SSCP Access Control & Identity Management 4 — Questions and Answers
Question 1: Which of the following best describes a federated identity management system?
- A system where each application maintains its own user directory
- A framework that allows identity information to be shared across different security domains (Correct answer)
- A single server that authenticates all users for all applications
- A biometric system used across multiple organizations
Correct answer: A framework that allows identity information to be shared across different security domains
Federated identity management enables trusted identity sharing across organizational boundaries using standards like SAML or OpenID.
Question 2: A user's account is automatically locked after three failed login attempts. What type of control is this?
- Compensating control
- Preventive control (Correct answer)
- Detective control
- Corrective control
Correct answer: Preventive control
Account lockout is a preventive control that stops brute-force attacks before unauthorized access occurs.
Question 3: In public key infrastructure (PKI), what role does a Certificate Authority (CA) serve in identity management?
- It stores user passwords in a hashed format
- It issues and signs digital certificates that bind a public key to an identity (Correct answer)
- It generates private keys for all users
- It manages access control lists for network resources
Correct answer: It issues and signs digital certificates that bind a public key to an identity
A CA vouches for the identity of certificate holders by digitally signing certificates that bind public keys to identities.
Question 4: Which provisioning process should be immediately triggered when an employee is terminated?
- Account review
- Access recertification
- Account deprovisioning (Correct answer)
- Privilege escalation audit
Correct answer: Account deprovisioning
Deprovisioning immediately disables or removes a terminated employee's accounts to prevent unauthorized access.
Question 5: What does 'context-aware authentication' consider when making an access decision?
- Only the username and password provided
- The user's biometric data exclusively
- Factors like location, device, time, and behavior alongside credentials (Correct answer)
- The user's assigned role in the directory
Correct answer: Factors like location, device, time, and behavior alongside credentials
Context-aware authentication evaluates environmental and behavioral signals to assess risk and determine whether to grant access.
Question 6: Which type of access control list (ACL) entry explicitly denies access to a specific user, overriding any other permissions?
- Inherited ACE
- Allow ACE
- Deny ACE (Correct answer)
- Audit ACE
Correct answer: Deny ACE
A Deny ACE explicitly blocks access for a specified user or group, and in most systems deny rules take precedence over allow rules.
Question 7: A healthcare organization uses data classification labels to enforce access, ensuring only cleared staff can view patient records above their clearance level. Which access control model is this?
- Discretionary Access Control (DAC)
- Attribute-Based Access Control (ABAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
Correct answer: Mandatory Access Control (MAC)
MAC uses security labels and clearance levels to enforce access decisions, and users cannot override these policies.
SSCP Access Control & Identity Management 4
Which of the following best describes a federated identity management system?