SSCP QUESTIONS WITH EXPLANATIONS | SSCP CERTIFICATION EXAM STUDY
GUIDE & PRACTICE TEST 2026/2027
MAC models use three types of environments. Which of the following is not a mandatory access control
design?
A. Hierarchical
B. Bracketed
C. Compartmentalized
D. Hybrid - ANS ✔✔B. Mandatory access control systems can be hierarchical, where each domain is
ordered and related to other domains above and below it; compartmentalized, where there is no
relationship between each domain; or hybrid, where both hierarchy and compartments are used. There
is no concept of bracketing in mandatory access control design.
The leadership at Susan's company has asked her to implement an access control system that can
support rule declarations like "Only allow access to salespeople from managed devices on the wireless
network between 8 a.m. and 6 p.m." What type of access control system would be Susan's best choice?
ABAC
Rule-based access control (RBAC)
DAC
MAC - ANS ✔✔A. An attribute-based access control (ABAC) system will allow Susan to specify details
about subjects, objects, and access, allowing granular control. Although a rule-based access control
system (RBAC) might allow this, the attribute-based access control system can be more specific and thus
is more flexible. Discretionary access control (DAC) would allow object owners to make decisions, and
mandatory access controls (MACs) would use classifications; neither of these capabilities was described
in the requirements.
What is the primary advantage of decentralized access control?
It provides better redundancy.
It provides control of access to people closer to the resources.
It is less expensive.
It provides more granular control of access. - ANS ✔✔B. Decentralized access control empowers people
closer to the resources to control access but does not provide consistent control. It does not provide
redundancy, since it merely moves control points, the cost of access control depends on its
implementation and methods, and granularity can be achieved in both centralized and decentralized
models.
Ben uses a software-based token that changes its code every minute. What type of token is he using?
Asynchronous
Smart card
Synchronous
Static - ANS ✔✔C. Synchronous soft tokens, such as Google Authenticator, use a time-based algorithm
that generates a constantly changing series of codes. Asynchronous tokens typically require a challenge
to be entered on the token to allow it to calculate a response, which the server compares to the
response it expects. Smartcards typically present a certificate but may have other token capabilities built
GUIDE & PRACTICE TEST 2026/2027
MAC models use three types of environments. Which of the following is not a mandatory access control
design?
A. Hierarchical
B. Bracketed
C. Compartmentalized
D. Hybrid - ANS ✔✔B. Mandatory access control systems can be hierarchical, where each domain is
ordered and related to other domains above and below it; compartmentalized, where there is no
relationship between each domain; or hybrid, where both hierarchy and compartments are used. There
is no concept of bracketing in mandatory access control design.
The leadership at Susan's company has asked her to implement an access control system that can
support rule declarations like "Only allow access to salespeople from managed devices on the wireless
network between 8 a.m. and 6 p.m." What type of access control system would be Susan's best choice?
ABAC
Rule-based access control (RBAC)
DAC
MAC - ANS ✔✔A. An attribute-based access control (ABAC) system will allow Susan to specify details
about subjects, objects, and access, allowing granular control. Although a rule-based access control
system (RBAC) might allow this, the attribute-based access control system can be more specific and thus
is more flexible. Discretionary access control (DAC) would allow object owners to make decisions, and
mandatory access controls (MACs) would use classifications; neither of these capabilities was described
in the requirements.
What is the primary advantage of decentralized access control?
It provides better redundancy.
It provides control of access to people closer to the resources.
It is less expensive.
It provides more granular control of access. - ANS ✔✔B. Decentralized access control empowers people
closer to the resources to control access but does not provide consistent control. It does not provide
redundancy, since it merely moves control points, the cost of access control depends on its
implementation and methods, and granularity can be achieved in both centralized and decentralized
models.
Ben uses a software-based token that changes its code every minute. What type of token is he using?
Asynchronous
Smart card
Synchronous
Static - ANS ✔✔C. Synchronous soft tokens, such as Google Authenticator, use a time-based algorithm
that generates a constantly changing series of codes. Asynchronous tokens typically require a challenge
to be entered on the token to allow it to calculate a response, which the server compares to the
response it expects. Smartcards typically present a certificate but may have other token capabilities built
