CCNA Access Controls Questions

The smart card holds a PKI certificate (something you have) while the PIN is something you know. Combining these two distinct factors satisfies two-factor authentication, unlike a single-factor method such as certificate-only or password-only verification.

SAML exchanges authentication and authorisation data as XML assertions between an identity provider and a service provider, exactly the flow described. Its assertion-based, XML-encoded token format is the defining characteristic distinguishing it from other SSO protocols.

Account lockout after five failed attempts halts repeated authentication guesses, so a brute-force attack cannot continue indefinitely against an account. Length and complexity rules alone do not stop sustained automated guessing, making lockout the control that directly mitigates this attack.

ABAC evaluates attributes of subjects, objects, and the environment to make access decisions. It can incorporate department, project, time of day, and resource sensitivity dynamically. Policies can be written in languages like XACML, which are human-readable. This model provides the fine-grained, runtime evaluation required, making it the best fit for the research facility's needs.

User identity, time of day, and device compliance status map directly onto ABAC's three attribute categories: subject, environmental, and resource/device. Time of day satisfies the business-hours constraint, while device compliance status enforces the managed-device requirement, so the policy evaluates all three conditions together before granting document access.

Setting the setgid bit on a directory causes new files and subdirectories created within it to inherit the directory's group ownership instead of the creator's primary group. This directly satisfies the requirement that files in /projects/team retain the team group. The command applies only to the specified directory and does not affect other paths, which matches the scoped requirement.

A smart card is a physical artefact issued to and held by the user, making it a possession factor. The embedded chip stores credentials or keys that the reader validates, so authentication depends on having the card rather than remembering a secret or presenting a biometric.

Holding two mutually exclusive roles grants access beyond what either role alone requires for the user's duties. Least privilege is violated because the accumulated permissions exceed the minimum necessary to perform the assigned job function.

A hybrid model allows owners to grant discretionary access while also enforcing mandatory label-based restrictions. This satisfies both the need for owner-controlled sharing and the requirement that Confidential documents remain inaccessible to users without proper clearance. No single traditional model provides both capabilities, so combining them is necessary.

Discretionary Access Control satisfies the stem's requirement because the resource owner holds discretion over permissions, typically via access control lists, and can pass that authority to other subjects. Unlike mandatory or role-based models, DAC permits owner-initiated delegation, directly matching the scenario where an owner grants permissions to others.

ABAC evaluates boolean rules combining multiple attributes of subject, resource, and environment. This rule matches user department, document classification, and time of day, then permits read, exactly the attribute-based evaluation model rather than role- or label-only checks.

Bell-LaPadula's simple security property, often called no-read-up, states that a subject cannot read an object with a classification higher than the subject's clearance. The nurse's clearance is lower than the record's label, so the read must be denied. This preserves confidentiality by preventing lower-cleared subjects from accessing more sensitive data, even when they have a legitimate operational reason to see it.

Provisioning covers creating and placing identities into the store, so account creation is a core provisioning activity. It precedes ongoing maintenance tasks such as permission updates, reviews and eventual deprovisioning, satisfying the lifecycle phase the stem asks about.

After initial authentication, the client presents its TGT to the Ticket Granting Service. The TGS validates that ticket and issues service tickets for specific resources, so the TGT acts as the credential enabling service ticket requests without re-entering credentials.

The authenticator is the network device, such as a switch or wireless access point, that blocks or permits traffic on the controlled port based on the outcome of authentication. Without it, there is no enforcement point to hold the laptop in an unauthenticated state before an IP address is assigned. It relays credentials between the supplicant and the authentication server, making it an essential element of the framework.

The access token is a credential issued to the client after the user grants authorisation, and the resource server validates it to permit scoped access on the user's behalf. It carries granted permissions rather than the user's password or identity credentials.

Granting every sales user full SELECT, INSERT, UPDATE and DELETE rights on orders exceeds what each user needs to perform their role. Least privilege requires only the minimum permissions necessary, so this blanket grant violates that principle as the stem describes.

SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider and service providers. It enables single sign-on across independent systems and supports centralized session management through the identity provider. When a user authenticates once, SAML assertions can be used to access multiple service providers, and terminating the session at the identity provider can invalidate access.

In SAML 2.0, the identity provider authenticates the user and issues a signed assertion containing authentication and attribute statements. The service provider trusts that signature and uses the assertion to establish a session. Since the business wants one authentication event to serve multiple applications, the identity provider is the component that generates the assertion the applications consume.

Least privilege is the principle that users should be granted only the minimum permissions necessary to perform their job functions. This directly matches the company's goal. By applying least privilege, the organization reduces the attack surface and limits potential damage from compromised accounts or insider threats.

A high false rejection rate means the system wrongly refuses genuine users whose biometrics fail to match the stored template. The consequence is denied access for authorised individuals, causing frustration and extra helpdesk load. This directly satisfies the stem's FRR constraint, since FRR measures valid-user rejections, not impostor acceptance.

Authentication establishes and verifies a claimed identity by validating credentials such as passwords, certificates or biometrics, directly satisfying the stem's requirement to verify a user, system or entity. It is distinct from authorisation, which grants access rights after identity is confirmed, and from identification, which merely presents an identity claim.

LDAP defines a directory information tree and operations such as bind, search, and modify, so it can hold accounts and validate credentials across the hospital. It is not a session or token service, so single sign-on across wards still requires an additional component such as Kerberos or a federation protocol layered on top of the directory.

RBAC assigns permissions to roles defined by job function rather than to individuals, so users receive only the access their duties require. Roles can also be structured to enforce separation of duties, satisfying both least privilege and the split-responsibility constraint in the stem.

ABAC evaluates policy rules against attributes of subject, object and environment, so access decisions dynamically reflect context rather than static role or label assignments. This directly satisfies the requirement to grant access based on user, resource and environmental attributes.

A smart card satisfies the "something you have" factor, while the PIN supplies "something you know". Combining a physical token with a memorised secret meets the stem's two-factor requirement, unlike single-factor or same-category pairings. This hardware-plus-knowledge pairing is a standard MFA implementation.

The Simple Security Property forbids a subject at a lower classification from reading an object at a higher level, the no read up rule. This directly prevents upward information flow, which is the specific restriction the question describes.

Presenting the badge code claims an identity, which is identification. The supervisor confirming that the person matches the photograph verifies that claim, which is authentication. Together they establish who the cashier is before the terminal grants any access, matching the two components the process combines.

A smart card is a physical token, satisfying the "something you have" factor, while a fingerprint is a biometric trait, satisfying "something you are". Combining these two distinct factor types delivers true multi-factor authentication for remote access, unlike two passwords or two possession factors.

Centralized policy authoring means a change to rules propagates to all protected applications through the shared decision point rather than through code releases. This satisfies the architectural intent directly: the firm gains consistent enforcement and can adjust entitlements quickly, with the applications remaining unaware of the underlying rule changes.

The access token is a credential presented to the resource server, which validates it and grants access to the protected resource. It authorises the request; it does not authenticate the user to the authorisation server or issue refresh tokens.

The crossover error rate is the threshold where false rejection rate and false acceptance rate intersect, giving a single comparable accuracy metric. A lower CER indicates a more accurate biometric system, useful when selecting between devices.

False Rejection Rate measures the proportion of legitimate users incorrectly denied access, which is exactly the high false-rejection symptom described. It is the biometric accuracy metric tied to Type I errors, unlike False Acceptance Rate, which covers impostors wrongly admitted.

Bell-LaPadula enforces confidentiality through mandatory access control, comparing classification labels on subjects and objects. Its no-read-up and no-write-down rules directly satisfy the stem's requirement for label-based enforcement, preventing lower-cleared subjects from accessing higher-classified data. This contrasts with integrity-focused models such as Biba, which reverse those rules.

The policy enforces three distinct controls: a 12-character minimum (length), mixed character categories (complexity), and a 60-day rotation (expiry). Option C names all three elements the stem describes, matching each stated requirement precisely without adding unrelated controls such as history or lockout.

RBAC assigns permissions to roles rather than individuals, so a clinician's cardiology role grants record access only while assigned to it. Rotating to oncology means the cardiology role assignment is removed and the oncology role takes over, automatically changing access. This matches the requirement that access be tied to department membership and revoked upon rotation without per-user intervention.

Combining something the employee has, the smart card, with something the employee knows, a personal identification number, means a found card alone is insufficient for entry. This satisfies the requirement without adding biometric hardware at each door, and it is a straightforward two-factor implementation for physical access. The card still provides the credential, while the number proves the presenter is the authorized holder.

Twelve-character minimum length with complexity raises brute-force search space, lockout after five attempts throttles online guessing, and history of ten blocks reuse of previously compromised passwords. Together these settings address brute-force and credential-reuse vectors more strongly than any shorter or lockout-free combination.

Bell-LaPadula enforces mandatory access control through no read up and no write down, preventing subjects from reading data above their clearance or leaking it to lower levels. This directly preserves confidentiality of classified data, unlike integrity-focused models such as Biba.

RBAC assigns permissions to roles, and users are assigned to roles based on their job functions. In the hospital scenario, this means access to EHR functions is determined by the user's role (e.g., physician, nurse, billing clerk), not by individual identity or ownership. This aligns exactly with the requirement that access decisions be based on job function.

Just-in-Time provisioning grants privileged rights only for the required window, then revokes them, satisfying the 'only when needed' constraint. Session recording captures all privileged activity for audit, meeting the recording requirement. Standing admin rights would fail both conditions.

Service accounts typically hold broad, long-lived credentials because they run automated processes, and their passwords are rarely rotated. This combination satisfies the stem's constraint: excessive privileges paired with infrequent password changes creates a prime target for lateral movement and credential abuse.

Separation of duties ensures that no single individual controls both initiating and approving a sensitive transaction, directly matching the transfer requirement. Pairing this with role-based access control and lifecycle management means rights are tied to roles and updated automatically when an employee changes departments, which satisfies the revocation requirement. Together these principles address both stated objectives.

A centralized identity management system can automate the provisioning and deprovisioning of accounts across all connected applications. When an employee is terminated, the system can immediately disable or delete their accounts in all integrated systems, eliminating the 24-hour delay caused by separate local databases. This directly addresses the root cause of the exposure.

TOTP derives the one-time password from a shared secret combined with the current time step, so each code is valid only within a short window before the counter advances. That time-bound derivation is what limits validity, unlike event-based or static methods.

In a Security Assertion Markup Language exchange, the relying party accepts authentication statements only if it trusts the issuing authority. The company's repository acts as the service provider, and the contractor's employer acts as the identity provider, so a configured trust with the provider's signing certificate is mandatory. Without that trust relationship, the repository would treat incoming assertions as untrusted and deny access regardless of the contractor's credentials.

Reading is blocked by the no-read-up property, since Secret clearance cannot access Top Secret data. Writing is blocked by the no-write-down property, which prevents a Secret subject from leaking information to an Unclassified object. Both Bell-LaPadula constraints are therefore satisfied, denying each action.

Mandatory Access Control enforces access decisions through system-assigned labels: each subject holds a clearance and each object a classification, and the operating system compares these to grant or deny access. Because users cannot alter labels or delegate permissions, this satisfies the stem's requirement that permissions derive from clearance and classification rather than owner discretion.

Discretionary Access Control lets the resource owner decide who receives permissions, satisfying the owner-grant constraint. Access rights are assigned at the owner's discretion via ACLs, unlike MAC or RBAC where policy or roles govern assignment.

FAR measures the likelihood that an unauthorized user is incorrectly accepted. By tuning the system to lower the FAR, the administrator reduces the chance of granting access to impostors. This aligns with the goal of minimizing unauthorized access, even at the cost of more frequent retries by legitimate users, which would increase the False Rejection Rate.

The Bell-LaPadula model enforces the no-read-up property: a subject cannot read an object with a higher sensitivity level. Since the nurse has Secret clearance and the file is Top Secret, the read is denied. This prevents unauthorized disclosure of classified information and is a core rule of MAC.

PAM vaults privileged credentials, brokers sessions and records activity, so administrative access is granted only when required and fully auditable. This directly satisfies the requirement to control and monitor privileged accounts, rather than merely authenticating ordinary users.

A hardware token that generates time-based one-time codes is a possession factor, meaning the user must physically hold the device to authenticate. Combined with a password, which is a knowledge factor, this creates true multi-factor authentication because it draws on two different categories. The possession factor is exactly what the token contributes in this VPN scenario.

Deprovisioning removes or disables identities and revokes their entitlements once employment or the business need ends, closing the standing access that could otherwise be abused. It is the lifecycle counterpart to provisioning, not a password or permission review.

Deprovisioning immediately disables or removes access rights when a user leaves or changes roles, and retaining the account data preserves audit evidence for investigations. This containment-first approach satisfies the lifecycle requirement to revoke access promptly while keeping records intact for forensic or compliance review.

TOTP generates a code from a shared secret and the current time, so the mobile app produces a fresh one-time code every 30 seconds. Combined with the password, this delivers the two distinct factors the stem requires, satisfying the multi-factor authentication constraint.

Kerberos provides ticket-based authentication within a trusted realm, issuing service tickets that let users access multiple internal applications without re-entering credentials. Its symmetric-key ticket exchange suits SSO for internal, domain-joined resources, satisfying the stem's requirement for a commonly used SSO protocol.

Logging and monitoring privileged actions creates accountability and detects abuse, deterring fraud because no single actor can act unobserved. This detective control supports separation of duties by exposing attempts to combine conflicting responsibilities, satisfying the stem's requirement.

Bell-LaPadula enforces mandatory access control through the no-read-up and no-write-down rules, matching the stated label comparisons exactly. Sensitivity labels on subjects and objects, rather than owner discretion, make the model mandatory, satisfying both the read and write constraints described.

Disabling the account immediately satisfies the revocation constraint while preserving the data for review. Unlike deletion, which destroys the identity and its associated content, disabling blocks all authentication through Microsoft Entra ID yet allows an administrator to transfer file ownership to the manager, granting the week-long access without reactivating the former employee's credentials.

MAC depends on a reference monitor that mediates every access request and compares subject clearance against object label. This enforcement is inside the trusted computing base and cannot be bypassed by users or applications. It directly satisfies the lab's requirement that the OS itself enforce decisions based on labels, making this a core MAC characteristic alongside centralized label assignment.

Subjects cannot write to higher integrity levels.

MAC enforces access based on security labels assigned to objects (files) and clearances assigned to subjects (users). These labels and clearances are typically managed by a central authority, and users cannot alter them. This matches the requirement that access be based on sensitivity labels and clearance levels, and that users cannot change permissions.

OAuth 2.0 is an authorization framework that lets a resource owner grant a third-party application limited access to protected resources without sharing credentials. The budgeting app receives an access token scoped to reading transaction history, and the customer's banking password is never disclosed. This exactly matches the requirement for delegated, limited access to account data with user consent.

Role hierarchies let senior roles inherit permissions from junior ones, so a manager role automatically gains the permissions assigned to the employee role beneath it. This satisfies RBAC's structural requirement that permissions attach to roles rather than individual users, reducing administrative overhead when many users share common access needs.

The threshold determines how closely a biometric sample must match the stored template; a stricter threshold lowers FAR.

DAC allows resource owners to set permissions at their discretion, enabling department managers to control access to their folders without IT intervention. This matches the small business owner's requirement for delegated, flexible access control. DAC is simple to implement and commonly used in file systems, making it the most appropriate model here.

MAC enforces access based on security labels assigned to subjects and objects, and users cannot change or delegate these labels. This matches the requirement to use sensitivity labels and clearance levels while preventing delegation. The system, not the user, makes access decisions, ensuring strict confidentiality and integrity controls suitable for a financial firm.

In 802.1X, the authenticator can maintain an authorized state for a supplicant after a successful RADIUS exchange and only reauthenticate at a configured interval or on a session event. Until reauthentication occurs, the device remains authorized even though the password changed. This caching of authorization state, governed by session and reauthentication timers, is the most likely reason users keep working for hours after the change.

SAML exchanges authentication and authorisation data as XML assertions between an Identity Provider and a Service Provider. The stem's XML-based assertion from IdP to SP matches SAML's protocol exactly, unlike OAuth 2.0, which uses JSON access tokens rather than XML assertions.

The IdP authenticates users against the corporate Active Directory and issues signed SAML assertions to the SaaS relying party, satisfying the requirement that existing credentials be reused. Without it, no trusted authority exists to vouch for user identity, so federation cannot occur.

This is the no read up rule, a core principle of MAC for confidentiality. It ensures that a subject cannot access information above their clearance level, preventing unauthorized disclosure. The auditor must confirm this is enforced, as it is fundamental to MAC's confidentiality model and directly supports the no read up requirement.

The home domain authenticates the user and issues the assertions the partner domain consumes, so it acts as the Identity Provider (IdP). The partner domain is the relying party or service provider that trusts those assertions.

Just-in-time provisioning grants elevated privileges only for the duration of a specific task, then automatically revokes them. This directly satisfies the PAM requirement for temporary, task-scoped access, eliminating standing privileges that attackers could exploit. Microsoft Entra ID Privileged Identity Management implements this through time-bound role activation, requiring justification and approval before elevation.

A hardware interlock is a physical control that couples system operation to the presence of a specific object, so the workstation runs only with the approved device inserted and stops the moment it is withdrawn. This directly satisfies both halves of the policy without relying on software that could be bypassed.