SSCP Certification SSCP Access Control Systems 5 — Questions and Answers
Question 1: What is the difference between identification and authentication in access control?
- Identification verifies identity; authentication claims it
- Identification claims identity; authentication verifies the claim (Correct answer)
- They are interchangeable terms for the same process
- Identification is stronger than authentication
Correct answer: Identification claims identity; authentication verifies the claim
Identification is the act of claiming an identity (e.g., username), while authentication is the process of proving that claim with evidence.
Question 2: Which access control model is most commonly used in commercial operating systems like Windows and Linux file systems?
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC) (Correct answer)
- Rule-Based Access Control
Correct answer: Discretionary Access Control (DAC)
DAC allows resource owners to control who can access their files, which is the standard model in mainstream operating systems via file permissions and ACLs.
Question 3: A biometric system that is tuned to minimize False Acceptance Rate (FAR) will likely experience:
- Decreased False Rejection Rate (FRR)
- Increased False Rejection Rate (FRR) (Correct answer)
- No change to False Rejection Rate (FRR)
- Lower Crossover Error Rate (CER)
Correct answer: Increased False Rejection Rate (FRR)
FAR and FRR have an inverse relationship; tightening the threshold to reduce FAR will cause more legitimate users to be rejected, increasing FRR.
Question 4: What does the term 'object' refer to in the context of access control?
- A user account attempting to gain access
- A passive resource such as a file, database, or device being accessed (Correct answer)
- An authentication token presented at login
- A security policy rule enforced by the system
Correct answer: A passive resource such as a file, database, or device being accessed
In access control terminology, an object is a passive entity (file, database record, printer) that a subject attempts to access.
Question 5: Which access control implementation enforces permissions at the operating system kernel level, making it resistant to application-level tampering?
- Application-layer ACLs
- Database row-level security
- Reference Monitor (Correct answer)
- Firewall rules
Correct answer: Reference Monitor
The Reference Monitor is a kernel-level concept that mediates all access requests between subjects and objects, and cannot be bypassed by user-space processes.
Question 6: In a Clark-Wilson integrity model, what are 'Transformation Procedures' (TPs)?
- Audit logs that record all data changes
- Well-formed transactions that are the only permitted operations on constrained data (Correct answer)
- Encryption routines that transform plaintext to ciphertext
- Authentication steps required before data access
Correct answer: Well-formed transactions that are the only permitted operations on constrained data
TPs are the only authorized methods for manipulating Constrained Data Items (CDIs), ensuring all changes follow defined integrity rules.
Question 7: A user is granted read access to a file by a group membership policy, but the file's ACL explicitly denies the same user. What is the typical outcome?
- Group membership permission takes precedence and access is granted
- The explicit deny overrides the group allow, and access is denied (Correct answer)
- The system prompts an administrator to resolve the conflict
- Access is granted with an audit log entry created
Correct answer: The explicit deny overrides the group allow, and access is denied
In most access control systems, an explicit Deny entry overrides any Allow permissions, including those granted through group membership.
SSCP Certification SSCP Access Control Systems 5
What is the difference between identification and authentication in access control?