SSCP Certification SSCP Access Control Systems 3 — Questions and Answers
Question 1: A database administrator can modify any record but a separate auditor must approve deletions. This enforces which principle?
- Least privilege
- Separation of duties (Correct answer)
- Need-to-know
- Non-repudiation
Correct answer: Separation of duties
Separation of duties splits sensitive tasks between multiple people so no single individual can complete a critical action alone.
Question 2: In RBAC, what is a 'role hierarchy'?
- A ranked list of users ordered by seniority
- A structure where senior roles inherit permissions from junior roles (Correct answer)
- A classification scheme for objects similar to MAC labels
- A logging mechanism that records role assignments over time
Correct answer: A structure where senior roles inherit permissions from junior roles
Role hierarchies allow senior roles to inherit the permissions of subordinate roles, reducing administrative overhead.
Question 3: Which authentication factor category does a hardware OTP token belong to?
- Something you know
- Something you have (Correct answer)
- Something you are
- Somewhere you are
Correct answer: Something you have
A hardware OTP token is a physical device the user possesses, placing it in the 'something you have' authentication factor category.
Question 4: What is the Biba model primarily designed to protect?
- Confidentiality of sensitive data
- Integrity of data from unauthorized modification (Correct answer)
- Availability of critical systems
- Auditability of user actions
Correct answer: Integrity of data from unauthorized modification
The Biba model enforces data integrity by preventing subjects from writing to higher-integrity objects or reading from lower-integrity objects.
Question 5: An access control system that evaluates policies using attributes of the user, resource, environment, and action is best described as:
- RBAC
- DAC
- ABAC (Correct answer)
- MAC
Correct answer: ABAC
Attribute-Based Access Control (ABAC) makes decisions based on a combination of subject, object, environment, and action attributes.
Question 6: What term describes the condition where a user accumulates excessive permissions over time due to role changes without revoking old access?
- Privilege creep (Correct answer)
- Privilege escalation
- Role explosion
- Access sprawl
Correct answer: Privilege creep
Privilege creep occurs when users retain permissions from previous roles as they move through an organization, violating least privilege.
Question 7: Which Kerberos component issues Ticket-Granting Tickets (TGTs)?
- Service Server (SS)
- Ticket-Granting Server (TGS)
- Authentication Server (AS) (Correct answer)
- Key Distribution Center client
Correct answer: Authentication Server (AS)
The Authentication Server (AS) within the Key Distribution Center verifies the user's credentials and issues the initial Ticket-Granting Ticket.
SSCP Certification SSCP Access Control Systems 3
A database administrator can modify any record but a separate auditor must approve deletions.
This enforces which principle?