SSCP Exam Questions
1,274 real SSCP exam questions with expert-verified answers and explanations. Page 5 of 26.
- Question #204Security Concepts and Practices
Which of the following exemplifies proper separation of duties?
Separation of DutiesSecurity PrinciplesAccess ControlOperational Security - Question #205Network and Communications Security
The control of communications test equipment should be clearly addressed by security policy for which of the following reasons?
Network securityData confidentialitySecurity policyNetwork monitoring - Question #206Security Concepts and Practices
Who is ultimately responsible for the security of computer based information systems within an organization?
Security governanceManagement accountabilityOrganizational responsibilityInformation security leadership - Question #207Security Operations and Administration
The major objective of system configuration management is which of the following?
Configuration ManagementSystem StabilitySecurity OperationsChange Control - Question #208Risk Identification, Monitoring and Analysis
Which must bear the primary responsibility for determining the level of protection needed for information systems resources?
Security GovernanceRisk ManagementSenior Management ResponsibilityInformation Protection Strategy - Question #209Systems and Application Security
The security of a computer application is most effective and economical in which of the following cases?
Security by DesignSecure Development LifecycleApplication Security Best PracticesCost-effective Security - Question #210Systems and Application Security
If an operating system permits shared resources such as memory to be used sequentially by multiple users/application or subjects without a refresh of the objects/memory area, what...
Residual DataObject ReuseOperating System SecurityMemory Management - Question #211Security Concepts and Practices
The Information Technology Security Evaluation Criteria (ITSEC) was written to address which of the following that the Orange Book did not address?
ITSECOrange BookSecurity Evaluation CriteriaIntegrity and Availability - Question #212Systems and Application Security
An Architecture where there are more than two execution domains or privilege levels is called:
Ring ArchitecturePrivilege LevelsOperating System Security - Question #213Systems and Application Security
Which of the following is commonly used for retrofitting multilevel security to a database management system?
Database SecurityMultilevel Security (MLS)Trusted Front-EndSecurity Architecture - Question #214Security Concepts and Practices
Who can best decide what are the adequate technical security controls in a computer-based application system in regards to the protection of the data being used, the criticality of...
Data OwnershipInformation ClassificationSecurity Roles and Responsibilities - Question #215Security Concepts and Practices
A security evaluation report and an accreditation statement are produced in which of the following phases of the system development life cycle?
SDLCCertification and Accreditation (C&A)Security EvaluationAcceptance Phase - Question #216Systems and Application Security
Which of the following is often the greatest challenge of distributed computing solutions?
Distributed computingSecurity challengesSystem securityAttack surface - Question #217Systems and Application Security
What is the appropriate role of the security analyst in the application system development or acquisition project?
Security Analyst RoleSDLCApplication SecurityControl Evaluation - Question #218Systems and Application Security
The information security staff's participation in which of the following system development life cycle phases provides maximum benefit to the organization?
SDLCSecurity IntegrationSecurity by DesignProactive Security - Question #219Security Concepts and Practices
Which of the following is NOT an example of an operational control?
Security ControlsOperational ControlsControl TypesSecurity Management - Question #220Security Operations and Administration
Degaussing is used to clear data from all of the following medias except:
DegaussingData SanitizationMagnetic MediaData Destruction - Question #221Security Concepts and Practices
It is a violation of the "separation of duties" principle when which of the following individuals access the software on systems implementing security?
Separation of dutiesSecurity principlesRoles and responsibilities - Question #222Incident Response and Recovery
When backing up an applications system's data, which of the following is a key question to be answered first?
Backup StrategyData Recovery PlanningData ClassificationBusiness Continuity - Question #223Security Concepts and Practices
A 'Pseudo flaw' is which of the following?
Pseudo flawHoneypot conceptSecurity trapsDeception technology - Question #224Security Concepts and Practices
Which of the following is considered the weakest link in a security system?
Human factorSecurity awarenessWeakest linkSocial engineering - Question #225Systems and Application Security
Which of the following is based on the premise that the quality of a software product is a direct function of the quality of its associated software development and maintenance pro...
Software Capability Maturity Model (CMM)Software Quality Assurance (SQA)Secure Software DevelopmentProcess Improvement - Question #226Systems and Application Security
Which of the following determines that the product developed meets the projects goals?
ValidationVerificationSecure Development Life CycleSoftware Quality Assurance - Question #227Systems and Application Security
Which of the following is the act of performing tests and evaluations to test a system's security level to see if it complies with the design specifications and security requiremen...
VerificationSecurity testingCompliance testingSDLC security - Question #228Security Concepts and Practices
Which of the following refers to the data left on the media after the media has been erased?
Data RemanenceMedia SanitizationInformation Disposal - Question #229Systems and Application Security
Which of the following is NOT a basic component of security architecture?
System ArchitectureHardware SecuritySecurity FundamentalsCore Components - Question #230Systems and Application Security
Which of the following is a set of data processing elements that increases the performance in a computer by overlapping the steps of different instructions?
PipeliningCPU architecturePerformance optimizationInstruction processing - Question #231Systems and Application Security
Which of the following describes a computer processing architecture in which a language compiler or pre-processor breaks program instructions down into basic operations that can be...
Processor ArchitectureVLIWParallel ComputingInstruction Processing - Question #232Systems and Application Security
Which of the following addresses a portion of the primary memory by specifying the actual address of the memory location?
Memory addressingCPU architectureDirect addressing mode - Question #233Systems and Application Security
Which of the following is NOT true concerning Application Control?
Application ControlEndpoint SecuritySystem SecuritySecurity Controls - Question #234Network and Communications Security
Which of the following are NOT a countermeasure to traffic analysis?
Traffic analysisNetwork security countermeasuresEavesdroppingInformation privacy - Question #235Security Concepts and Practices
Preservation of confidentiality within information systems requires that the information is not disclosed to:
ConfidentialityCIA TriadInformation Security Principles - Question #236Security Concepts and Practices
Which of the following is not one of the three goals of Integrity addressed by the Clark-Wilson model?
Clark-Wilson modelIntegrity modelsData integritySecurity models - Question #237Security Concepts and Practices
External consistency ensures that the data stored in the database is:
External consistencyData integrityDatabase consistencySecurity concepts - Question #238Security Concepts and Practices
Which of the following would be best suited to oversee the development of an information security policy?
Information Security PolicySecurity GovernanceRoles and Responsibilities - Question #239Security Operations and Administration
Which of the following is the MOST important aspect relating to employee termination?
Employee terminationOffboardingPersonnel securitySecurity procedures - Question #240Security Concepts and Practices
Making sure that only those who are supposed to access the data can access is which of the following?
ConfidentialityCIA TriadInformation Security Principles - Question #241Security Concepts and Practices
Related to information security, confidentiality is the opposite of which of the following?
ConfidentialityCIA TriadInformation Security PrinciplesDisclosure - Question #242Security Concepts and Practices
Related to information security, integrity is the opposite of which of the following?
IntegrityCIA TriadInformation Security PrinciplesData Alteration - Question #243Security Concepts and Practices
Making sure that the data is accessible when and where it is needed is which of the following?
CIA TriadAvailabilityInformation Security PrinciplesData Accessibility - Question #244Security Concepts and Practices
Related to information security, availability is the opposite of which of the following?
CIA TriadAvailabilityInformation Security ConceptsThreats - Question #245Security Concepts and Practices
Related to information security, the prevention of the intentional or unintentional unauthorized disclosure of contents is which of the following?
ConfidentialityCIA TriadInformation Security PrinciplesData Disclosure - Question #246Security Concepts and Practices
Related to information security, the guarantee that the message sent is the message received with the assurance that the message was not intentionally or unintentionally altered is...
integrityCIA triadsecurity principlesdata integrity - Question #247Network and Communications Security
One of the following assertions is NOT a characteristic of Internet Protocol Security (IPsec)
IPsecNetwork Security ProtocolsOSI ModelProtocol Guarantees - Question #248Security Operations and Administration
One of these statements about the key elements of a good configuration process is NOT true
Configuration ManagementChange ControlSecurity OperationsSystem Administration - Question #249Network and Communications Security
An area of the Telecommunications and Network Security domain that directly affects the Information Systems Security tenet of Availability can be defined as:
Network AvailabilityTelecommunications SecurityCIA TriadNetwork Security - Question #250Risk Identification, Monitoring and Analysis
Risk analysis is MOST useful when applied during which phase of the system development process?
Risk analysisSDLCProject planningSecurity integration - Question #251Systems and Application Security
Which of the following would MOST likely ensure that a system development project meets business objectives?
SDLCRequirements gatheringUser Acceptance TestingBusiness objectives alignment - Question #253Systems and Application Security
Which of the following best describes the purpose of debugging programs?
DebuggingApplication securitySoftware flawsSDLC - Question #254Systems and Application Security
Which of the following would best describe the difference between white-box testing and black box testing?
White-box testingBlack-box testingApplication testingSoftware security