SSCP Access Control & Identity Management 3 — Questions and Answers
Question 1: Which technology allows users to authenticate once and gain access to multiple systems without re-entering credentials?
- Multi-factor authentication (MFA)
- Single Sign-On (SSO) (Correct answer)
- Federated identity management
- Public Key Infrastructure (PKI)
Correct answer: Single Sign-On (SSO)
SSO enables users to log in once and access multiple related systems without repeated authentication.
Question 2: What is the term for an attack where an adversary intercepts an authentication session token to gain unauthorized access?
- Brute force attack
- Session hijacking (Correct answer)
- Credential stuffing
- Replay attack
Correct answer: Session hijacking
Session hijacking involves stealing a valid session token to impersonate an authenticated user.
Question 3: In a Kerberos authentication flow, what does the Ticket Granting Ticket (TGT) allow a user to do?
- Decrypt messages encrypted with the KDC's public key
- Request service tickets without re-entering their password (Correct answer)
- Authenticate directly to application servers
- Store user credentials on the local workstation
Correct answer: Request service tickets without re-entering their password
The TGT is used to obtain service tickets from the Key Distribution Center without requiring the user's password again.
Question 4: Which access control approach allows the data owner to determine who can access their resources?
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC) (Correct answer)
- Rule-Based Access Control
Correct answer: Discretionary Access Control (DAC)
DAC lets the resource owner decide who is granted access, as seen in traditional file system permissions.
Question 5: What is the primary risk associated with excessive user account privileges that accumulate over time through job role changes?
- Privilege escalation
- Privilege creep (Correct answer)
- Insider threat
- Account lockout
Correct answer: Privilege creep
Privilege creep occurs when users retain old access rights after changing roles, resulting in more access than needed.
Question 6: Which identity federation standard allows web applications to grant limited access to user accounts on third-party services without sharing passwords?
- SAML 2.0
- OAuth 2.0 (Correct answer)
- OpenID Connect
- WS-Federation
Correct answer: OAuth 2.0
OAuth 2.0 is an authorization framework that allows third-party applications to access resources on behalf of a user without exposing credentials.
Question 7: An organization requires that two administrators must simultaneously approve any changes to firewall rules. This is an example of which control?
- Dual control (Correct answer)
- Least privilege
- Defense in depth
- Need to know
Correct answer: Dual control
Dual control requires two authorized individuals to act together, preventing unilateral changes to critical systems.
SSCP Access Control & Identity Management 3
Which technology allows users to authenticate once and gain access to multiple systems without re-entering credentials?