A company is establishing a federation with a partner. The partner uses SAML 2.0, and the company uses OpenID Connect. The company wants to enable SSO for its users to access the partner's application. The company also needs to pass a custom attribute (e.g., department) to the partner for authorization decisions. Which approach should they use?

Have the partner modify its application to support OpenID Connect.

Use a federation gateway that translates the company's OpenID Connect tokens into SAML assertions, including the custom attribute.

Use a shared database to synchronize user attributes between the companies.

Send the custom attribute in the URL as a query parameter.

A hospital deploys new laptops to its nursing staff. The security policy requires that only these specific, company-issued devices can access the electronic health record (EHR) system, even if a user's username and password are compromised. The devices have TPM 2.0 chips. Which approach should the security team implement to meet this requirement?

Enroll each laptop's TPM-backed certificate in the internal PKI and require that certificate for EHR access.

Require users to enter a BIOS password before the laptop boots.

Record the MAC address of each laptop's Wi-Fi adapter and allowlist them on the EHR server.

Install a software agent on each laptop that reports its serial number to the EHR server.

An organization wants to add a second authentication factor that does NOT require users to carry a separate physical token and works even when the user is offline. Which MFA method best fits this requirement?

Time-based one-time password (TOTP) generated by an authenticator app

SMS-delivered one-time password

Hardware security key with USB connection

Push notification to a mobile device

Which of the following is an example of an inherence authentication factor?

A fingerprint scanned by a biometric reader

A password combined with a security question

A one-time password generated by an authenticator app

A hardware security key inserted into a USB port

Which statement accurately describes the use of MAC addresses for device authentication?

MAC addresses are globally unique and cannot be spoofed, making them a strong authentication factor

MAC addresses are assigned by the operating system and change on every reboot

MAC addresses are a weak form of device identification because they can be spoofed and are not cryptographically verified

MAC addresses are encrypted by the TPM before being sent over the network

Systems Security Certified Practitioner

Domain 2Objective 1

2.1 - Implement and Maintain Authentication Methods SSCP Practice Questions (Page 4)

Part of the Access Controls domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

15%of the exam

Questions 16–20

16expert · medium
A company is establishing a federation with a partner. The partner uses SAML 2.0, and the company uses OpenID Connect. The company wants to enable SSO for its users to access the partner's application. The company also needs to pass a custom attribute (e.g., department) to the partner for authorization decisions. Which approach should they use?
Select an answer first
17application · medium
A hospital deploys new laptops to its nursing staff. The security policy requires that only these specific, company-issued devices can access the electronic health record (EHR) system, even if a user's username and password are compromised. The devices have TPM 2.0 chips. Which approach should the security team implement to meet this requirement?
Select an answer first
18foundation · easy
An organization wants to add a second authentication factor that does NOT require users to carry a separate physical token and works even when the user is offline. Which MFA method best fits this requirement?
Select an answer first
19foundation · easy
Which of the following is an example of an inherence authentication factor?
Select an answer first
20foundation · easy
Which statement accurately describes the use of MAC addresses for device authentication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

2.1 - Implement and Maintain Authentication Methods SSCP Practice Questions (Page 4)

Questions 16–20

An organization wants to add a second authentication factor that does NOT require users to carry a separate physical token and works even when the user is offline. Which MFA method best fits this requirement?

Which of the following is an example of an inherence authentication factor?

Which statement accurately describes the use of MAC addresses for device authentication?

Keep studying — Access Controls