SSCP Exam Questions

When referring to a computer crime investigation, which of the following would be the MOST important step required in order to preserve and maintain a proper chain of custody of ev...

When should a post-mortem review meeting be held after an intrusion has been properly taken care of?

What can be defined as an event that could cause harm to the information systems?

Most access violations are:

A business continuity plan is an example of which of the following?

When preparing a business continuity plan, who of the following is responsible for identifying and prioritizing time-critical systems?

Which of the following statements pertaining to disaster recovery planning is incorrect?

Which of the following statements do not apply to a hot site?

What can be defined as a batch process dumping backup data through communications lines to a server at an alternate location?

Which of the following is the most complete disaster recovery plan test type, to be performed after successfully completing the Parallel test?

Which of the following statements pertaining to disaster recovery is incorrect?

If an employee's computer has been used by a fraudulent employee to commit a crime, the hard disk may be seized as evidence and once the investigation is complete it would follow t...

Which of the following is a problem regarding computer investigation issues?

Which of the following are not Remote Access concerns?

Smart cards are an example of which type of control?

What security model is dependent on security labels?

What security model implies a central authority that define rules and sometimes global rules, dictating what subjects can have access to what objects?

Which type of password token involves time synchronization?

Which of the following statements pertaining to biometrics is false?

Which of the following statements pertaining to Kerberos is TRUE?

Which of the following centralized access control mechanisms is the least appropriate for mobile workers accessing the corporate network over analog lines?

Which of the following is NOT a compensating measure for access violations?

A host-based IDS is resident on which of the following?

Which of the following usually provides reliable, real-time information without consuming network or host resources?

The fact that a network-based IDS reviews packets payload and headers enable which of the following?

Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?

What would be considered the biggest drawback of Host-based Intrusion Detection systems (HIDS)?

Attributes that characterize an attack are stored for reference using which of the following Intrusion Detection System (IDS) ?

Which of the following is an issue with signature-based intrusion detection systems?

Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?

Which of the following is a disadvantage of a statistical anomaly-based intrusion detection system?

In the process of gathering evidence from a computer attack, a system administrator took a series of actions which are listed below. Can you identify which one of these actions has...

As a result of a risk assessment, your security manager has determined that your organization needs to implement an intrusion detection system that can detect unknown attacks and c...

Which of the following is NOT a characteristic of a host-based intrusion detection system?

Which of the following is NOT a fundamental component of an alarm in an intrusion detection system?

What is the goal of the Maintenance phase in a common development process of a security policy?

What is the difference between Advisory and Regulatory security policies?

What is the main purpose of Corporate Security Policy?

Which of the following is not a component of a Operations Security "triples"?

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, thi...

Which of the following is NOT a proper component of Media Viability Controls?

A channel within a computer system or network that is designed for the authorized transfer of information is identified as a(n)?

When attempting to establish Liability, which of the following would be describe as performing the ongoing maintenance necessary to keep something in proper working order, updated,...

What can best be described as a domain of trust that shares a single security policy and single management?

Which of the following describes a technique in which a number of processor units are employed in a single computer system to increase the performance of the system in its applicat...

What can best be described as an abstract machine which must mediate all access to subjects to objects?

Who is responsible for implementing user clearances in computer-based information systems at the B3 level of the TCSEC rating ?

Which of the following questions is less likely to help in assessing physical access controls?

Which of the following questions is less likely to help in assessing physical and environmental protection?

How would nonrepudiation be best classified as?