SSCP Exam Questions
1,274 real SSCP exam questions with expert-verified answers and explanations. Page 1 of 26.
- Question #1Risk Identification, Monitoring and Analysis
Which of the following would assist the most in Host Based intrusion detection?
Host-Based Intrusion Detection (HIDS)Audit trailsSecurity monitoringLog analysis - Question #2Network and Communications Security
Controls to keep password sniffing attacks from compromising computer systems include which of the following?
Password securityNetwork securityAuthentication mechanismsEncryption - Question #3Network and Communications Security
Kerberos can prevent which one of the following attacks?
KerberosAuthentication ProtocolsReplay AttackNetwork Security - Question #4Access Controls
In discretionary access environments, which of the following entities is authorized to grant information access to other people?
Discretionary Access Control (DAC)Access Control ModelsData OwnerAuthorization - Question #5Access Controls
What is the main concern with single sign-on?
Single Sign-On (SSO)AuthenticationSecurity RisksAccess Management - Question #6Access Controls
Who developed one of the first mathematical models of a multilevel-security computer system?
Security ModelsBell-LaPadula ModelMultilevel SecurityAccess Control Models - Question #7Access Controls
A department manager has read access to the salaries of the employees in his/her department but not to the salaries of employees in other departments. A database security mechanism...
Access Control ModelsContent-dependent access controlDatabase Security - Question #8Network and Communications Security
Which of the following attacks could capture network user passwords?
Network sniffingPassword captureNetwork attacksEavesdropping - Question #9Access Controls
Which of the following would constitute the best example of a password to use for access to a system by a network administrator?
Password strengthPassword best practicesAuthenticationAccess control - Question #12Risk Identification, Monitoring and Analysis
The number of violations that will be accepted or forgiven before a violation record is produced is called which of the following?
Security monitoringLoggingThresholdsIntrusion detection - Question #14Security Concepts and Practices
Guards are appropriate whenever the function required by the security program involves which of the following?
Physical SecuritySecurity GuardsHuman ElementSecurity Program - Question #15Access Controls
What physical characteristic does a retinal scan biometric device measure?
BiometricsRetinal ScanAccess Control TechnologyPhysical Characteristics - Question #16Security Operations and Administration
Which is the last line of defense in a physical security sense?
Physical SecurityLayered DefenseSecurity PersonnelLast Line of Defense - Question #17Access Controls
The Computer Security Policy Model the Orange Book is based on is which of the following?
Security ModelsBell-LaPadulaOrange BookAccess Control Models - Question #18Access Controls
The end result of implementing the principle of least privilege means which of the following?
least privilegeaccess controlneed to know - Question #19Access Controls
Which of the following is the most reliable authentication method for remote access?
Authentication methodsRemote access securityMulti-factor authenticationSynchronous tokens - Question #20Security Concepts and Practices
Which of the following is the most reliable, secure means of removing data from magnetic storage media such as a magnetic tape, or a cassette?
Data SanitizationDegaussingMedia DisposalMagnetic Storage - Question #21Security Concepts and Practices
The Orange Book is founded upon which security policy model?
Orange BookBell-LaPadula ModelConfidentialitySecurity Models - Question #22Access Controls
Which of the following is true of two-factor authentication?
Two-factor authenticationAuthentication factorsMulti-factor authenticationIdentity verification - Question #23Access Controls
The primary service provided by Kerberos is which of the following?
KerberosAuthenticationNetwork ProtocolsSecurity Services - Question #24Cryptography
There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI). When we compare them side by side, Kerberos tickets correspond most closely to which o...
KerberosPKIDigital CertificatesAuthentication - Question #25Access Controls
Which of the following is NOT a system-sensing wireless proximity card?
Proximity cardsMagnetic stripe cardsPhysical access controlAccess control technologies - Question #26Security Concepts and Practices
Which of the following is NOT a type of motion detector?
Physical securityMotion sensorsSensor typesAlarm systems - Question #27Security Operations and Administration
Which of the following is NOT a technique used to perform a penetration test?
Penetration TestingSecurity TestingNetwork ReconnaissanceTraffic Analysis - Question #28Access Controls
In which of the following model are Subjects and Objects identified and the permissions applied to each subject/object combination are specified. Such a model can be used to quickl...
Access Control ModelsAccess Control MatrixPermissionsSubjects and Objects - Question #29Access Controls
In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-o...
Security ModelsBell-LaPadulaConfidentialityMandatory Access Control - Question #30Access Controls
Which of the following classes is the first level (lower) defined in the TCSEC (Orange Book) as mandatory protection?
TCSECOrange BookMandatory Access ControlSecurity Evaluation - Question #31Access Controls
Which of the following classes is defined in the TCSEC (Orange Book) as discretionary protection?
TCSECOrange BookDiscretionary Access ControlEvaluation Criteria - Question #32Systems and Application Security
Which of the following division is defined in the TCSEC (Orange Book) as minimal protection?
TCSECOrange BookSecurity ModelsSystem Evaluation - Question #33Security Concepts and Practices
Which of the following was developed by the National Computer Security Center (NCSC) for the US Department of Defense ?
TCSECSecurity ModelsNCSCDoD Security Standards - Question #34Access Controls
Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution of secret keys and provides additional acce...
Authentication ProtocolsKerberosPublic Key CryptographyAccess Control Systems - Question #35Access Controls
Single Sign-on (SSO) is characterized by which of the following advantages?
Single Sign-On (SSO)AuthenticationIdentity ManagementAccess Control - Question #36Risk Identification, Monitoring and Analysis
The "vulnerability of a facility" to damage or attack may be assessed by all of the following except:
Vulnerability AssessmentRisk ManagementSecurity AssessmentPhysical Security - Question #37Cryptography
What is the primary role of smartcards in a PKI?
SmartcardsPKIPrivate Key StorageTamper Resistance - Question #38Cryptography
What kind of certificate is used to validate a user identity?
CertificatesPKIIdentity validationPublic key cryptography - Question #39Security Concepts and Practices
Which of the following is not a physical control for physical security?
Physical SecuritySecurity ControlsControl Types - Question #40Security Operations and Administration
Crime Prevention Through Environmental Design (CPTED) is a discipline that:
CPTEDPhysical SecurityCrime PreventionEnvironmental Design - Question #41Access Controls
The following is NOT a security characteristic we need to consider while choosing a biometric identification systems:
Biometric SystemsAccess ControlSecurity System EvaluationSystem Characteristics - Question #42Access Controls
In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on :
Biometric IdentificationAuthentication FactorsPhysical BiometricsUnique Identifiers - Question #43Access Controls
In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person. This raised t...
BiometricsIdentificationAccess Control MethodsBiometric System Design - Question #44Access Controls
In biometric identification systems, the parts of the body conveniently available for identification are:
BiometricsIdentificationAuthentication Methods - Question #45Access Controls
Controlling access to information systems and associated networks is necessary for the preservation of their:
Access ControlCIA TriadInformation Security Principles - Question #46Security Concepts and Practices
Controls like guards and general steps to maintain building security, securing of server rooms or laptops, the protection of cables, and usage of magnetic switches on doors and win...
Physical securitySecurity controlsPhysical access controlsEnvironmental security - Question #47Access Controls
To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up:
Access controlAccess rulesAuthorizationSubject-object model - Question #48Access Controls
Rule-Based Access Control (RuBAC) access is determined by rules. Such rules would fit within what category of access control ?
Access ControlRule-Based Access ControlNon-Discretionary Access ControlSecurity Models - Question #49Access Controls
The type of discretionary access control (DAC) that is based on an individual's identity is also called:
Access ControlDACIdentity-based Access Control - Question #50Access Controls
Which access control type has a central authority that determine to what objects the subjects have access to and it is based on role or on the organizational security policy?
Access Control TypesNon-Discretionary Access ControlRole-Based Access ControlSecurity Policy Enforcement - Question #51Access Controls
What is called the type of access control where there are pairs of elements that have the least upper bound of values and greatest lower bound of values?
Access Control ModelsLattice ModelSecurity ModelsInformation Flow - Question #52Access Controls
Which of the following control pairing places emphasis on "soft" mechanisms that support the access control objectives?
Security ControlsAccess Control MechanismsAdministrative ControlsPreventive Controls - Question #53Security Concepts and Practices
Which of the following control pairings include: organizational policies and procedures, pre- employment background checks, strict hiring practices, employment agreements, employee...
Security ControlsAdministrative ControlsPreventive ControlsControl Types