A financial institution has a team of database administrators (DBAs) who have full administrative rights on the production database. The security team is concerned that a compromised DBA account could be used to exfiltrate sensitive customer data. They want to require that DBAs use a separate, temporary account with elevated privileges only when performing administrative tasks, and that all actions taken with that account are recorded. Which solution directly addresses this requirement?

Implement a Privileged Access Management (PAM) solution that issues time-limited credentials and records sessions

Apply Mandatory Access Control (MAC) labels to the database and grant all DBAs the highest label

Assign the DBAs to a new role in Role-Based Access Control (RBAC) that grants full access permanently

Use Discretionary Access Control (DAC) and let each DBA share their password with the team

A defense agency uses MAC to protect documents. A security administrator needs to reclassify a document from SECRET to TOP SECRET. Under MAC, what is the primary constraint the administrator must satisfy?

The administrator must have a clearance equal to or higher than the new classification

The administrator must be the original creator of the document

The administrator must use a PAM solution to elevate their privileges temporarily

The administrator must obtain approval from the document's owner

Which access control model allows a file owner to decide whether to share the file with a colleague?

Attribute-Based Access Control (ABAC)

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

A company's CRM system has roles for 'Sales Rep' and 'Sales Manager'. A new rule is added that allows 'Sales Rep' to export data only if the export size is less than 100 MB. This rule is enforced by the system. How does this scenario combine access control models?

It uses DAC for role assignment and MAC for the export size condition

It uses ABAC for role assignment and RBAC for the export size condition

It uses MAC for role assignment and DAC for the export size condition

It uses RBAC for role assignment and rule-based access control for the export size condition

A company's IT team wants to ensure that only authorized personnel can access the root account on critical servers. They want to require a second person to approve any use of the root account, and they want to record all commands executed. Which solution should they implement?

A Mandatory Access Control (MAC) label that grants root access to the 'System' label

A Privileged Access Management (PAM) solution with approval workflows and session recording

A Discretionary Access Control (DAC) policy that lets each server admin share the root password

A Role-Based Access Control (RBAC) role that grants root access to all IT staff

Systems Security Certified Practitioner

Domain 2Objective 4

2.4 - Understand and Administer Access Controls SSCP Practice Questions (Page 3)

Part of the Access Controls domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

6concepts

15%of the exam

Questions 11–15

11application · medium
A financial institution has a team of database administrators (DBAs) who have full administrative rights on the production database. The security team is concerned that a compromised DBA account could be used to exfiltrate sensitive customer data. They want to require that DBAs use a separate, temporary account with elevated privileges only when performing administrative tasks, and that all actions taken with that account are recorded. Which solution directly addresses this requirement?
Select an answer first
12expert · hard
A defense agency uses MAC to protect documents. A security administrator needs to reclassify a document from SECRET to TOP SECRET. Under MAC, what is the primary constraint the administrator must satisfy?
Select an answer first
13foundation · easy
Which access control model allows a file owner to decide whether to share the file with a colleague?
Select an answer first
14application · medium
A company's CRM system has roles for 'Sales Rep' and 'Sales Manager'. A new rule is added that allows 'Sales Rep' to export data only if the export size is less than 100 MB. This rule is enforced by the system. How does this scenario combine access control models?
Select an answer first
15application · medium
A company's IT team wants to ensure that only authorized personnel can access the root account on critical servers. They want to require a second person to approve any use of the root account, and they want to record all commands executed. Which solution should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.