2.4 - Understand and Administer Access Controls SSCP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A university uses RBAC to manage access to its student information system. A new policy requires that teaching assistants (TAs) can only view grades for courses they are assigned to, and only during the semester they are assigned. The university wants to avoid creating a new role for every course-semester combination. Which approach best satisfies the policy while minimizing administrative overhead?

   • AUse DAC and let each professor grant TAs access to their course
   • BCreate a single 'TA' role and add a rule that restricts access based on course and semester attributes
   • CUse MAC with labels for each course and semester
   • DCreate a separate role for each course-semester combination
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A government agency uses MAC to protect classified documents. A system administrator with a TOP SECRET clearance needs to perform routine maintenance on the server hosting SECRET documents. The administrator's normal account has a TOP SECRET clearance, but the security officer is concerned that using this account for maintenance could expose the administrator to unnecessary classified data. The agency wants to minimize the administrator's exposure while still allowing the maintenance to occur. What is the most appropriate approach?

   • AUse the administrator's TOP SECRET account for all maintenance tasks
   • BCreate a separate account for the administrator with a SECRET clearance for maintenance tasks
   • CImplement a PAM solution that grants the TOP SECRET account only during maintenance windows
   • DSwitch to DAC and let the administrator decide which documents to access
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a Discretionary Access Control (DAC) model, who has the authority to grant or deny access to an object?

   • AThe security auditor, who reviews access logs
   • BThe system administrator, who sets global policies
   • CThe system, based on security labels assigned to the object
   • DThe resource owner, who can set permissions for other users
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which characteristic is a defining feature of Mandatory Access Control (MAC)?

   • AAccess decisions are based on the identity of the user only
   • BThe system enforces access based on security labels and clearances
   • CAccess is granted based on the role the user holds in the organization
   • DUsers can delegate access to other users at their discretion
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large enterprise has 50 system administrators who all have permanent domain admin rights. The security team wants to reduce the risk of credential theft by requiring administrators to request elevated access only when needed, with an approval workflow and session recording. However, the team also wants to ensure that emergency break-glass access is available 24/7 without an approval delay. Which solution best balances these requirements?

   • AImplement a PAM solution with just-in-time (JIT) access and a break-glass emergency account
   • BKeep the permanent domain admin rights but enable auditing on all admin accounts
   • CUse ABAC to grant admin access based on the user's department and time of day
   • DRemove all admin rights and require a manager to approve every access request manually
   Reveal Solution Discussion Select an answer first