CCNA Access Controls Questions

SAML exchanges XML-based assertions between identity and service providers, enabling browser-based single sign-on across security domains. It directly satisfies the stem's requirement for federated authentication using corporate credentials at a partner's cloud application, with the identity provider issuing signed assertions the partner's application validates and trusts.

RADIUS clients and servers authenticate each other using a shared secret. If the shared secret on the VPN concentrator does not match the one configured on the RADIUS server, authentication requests will be rejected. The logs indicating a shared secret mismatch point directly to this configuration error on the new device.

The Ticket-Granting Ticket is obtained at initial authentication and used to request service tickets. If it expires, subsequent access to the network share fails with a ticket expired error, matching the stem's symptom after password entry.

Least privilege requires granting only the access needed to perform a role's duties. A service account holding domain administrator rights far exceeds its operational requirements, so the excessive privilege violates that principle, regardless of authentication or separation-of-duties controls.

Password history enforces the no-reuse constraint by storing hashes of prior passwords and rejecting any new one matching the last 10 entries. This directly satisfies the stem's requirement that users cannot reuse recent passwords, distinct from complexity, length, or expiry settings.

Authentication is the process of verifying a claimed identity by checking the supplied credential against the stored one. Here, the system compares the password against the record for 'jsmith', confirming the user is who they claim to be. This directly satisfies the stem's requirement to verify the password matches the one on file.

Access control proceeds by first claiming an identity, then proving it, then granting rights, then logging activity. Accountability depends on the prior identification and authentication steps, so this sequence reflects the actual dependency chain rather than any reordering of the four stages.

ABAC evaluates attributes of the subject, object, action, and environment, which maps directly to department, data classification, time of day, and patient admission status. Policies written as boolean rules can require all conditions to be true before granting access, delivering the fine-grained, context-aware decisions this scenario demands. This makes ABAC the appropriate model for combining multiple dynamic factors into one authorization decision.

DAC grants the resource owner discretion over access decisions, so they assign permissions directly to other subjects. This owner-controlled permission assignment is precisely the mechanism the stem requires, distinguishing DAC from mandatory and role-based models where policy or roles dictate access.

RADIUS accounting logs record session start and stop times, as well as the network access server and assigned IP address. Reviewing these logs first can reveal whether two simultaneous sessions were actually established and from which devices. This directly addresses whether the logins are concurrent and helps distinguish a legitimate session from credential theft.

Just-in-time privileged access issues credentials only when needed and for a brief window, so a captured credential quickly becomes useless and cannot be replayed later. This shrinks the attack surface for lateral movement because standing privileges do not persist across the environment. It directly supports the goal of reducing replay risk and containing a compromised password.

In SAML federation the IdP owns authentication, verifying the user's credentials and then issuing a signed assertion describing the authenticated subject. The SP trusts that assertion to grant access, so the IdP never authorises resources itself.

Least privilege grants each user only the minimum access rights required to perform their role, reducing the blast radius of compromised accounts or insider misuse. It is fundamental because the access control policy must limit permissions by default rather than granting broad standing access.

Disabling the account immediately blocks authentication and access while preserving the object and its group memberships for audit and possible rehire. This satisfies the security-first constraint, since deletion would remove evidence and any dependent access before revocation is verified.

The TGT is issued by the Authentication Service after initial credential validation and is presented to the Ticket Granting Service to request service tickets. It proves the user's identity without re-entering credentials, enabling single sign-on for subsequent resource access.

Accountability requires that each user be uniquely identified so actions can be traced back to a specific individual, with those actions recorded in logs. Shared or generic accounts break this, since activity cannot be attributed to one person.

Splitting the medication workflow so no single user both orders and approves it enforces separation of duties, preventing one person from completing a sensitive transaction end to end. This satisfies the stem's explicit constraint that ordering and administration approval must remain with different individuals.

Just-in-time provisioning grants elevated rights only for a defined window, then revokes them automatically, directly satisfying PAM's need to eliminate standing privileges. This contrasts with permanent admin accounts, which persist indefinitely and widen the attack surface. JIT is a core PAM capability alongside credential vaulting and session recording.

In discretionary access control the owner of a resource decides who receives access, and the system does not inherently revoke that access when the business need ends. Because the department head acted as owner and no centralized lifecycle process intervened, the permission persisted after the vacation coverage concluded. This decentralization of authority is the defining trait that produced the stale entitlement found during the audit.

In discretionary access control, the owner of a resource has the discretion to grant or revoke access. Since the project manager created the folder, they are the owner and can assign read-only permission to the team member. This is the defining characteristic of DAC.

Discretionary Access Control satisfies the stem's requirement that a resource owner assigns permissions, since DAC grants each owner discretion over their own objects via access control lists. Unlike mandatory or role-based models, where central policy or job function dictates access, DAC places that authority directly with the owner.

Mandatory Access Control enforces access decisions through a central authority using security labels and clearances, so users cannot alter permissions themselves. This satisfies the high-security constraint, where only the system assigns sensitivity labels and determines access, preventing user discretion or ownership-based control that discretionary models permit.

Just-in-time provisioning grants elevated privileges only for the duration of a specific task, then revokes them automatically. This directly satisfies the PAM requirement for temporary administrative rights issued on demand, eliminating standing access. Unlike permanent role assignment, it enforces least privilege by limiting the exposure window during which credentials could be abused.

SAML satisfies the cross-domain single sign-on requirement by exchanging XML-based assertions between an identity provider and service provider. Its assertion format carries authentication and attribute statements, enabling federated trust across separate security domains without sharing credentials, which matches the stem's specified XML assertion and SSO constraints precisely.

DAC allows the owner of a resource to grant permissions to individual users at their discretion. This matches the owner's requirement to assign different permissions to employees based on job duties without using groups. DAC is the most appropriate model here.