A company is implementing a zero-trust architecture. They need to authenticate users and devices before granting access to internal resources. The company has a mix of Windows 10 laptops with TPM 2.0 and personal smartphones. The security team wants to ensure that only company-managed devices can access sensitive resources, while still allowing personal devices to access non-sensitive resources. Which approach should they implement?

Require all users to use a hardware token for MFA, regardless of device.

Use device certificates issued by the company's MDM to authenticate company-managed devices, and require MFA for all users.

Use a TPM-based attestation for all devices, including personal smartphones.

Use MAC address filtering to identify company-managed devices.

What is the primary purpose of OAuth2 in a federated access scenario?

To provide delegated authorization, allowing a third-party application to access a user's resources without sharing the user's password

To authenticate the user and provide identity information in a standardized format

To synchronize user accounts between different identity providers

To encrypt all data transmitted between the user and the application

Which MFA method is most appropriate for a high-security environment where users must authenticate to a workstation without typing a password and the method must be resistant to phishing?

Push notification with a numeric approval code

What is the defining characteristic of federated identity management?

A single organization manages all user identities and passwords for its own applications

The identity provider stores all user passwords in a central cloud database

Users must create a new account for every external service they use

Multiple organizations establish a trust relationship to share identity information and allow users to access resources across domains

In an SSO architecture, what is the role of the identity provider (IdP)?

To provide a network firewall for the user's workstation

To store the user's passwords in plaintext for all applications

To host the applications that the user wants to access

To authenticate the user and issue a token or assertion that other applications trust

Systems Security Certified Practitioner

Domain 2Objective 1

2.1 - Implement and Maintain Authentication Methods SSCP Practice Questions (Page 3)

Part of the Access Controls domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

15%of the exam

Questions 11–15

11expert · medium
A company is implementing a zero-trust architecture. They need to authenticate users and devices before granting access to internal resources. The company has a mix of Windows 10 laptops with TPM 2.0 and personal smartphones. The security team wants to ensure that only company-managed devices can access sensitive resources, while still allowing personal devices to access non-sensitive resources. Which approach should they implement?
Select an answer first
12foundation · easy
What is the primary purpose of OAuth2 in a federated access scenario?
Select an answer first
13foundation · easy
Which MFA method is most appropriate for a high-security environment where users must authenticate to a workstation without typing a password and the method must be resistant to phishing?
Select an answer first
14foundation · easy
What is the defining characteristic of federated identity management?
Select an answer first
15foundation · easy
In an SSO architecture, what is the role of the identity provider (IdP)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.