Related to this question