Free SSCA Access Controls & Identity Management Questions and Answers — Questions and Answers
Question 1: What is the primary purpose of Role‑Based Access Control (RBAC)?
- Grant every user full system access
- Assign permissions based on job functions (Correct answer)
- Allow access based on time of day
- Grant privileges to devices instead of users
Correct answer: Assign permissions based on job functions
Role-Based Access Control (RBAC) is a security model that assigns permissions to users based on their specific job functions or roles within an organization. Instead of granting individual permissions, users inherit access rights defined for their role, simplifying management and enforcing the principle of least privilege.
Question 2: In multi‑factor authentication, which factor is considered "something you are"?
- Password
- Smart card
- Fingerprint scan (Correct answer)
- One‑time PIN sent via SMS
Correct answer: Fingerprint scan
In multi-factor authentication, "something you are" refers to a biometric factor, which is a unique physical characteristic of an individual. A fingerprint scan falls into this category, providing a strong and personal method of identity verification beyond just passwords or tokens.
Question 3: What does the principle of least privilege require in an IAM system?
- Grant users administrative rights by default
- Assign permissions based on seniority
- Provide limited access needed for job duties (Correct answer)
- Allow users to select their own privileges
Correct answer: Provide limited access needed for job duties
The principle of least privilege in an Identity and Access Management (IAM) system requires that users are granted only the minimum level of access necessary to perform their specific job duties. This minimizes the potential for unauthorized actions, accidental errors, or malicious activity, enhancing overall security.
Question 4: Which protocol is commonly used for centralized authentication, authorization, and accounting in enterprise networks?
- SMTP
- FTP
- RADIUS (Correct answer)
- SNMP
Correct answer: RADIUS
RADIUS (Remote Authentication Dial-In User Service) is a widely used networking protocol for centralized Authentication, Authorization, and Accounting (AAA) services in enterprise networks. It enables secure access to various network resources, such as Wi-Fi and VPNs, by verifying user identities and controlling their access privileges.
Question 5: LDAP, used in many directory services, stands for ____.
- Logical Data Access Procedure
- Layered Directory Application Protocol
- Lightweight Directory Access Protocol (Correct answer)
- Local Domain Authentication Process
Correct answer: Lightweight Directory Access Protocol
LDAP stands for Lightweight Directory Access Protocol. It is an open, industry-standard application protocol used for accessing and maintaining distributed directory information services, commonly employed for storing user and group information and facilitating authentication in many enterprise environments.
Question 6: Which statement best describes Single Sign‑On (SSO)?
- It requires a unique password for every application
- It lets users access several systems after one login (Correct answer)
- It eliminates the need for authentication
- It restricts access to a single workstation only
Correct answer: It lets users access several systems after one login
Single Sign-On (SSO) allows users to access multiple connected systems or applications after authenticating just once with a single set of credentials. This enhances user convenience by reducing the number of passwords to remember and improves security by centralizing authentication management.
Question 7: What is the main security benefit of implementing account lockout policies?
- Increase session timeout length
- Prevent brute‑force password attacks (Correct answer)
- Encrypt stored passwords
- Enable anonymous access
Correct answer: Prevent brute‑force password attacks
Account lockout policies are a critical security measure designed to prevent brute-force password attacks. By temporarily disabling an account after a specified number of failed login attempts, these policies thwart attackers from repeatedly guessing passwords until they succeed, thus protecting user accounts.
Question 8: Which policy ensures that no single individual has enough privileges to misuse the system?
- Mandatory Vacation Policy
- Separation of Duties (Correct answer)
- Acceptable Use Policy
- Password Complexity Policy
Correct answer: Separation of Duties
The policy of Separation of Duties ensures that no single individual has enough privileges to misuse a system or complete a critical task alone. By dividing responsibilities among different people, it minimizes the risk of fraud, error, or unauthorized actions, enhancing internal controls and security.
Question 9: How should unused or stale user accounts be handled to improve security?
- Leave them untouched to preserve data
- Disable or delete them promptly (Correct answer)
- Change their passwords monthly
- Convert them to guest accounts
Correct answer: Disable or delete them promptly
To improve security, unused or stale user accounts should be disabled or deleted promptly. These accounts pose a significant security risk as they can be exploited by attackers to gain unauthorized access, so removing them reduces the attack surface and adheres to the principle of least privilege.
Free SSCA Access Controls & Identity Management Questions and Answers
What is the primary purpose of Role‑Based Access Control (RBAC)?