Access Controls

An organization uses smart cards with PKI certificates for authentication. Users must insert the card and enter a PIN. This is an example of which authentication method?

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

A company implements a password policy requiring a minimum length of 12 characters, including uppercase, lowercase, digits, and special characters. Passwords must be changed every 90 days, and the last 10 passwords cannot be reused. After a brute-force attack, several accounts were compromised despite the policy. Which additional control would most effectively mitigate such attacks?

An organization uses ABAC to control access to a document. Which attribute combination would be used to allow access only during business hours from a managed device?

An organization is implementing multi-factor authentication (MFA). Which TWO of the following are examples of something you have?

During an access control audit, you find that a user has been assigned to two mutually exclusive roles. Which TWO principles are most likely violated?

Which access control model allows the owner of a resource to grant permissions to others?

An organization uses an ABAC system to control access to documents. Policies are defined using attributes such as user department, document classification, and time of day. Which of the following is an example of an ABAC policy rule?

An organization is reviewing its account lifecycle management process. Which TWO activities are part of the provisioning phase? (Select TWO.)

In a Kerberos environment, what is the primary function of the Ticket Granting Ticket (TGT)?

A security analyst notices that a user's account was used to access sensitive files after the user had left the company. Which access control principle was most likely violated?

An organization implements RBAC to enforce separation of duties. Which of the following is a key benefit of using role-based access control in this context?

An organization uses OAuth 2.0 for delegated access to a cloud storage API. A third-party application requests an access token to read user files. What is the primary purpose of the access token in OAuth?

A company wants to implement multi-factor authentication (MFA) for remote access. Which THREE of the following are examples of different authentication factors? (Choose THREE.)

A security engineer is designing a federated identity solution for cross-domain authentication. Which THREE of the following technologies are commonly used?

A security administrator is configuring a system to enforce separation of duties. In which access control model is this principle most directly implemented?

A security analyst is reviewing access controls for a database server. The database administrator has granted all users in the 'sales' role SELECT, INSERT, UPDATE, and DELETE permissions on the 'orders' table. Which access control principle is being violated?

A biometric system has a high false rejection rate (FRR). Which of the following is a likely consequence?

During a security audit, it is discovered that a service account has been used to log in interactively to a server. The account was originally provisioned only for running a background service. Which PAM (Privileged Access Management) control would best prevent such misuse in the future?

Which term describes the process of verifying the identity of a user, system, or entity?

Which access control model enforces the principle of least privilege by granting permissions based on job functions and requires separation of duties?

A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?

Which of the following is a common method for implementing multi-factor authentication (MFA) using something you have and something you know?

In the Bell-LaPadula model, which property prevents a subject from reading an object at a higher classification level?

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

In an OAuth 2.0 authorization flow, a client application receives an access token. This token is used to:

In a biometric system, the point at which the false rejection rate (FRR) equals the false acceptance rate (FAR) is known as the:

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

Which access control model enforces security based on classification labels assigned to subjects and objects, commonly used for confidentiality?

In Role-Based Access Control (RBAC), what is the purpose of role hierarchy?

An organization implements a policy requiring passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 60 days. Which password policy elements are being enforced?

A security administrator is configuring password policies to meet compliance. Which combination of settings provides the strongest protection against brute-force attacks?

A security administrator is configuring a new system and wants to enforce a mandatory access control model to ensure confidentiality of classified data. Which access control model should the administrator implement?

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

What is the primary risk associated with service accounts in an enterprise?

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Which authentication method generates a one-time password that is valid for only a short time window?

In a Bell-LaPadula model implementation, a user with a Secret clearance attempts to read a document classified as Top Secret. Additionally, they try to write to a document classified as Unclassified. What are the results of these actions?

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Which access control model allows the owner of a resource to grant access permissions to other users?

What is the primary purpose of a Privileged Access Management (PAM) solution?

What is the primary purpose of account deprovisioning?

What is the primary purpose of account deprovisioning in the account lifecycle?

An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?

A security administrator is designing an identity federation solution. Which THREE of the following are commonly used federation standards?

A company is implementing single sign-on (SSO) for its internal applications. Which TWO of the following protocols are commonly used for SSO?

An organization wants to implement separation of duties to reduce the risk of fraud. Which THREE of the following are common techniques used to enforce separation of duties?

A security administrator is implementing an access control system that uses sensitivity labels on subjects and objects. The policy dictates that a subject can only read objects with a label equal to or lower than the subject's clearance, and can only write to objects with a label equal to or higher than the subject's clearance. Which access control model and principle is being enforced?

During a user offboarding process, the security team must ensure that the former employee's access is revoked immediately. However, the user's manager requests that the account remain active for a week to review files. What is the BEST practice?

A security engineer is designing a system that must ensure data integrity at all costs, even if it means sacrificing availability. Which access control model and corresponding principle should be applied?

Which TWO of the following are characteristics of the Biba integrity model? (Choose TWO.)

A company is adopting a role-based access control (RBAC) model. Which TWO principles are fundamental to RBAC?

An Identity Provider (IdP) sends an XML-based assertion to a Service Provider (SP) to grant access. Which federated identity standard is being used?

A company is migrating to a cloud-based SaaS application and wants to implement federated identity. Users will authenticate using their existing corporate Active Directory credentials. Which THREE components are essential for a SAML-based federation? (Select THREE.)

In a federated identity scenario, a user authenticates to their home domain and accesses a resource in a partner domain. The partner domain trusts the authentication performed by the home domain. What is the home domain's role in this trust relationship?

An organization uses Kerberos for single sign-on (SSO) within its Windows domain. Which component issues ticket-granting tickets (TGTs) after verifying user credentials?

An organization has implemented a PAM solution for managing privileged accounts. Which feature allows administrators to request temporary elevated access for a specific task?

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

An organization is planning to implement a Single Sign-On (SSO) solution. Which THREE of the following are commonly associated with SSO technologies?

An organization is planning to implement multi-factor authentication. Which TWO of the following are valid authentication factors?

An organization uses Kerberos for SSO. A user reports that after entering their password, they receive a 'ticket expired' error when trying to access a network share. The system administrator checks the Kerberos configuration. Which ticket is most likely expired?

A security analyst notices that a service account has been granted domain administrator privileges. Which principle of access control is being violated?

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?

Which of the following is the correct order of the access control process?

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

In a federated identity environment using SAML, what is the role of the Identity Provider (IdP) when a user requests access to a service provider (SP)?

An organization is designing an access control policy for a new system. Which THREE of the following are fundamental principles that should be incorporated? (Choose THREE.)

An IT administrator needs to deprovision a user who has been terminated. Which of the following actions should be performed first to ensure security?

An organization uses Kerberos for single sign-on. When a user logs in, they receive a Ticket Granting Ticket (TGT). What is the primary purpose of the TGT?

Which of the following best describes the concept of accountability in access controls?

Which authentication method uses a time-based one-time password (TOTP) generated by a hardware or software token?

A security architect is designing an access control system for a healthcare application. The system must ensure that a nurse can view patient records but cannot modify them, and that a doctor can both view and update records. Additionally, the system must prevent a single user from both ordering a medication and approving its administration. Which TWO access control principles are being applied? (Select TWO.)

An organization is implementing a privileged access management (PAM) solution. Which THREE of the following are common PAM capabilities?

Which access control model allows the owner of a resource to determine who can access it and what privileges they have?

A company is implementing an access control system for a high-security environment. Which TWO of the following are characteristics of Mandatory Access Control (MAC)?

An organization implements a Privileged Access Management (PAM) solution. Which capability best describes granting temporary administrative rights just when needed?

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Which federated identity protocol uses XML-based assertions and provides single sign-on across different security domains?