SSCP Certification SSCP Access Control Systems 4 — Questions and Answers
Question 1: A firewall rule denies all traffic not explicitly permitted. This implements which access control philosophy?
- Default allow
- Default deny (implicit deny) (Correct answer)
- Need-to-know
- Open policy
Correct answer: Default deny (implicit deny)
Default deny (implicit deny) blocks all traffic unless a rule explicitly permits it, reducing attack surface by closing all paths not intentionally opened.
Question 2: Which type of access control list (ACL) is typically associated with network devices like routers and firewalls?
- Filesystem ACLs
- Network ACLs (Correct answer)
- Database ACLs
- Application ACLs
Correct answer: Network ACLs
Network ACLs on routers and firewalls filter traffic based on IP addresses, ports, and protocols to control network-layer access.
Question 3: Single Sign-On (SSO) improves security primarily by:
- Eliminating the need for passwords entirely
- Reducing password fatigue and encouraging stronger, fewer credentials (Correct answer)
- Encrypting all application traffic automatically
- Requiring multi-factor authentication for every session
Correct answer: Reducing password fatigue and encouraging stronger, fewer credentials
SSO reduces the number of credentials users must manage, decreasing password reuse and encouraging stronger passwords for the single login.
Question 4: A subject at SECRET level attempting to write data to a CONFIDENTIAL object would violate which Bell-LaPadula rule?
- Simple Security Property (no read up)
- Star (*) Property (no write down) (Correct answer)
- Discretionary Security Property
- Tranquility Property
Correct answer: Star (*) Property (no write down)
The Star (*) Property prohibits writing to objects at a lower classification level, preventing information from leaking downward.
Question 5: What is a primary risk of using shared accounts in a multi-user environment?
- Increased password complexity requirements
- Loss of individual accountability and audit trail integrity (Correct answer)
- Higher licensing costs for the application
- Slower authentication performance
Correct answer: Loss of individual accountability and audit trail integrity
Shared accounts make it impossible to attribute actions to a specific individual, destroying accountability and complicating forensic investigations.
Question 6: Which protocol is commonly used to provide centralized AAA services for network access?
- SNMP
- RADIUS (Correct answer)
- SMTP
- DNS
Correct answer: RADIUS
RADIUS (Remote Authentication Dial-In User Service) provides centralized Authentication, Authorization, and Accounting for network access control.
Question 7: An attacker gains admin-level access by exploiting a vulnerability in a low-privilege process. This attack technique is called:
- Privilege creep
- Horizontal privilege escalation
- Vertical privilege escalation (Correct answer)
- Lateral movement
Correct answer: Vertical privilege escalation
Vertical privilege escalation involves gaining higher-level privileges than originally assigned, moving up the permission hierarchy.
SSCP Certification SSCP Access Control Systems 4
A firewall rule denies all traffic not explicitly permitted.
This implements which access control philosophy?