SSCP Access Control & Identity Management 2 — Questions and Answers
Question 1: Which access control model assigns permissions based on a user's role within an organization rather than their individual identity?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Mandatory Access Control (MAC)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC grants access based on job roles, simplifying permission management in organizations.
Question 2: A security administrator wants to ensure that no single employee can both initiate and approve a financial transaction. Which principle does this enforce?
- Least privilege
- Separation of duties (Correct answer)
- Need to know
- Defense in depth
Correct answer: Separation of duties
Separation of duties requires that critical tasks be split among multiple people to prevent fraud or error.
Question 3: Which authentication factor category does a retinal scan belong to?
- Something you know
- Something you have
- Something you are (Correct answer)
- Somewhere you are
Correct answer: Something you are
Biometric identifiers like retinal scans fall under 'something you are' authentication factors.
Question 4: What is the primary function of a Privileged Access Workstation (PAW)?
- To provide general-purpose computing for all employees
- To host administrative tasks in a hardened, isolated environment (Correct answer)
- To replace multi-factor authentication for privileged users
- To store privileged account credentials securely
Correct answer: To host administrative tasks in a hardened, isolated environment
A PAW is a dedicated, hardened workstation used exclusively for sensitive administrative tasks to reduce attack surface.
Question 5: When a user is granted the minimum access rights needed to perform their job, which security principle is being applied?
- Separation of duties
- Defense in depth
- Least privilege (Correct answer)
- Zero trust
Correct answer: Least privilege
The principle of least privilege limits user access to only what is necessary for their role, reducing exposure.
Question 6: Which protocol is commonly used by enterprise directories to authenticate users and query directory information?
- RADIUS
- LDAP (Correct answer)
- TACACS+
- Kerberos
Correct answer: LDAP
LDAP (Lightweight Directory Access Protocol) is the standard protocol for accessing and managing directory services like Active Directory.
Question 7: A company uses a system where access decisions are made based on user attributes, resource attributes, and environmental conditions. What type of access control is this?
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
Correct answer: Attribute-Based Access Control (ABAC)
ABAC evaluates multiple attributes (user, resource, environment) dynamically to make fine-grained access decisions.
SSCP Access Control & Identity Management 2
Which access control model assigns permissions based on a user's role within an organization rather than their individual identity?