SSCP Access Control Systems Questions and Answers

Question 1

A security administrator is configuring access to a highly sensitive database containing classified government information.
The policy dictates that access is determined by the clearance level of the user and the classification level of the data.
Even the data owner is not permitted to grant access to users without the appropriate clearance.
Which access control model is being implemented?

Accepted Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Question 2

Which of the following is considered a 'Type 3' authentication factor?

Accepted Answer

A fingerprint scan

Answer

A hardware token

Answer

A complex password

Answer

The location of the user

Question 3

A company implements an access control system where permissions are assigned to job titles rather than to individual users. When an employee changes their job title, their access rights are automatically updated to reflect their new position. This is an example of which access control model?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Rule-Based Access Control

Question 4

In a Discretionary Access Control (DAC) model, who is responsible for determining which users have access to a resource?

Accepted Answer

The owner of the resource

Answer

The security administrator

Answer

A central authority based on security labels

Answer

The system itself based on predefined rules

Question 5

A user successfully logs into their corporate network using a password. They then attempt to access a secure financial application and are prompted to enter a one-time code from a mobile app. What security concept does this scenario describe?

Accepted Answer

Multi-Factor Authentication (MFA)

Answer

Single Sign-On (SSO)

Answer

Federated Identity

Answer

Least Privilege

Question 6

Which of the following BEST describes the principle of 'least privilege' in the context of access control?

Accepted Answer

Granting users only the minimum permissions necessary to perform their job responsibilities.

Answer

Granting users the highest level of access required to perform any potential job function.

Answer

Allowing resource owners to decide who can access their resources.

Answer

Ensuring all users have a baseline set of access permissions.