SSCP Access Control & Identity Management — Questions and Answers
Question 1: What is the goal of access control in information security?
- To increase website traffic.
- To protect sensitive data from unauthorized access (Correct answer)
- To promote user sharing of credentials.
- To slow down network access.
Correct answer: To protect sensitive data from unauthorized access
Access control is a fundamental security mechanism designed to regulate who or what can view or use resources within an information system. Its primary goal is to enforce policies that ensure only authorized individuals or systems can interact with sensitive data. This prevents unauthorized access, maintaining the confidentiality, integrity, and availability of information.
Question 2: Which of the following is an example of physical access control?
- Password policy.
- Firewall configuration.
- Security badge system (Correct answer)
- Encryption software.
Correct answer: Security badge system
Physical access control refers to security measures that restrict physical entry to buildings, rooms, or specific areas. A security badge system is a direct example, as it requires a physical credential to unlock doors or gates, thereby controlling who can physically enter a restricted space. Other options like password policies or firewalls are forms of logical or technical access control.
Question 3: What is the purpose of multifactor authentication (MFA)?
- To simplify login processes.
- To reduce authentication accuracy.
- To verify identity using more than one factor (Correct answer)
- To replace usernames completely.
Correct answer: To verify identity using more than one factor
Multifactor authentication (MFA) enhances security by requiring users to provide two or more different types of verification factors from independent categories. These typically include something the user knows (like a password), something the user has (like a phone or token), and something the user is (like a fingerprint). This layered approach significantly reduces the risk of unauthorized access, even if one factor is compromised.
Question 4: What is identity management in cybersecurity?
- Managing physical hardware.
- Ensuring proper administration of user identities and privileges (Correct answer)
- Overseeing power supply levels.
- Conducting market research.
Correct answer: Ensuring proper administration of user identities and privileges
Identity management in cybersecurity encompasses the processes and technologies used to manage digital identities and their associated access rights across an organization. It focuses on creating, maintaining, and revoking user accounts and ensuring each user has the appropriate level of access (privileges) to systems and data based on their role. This is crucial for maintaining security, ensuring compliance, and streamlining operations.
Question 5: Which of the following best represents 'least privilege'?
- Giving all users full administrative rights.
- Providing access only necessary for specific job roles (Correct answer)
- Blocking all access requests.
- Granting access to entire departments.
Correct answer: Providing access only necessary for specific job roles
The principle of 'least privilege' dictates that users, programs, or processes should be granted only the minimum necessary permissions to perform their specific tasks. This minimizes the potential damage from accidental errors, misuse, or malicious activity, as it limits the scope of what an attacker can do if an account is compromised. It is a cornerstone of robust security architecture.
Question 6: Why is access control auditing important?
- To penalize users.
- To evaluate and log access activity for security monitoring (Correct answer)
- To store passwords openly.
- To increase login time.
Correct answer: To evaluate and log access activity for security monitoring
Access control auditing involves regularly reviewing and analyzing records of who accessed what, when, and how. This process is crucial for detecting unauthorized access attempts, identifying policy violations, and monitoring user behavior. Audit logs provide critical evidence for forensic investigations and help ensure the ongoing effectiveness of access control policies.
Question 7: What is an access control list (ACL)?
- A list of blocked email addresses.
- A record of access permissions for system resources (Correct answer)
- A list of marketing contacts.
- A phonebook directory.
Correct answer: A record of access permissions for system resources
An Access Control List (ACL) is a list of permissions attached to an object, such as a file, folder, or network resource. It specifies which users or system processes are granted access to that object and what operations they are allowed to perform. ACLs act as a gatekeeper, defining granular access rights and enforcing security policies at the resource level.
Question 8: What does role-based access control (RBAC) assign permissions based on?
- Their internet usage.
- Their hobbies.
- Their organizational role or function (Correct answer)
- Their physical location.
Correct answer: Their organizational role or function
Role-Based Access Control (RBAC) is an access control model where permissions are associated with specific roles within an organization, rather than directly with individual users. Users are then assigned to one or more roles, inheriting the permissions associated with those roles. This simplifies management, especially in large organizations, by streamlining the assignment and revocation of access rights based on job functions.
Question 9: How does identity federation work?
- By creating duplicate accounts for each system.
- By sharing identity information across trusted domains (Correct answer)
- By disabling external access.
- By blocking all federated logins.
Correct answer: By sharing identity information across trusted domains
Identity federation allows users to use a single set of credentials to access multiple applications or services across different security domains without having to re-authenticate for each one. This is achieved by establishing trust relationships between identity providers and service providers, enabling the secure exchange of authentication and authorization information. It enhances user convenience and reduces administrative overhead.
SSCP Access Control & Identity Management
What is the goal of access control in information security?