easyMultiple Choice
SSCP Practice Question: A system administrator needs to grant a temporary…
A system administrator needs to grant a temporary contractor access to a specific shared folder for two weeks. Which access control approach is most appropriate?
⚠ Common exam trap
Watch out — candidates often choose role-based access control (RBAC) as a best practice, but fail to recognize that creating a new role for a single temporary user is an anti-pattern that violates role-based design principles and does not inherently enforce time limits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a temporary user account with an expiration date and grant NTFS permissions
Creating a temporary user account with an expiration date directly addresses the need for time-limited access. Granting NTFS permissions on the specific shared folder provides granular, least-privilege access control. This approach ensures the account is automatically disabled after two weeks, reducing administrative overhead and security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new role with access to the folder and assign the contractor to that role
Why it's wrong here
Role creation suits permanent, reusable job functions, not a single two-week contractor grant; the role would persist after the engagement ends, leaving standing access. It is tempting because role-based access control scales cleanly when many users share identical, ongoing duties.
- ✓
Create a temporary user account with an expiration date and grant NTFS permissions
Why this is correct
A time-bound account with an expiration date enforces automatic revocation after two weeks, satisfying the temporary access constraint without manual cleanup. NTFS permissions then scope the contractor to the specific shared folder, applying least privilege. Together they deliver both automatic expiry and granular resource-level authorisation.
- ✗
Use mandatory access control (MAC) to enforce a security label for the contractor
Why it's wrong here
MAC enforces administrator-defined labels matched to clearance levels, so the contractor's label would need to match the folder's classification, and labels are not time-bound. It is tempting because MAC gives strict, centralised control in high-assurance environments such as government or military systems.
- ✗
Configure the folder with discretionary access control (DAC) and let the contractor request access
Why it's wrong here
DAC lets the folder owner set permissions, but it provides no automatic expiry, so the contractor's access would remain until manually revoked. It is tempting because DAC is the native permission model on most file systems and is adequate for routine, owner-managed sharing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.