SSCP Access Control Systems Questions and Answers — Questions and Answers
Question 1: A security administrator is configuring access to a highly sensitive database containing classified government information. The policy dictates that access is determined by the clearance level of the user and the classification level of the data. Even the data owner is not permitted to grant access to users without the appropriate clearance. Which access control model is being implemented?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
Mandatory Access Control (MAC) is the correct model because access decisions are based on security labels (clearance for subjects, classification for objects) assigned by a central authority. In a MAC environment, individuals cannot alter access permissions, which is a key requirement described in the scenario.
Question 2: Which of the following is considered a 'Type 3' authentication factor?
- A hardware token
- A fingerprint scan (Correct answer)
- A complex password
- The location of the user
Correct answer: A fingerprint scan
Authentication factors are categorized as Type 1 (something you know), Type 2 (something you have), and Type 3 (something you are). A fingerprint scan is a biometric characteristic, which falls under the 'something you are' category (Type 3).
Question 3: A company implements an access control system where permissions are assigned to job titles rather than to individual users. When an employee changes their job title, their access rights are automatically updated to reflect their new position. This is an example of which access control model?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Mandatory Access Control (MAC)
- Rule-Based Access Control
Correct answer: Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) assigns permissions to roles, and users acquire permissions by being assigned to those roles. This simplifies administration, as described in the scenario where access rights are tied to job titles.
Question 4: In a Discretionary Access Control (DAC) model, who is responsible for determining which users have access to a resource?
- The security administrator
- A central authority based on security labels
- The system itself based on predefined rules
- The owner of the resource (Correct answer)
Correct answer: The owner of the resource
In the Discretionary Access Control (DAC) model, the owner of an object (such as a file or folder) has the discretion to grant or deny access to other subjects (users).
Question 5: A user successfully logs into their corporate network using a password. They then attempt to access a secure financial application and are prompted to enter a one-time code from a mobile app. What security concept does this scenario describe?
- Single Sign-On (SSO)
- Federated Identity
- Multi-Factor Authentication (MFA) (Correct answer)
- Least Privilege
Correct answer: Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) requires a user to provide two or more different types of authentication factors to verify their identity. In this case, the user provided 'something they know' (password) and 'something they have' (the mobile app generating a code).
Question 6: Which of the following BEST describes the principle of 'least privilege' in the context of access control?
- Granting users the highest level of access required to perform any potential job function.
- Allowing resource owners to decide who can access their resources.
- Ensuring all users have a baseline set of access permissions.
- Granting users only the minimum permissions necessary to perform their job responsibilities. (Correct answer)
Correct answer: Granting users only the minimum permissions necessary to perform their job responsibilities.
The principle of least privilege is a fundamental security concept that dictates a user should be given only the minimum levels of access – or permissions – needed to perform their job tasks. This minimizes the potential damage from a compromised account.
SSCP Access Control Systems Questions and Answers
A security administrator is configuring access to a highly sensitive database containing classified government information.
The policy dictates that access is determined by the clearance level of the user and the classification level of the data.
Even the data owner is not permitted to grant access to users without the appropriate clearance.
Which access control model is being implemented?