SSCP Exam Questions and Answers | Exam-Dumps (Page: 13)

QUESTION: 63 Topic: 1, Access Control

The type of discretionary access control (DAC) that is based on an individual's identity is also called:

Identity-based Access control
Rule-based Access control
Non-Discretionary Access Control
Lattice-based Access control

Answer(s): A

Explanation:

An identity-based access control is a type of Discretionary Access Control (DAC) that is based on an individual's identity.
DAC is good for low level security environment. The owner of the file decides who has access to the file.
If a user creates a file, he is the owner of that file. An identifier for this user is placed in the file header and/or in an access control matrix within the operating system.
Ownership might also be granted to a specific individual. For example, a manager for a certain department might be made the owner of the files and resources within her department. A system that uses discretionary access control (DAC) enables the owner of the resource to specify which subjects can access specific resources.
This model is called discretionary because the control of access is based on the discretion of the owner. Many times department managers, or business unit managers , are the owners of the data within their specific department. Being the owner, they can specify who should have access and who should not.

Reference:

Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 220). McGraw-Hill .
Kindle Edition.

Reveal Solution Next Question

QUESTION: 64 Topic: 1, Access Control

Which access control type has a central authority that determine to what objects the subjects have access to and it is based on role or on the organizational security policy?

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Answer(s): C

Explanation:

Non Discretionary Access Control include Role Based Access Control (RBAC) and Rule Based Access Control (RBAC or RuBAC). RABC being a subset of NDAC, it was easy to eliminate RBAC as it was covered under NDAC already.
Some people think that RBAC is synonymous with NDAC but RuBAC would also fall into this category.
Discretionary Access control is for environment with very low level of security. There is no control
on the dissemination of the information. A user who has access to a file can copy the file or further share it with other users.
Rule Based Access Control is when you have ONE set of rules applied uniformly to all users. A good example would be a firewall at the edge of your network. A single rule based is applied against any packets received from the internet.
Mandatory Access Control is a very rigid type of access control. The subject must dominate the object and the subject must have a Need To Know to access the information. Objects have labels that indicate the sensitivity (classification) and there is also categories to enforce the Need To Know (NTK).

Reference:

KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 33.

Reveal Solution Next Question

QUESTION: 65 Topic: 1, Access Control

What is called the type of access control where there are pairs of elements that have the least upper bound of values and greatest lower bound of values?

Mandatory model
Discretionary model
Lattice model
Rule model

Answer(s): C

Explanation:

In a lattice model, there are pairs of elements that have the least upper bound of values and greatest lower bound of values.

Reference:

KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 34.

Reveal Solution Next Question

QUESTION: 66 Topic: 1, Access Control

Which of the following control pairing places emphasis on "soft" mechanisms that support the access control objectives?

Preventive/Technical Pairing
Preventive/Administrative Pairing
Preventive/Physical Pairing
Detective/Administrative Pairing

Answer(s): B

Explanation:

Soft Control is another way of referring to Administrative control.
Technical and Physical controls are NOT soft control, so any choice listing them was not the best answer.
Preventative/Technical is incorrect because although access control can be technical control, it is commonly not referred to as a "soft" control
Preventative/Administrative is correct because access controls are preventative in nature. it is always best to prevent a negative event, however there are times where controls might fail and you cannot prevent everything. Administrative controls are roles, responsibilities, policies, etc which are usually paper based. In the administrative category you would find audit, monitoring, and security awareness as well.
Preventative/Physical pairing is incorrect because Access controls with an emphasis on "soft" mechanisms conflict with the basic concept of physical controls, physical controls are usually tangible objects such as fences, gates, door locks, sensors, etc...
Detective/Administrative Pairing is incorrect because access control is a preventative control used to control access, not to detect violations to access.

Reference:

KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 34.

Reveal Solution Next Question

QUESTION: 67 Topic: 1, Access Control

Which of the following control pairings include: organizational policies and procedures, pre- employment background checks, strict hiring practices, employment agreements, employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks?

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Administrative Pairing

Answer(s): A

Explanation:

Preventive/Administrative Pairing: These mechanisms include organizational policies and procedures, pre-employment background checks, strict hiring practices, employment agreements, friendly and unfriendly employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks.

Reference:

KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 34.

Reveal Solution Next Question

ISC SSCP Exam (page: 13) ISC SSCP System Security Certified Practitioner (SSCP) Updated on: 15-Feb-2026

QUESTION: 63 Topic: 1, Access Control

Explanation:

Reference:

QUESTION: 64 Topic: 1, Access Control

Explanation:

Reference:

QUESTION: 65 Topic: 1, Access Control

Explanation:

Reference:

QUESTION: 66 Topic: 1, Access Control

Explanation:

Reference:

QUESTION: 67 Topic: 1, Access Control

Explanation:

Reference:

ISC SSCP Exam (page: 13)
ISC SSCP System Security Certified Practitioner (SSCP)
Updated on: 15-Feb-2026