SSCP Exam Questions
1,274 real SSCP exam questions with expert-verified answers and explanations. Page 6 of 26.
- Question #255Security Concepts and Practices
Which of the following is a not a preventative control?
Security ControlsPreventative ControlsDetective ControlsControl Types - Question #256Systems and Application Security
Which of the following would provide the BEST stress testing environment taking under consideration and avoiding possible data exposure and leaks of sensitive data?
Stress TestingData SecurityTest EnvironmentsData Sanitization - Question #257Systems and Application Security
Which of the following BEST explains why computerized information systems frequently fail to meet the needs of users?
SDLCRequirements GatheringUser ParticipationSystem Design - Question #258Systems and Application Security
Which of the following would be the MOST serious risk where a systems development life cycle methodology is inadequate?
SDLCRisk ManagementRequirements AnalysisProject Failure - Question #259Systems and Application Security
Which of the following is an advantage of prototyping?
PrototypingSDLCSoftware DevelopmentSystem Acquisition - Question #260Risk Identification, Monitoring and Analysis
Which of the following is a CHARACTERISTIC of a decision support system (DSS) in regards to Threats and Risks Analysis?
Decision Support Systems (DSS)Risk Analysis ToolsDecision Making Flexibility - Question #261Systems and Application Security
Which of the following is an advantage in using a bottom-up versus a top-down approach to software testing?
Software TestingSDLCBottom-up Testing - Question #262Systems and Application Security
Which of the following would be the best reason for separating the test and development environments?
Environment SeparationSDLC SecurityTesting EnvironmentsConfiguration Management - Question #263Security Concepts and Practices
What would BEST define a covert channel?
Covert ChannelsInformation Security ConceptsSecurity PolicyData Exfiltration - Question #264Access Controls
Which of the following is NOT an administrative control?
Administrative controlsTechnical controlsControl typesLogical access control - Question #265Security Concepts and Practices
Which of the following is NOT a technical control?
Security ControlsTechnical ControlsPhysical ControlsControl Types - Question #266Systems and Application Security
Which of the following statements pertaining to protection rings is false?
Protection RingsOperating System SecurityPrivilege LevelsPeripheral Access - Question #267Systems and Application Security
What is it called when a computer uses more than one CPU in parallel to execute instructions?
MultiprocessingCPUComputer ArchitectureOperating Systems - Question #268Security Concepts and Practices
What can be defined as an abstract machine that mediates all access to objects by subjects to ensure that subjects have the necessary access rights and to protect objects from unau...
Reference MonitorSecurity ModelsAccess ControlSecurity Architecture - Question #269Security Concepts and Practices
Which of the following is not a method to protect objects and the data within the objects?
Security principlesData protectionObject-oriented securitySecurity controls - Question #270Risk Identification, Monitoring and Analysis
What is called the formal acceptance of the adequacy of a system's overall security by the management?
AccreditationSecurity GovernanceRisk ManagementManagement Acceptance - Question #271Security Concepts and Practices
Which property ensures that only the intended recipient can access the data and nobody else?
ConfidentialityCIA triadInformation Security Principles - Question #272Security Concepts and Practices
Making sure that the data has not been changed unintentionally, due to an accident or malice is:
Data integrityCIA triadInformation security principlesSecurity concepts - Question #273Security Operations and Administration
Which of the following are the steps usually followed in the development of documents such as security policy, standards and procedures?
Security Policy DevelopmentPolicy LifecycleInformation Security GovernanceSecurity Documentation - Question #274Systems and Application Security
Buffer overflow and boundary condition errors are subsets of which of the following?
Buffer overflowsInput validationSoftware vulnerabilitiesApplication security - Question #275Access Controls
Ensuring least privilege does not require:
Least PrivilegeSeparation of DutiesAccess Control PrinciplesSecurity Principles - Question #276Security Concepts and Practices
Who is responsible for initiating corrective measures and capabilities used when there are security violations?
Roles and ResponsibilitiesSecurity GovernanceCorrective ActionsIncident Management Oversight - Question #277Security Concepts and Practices
What can best be defined as high-level statements, beliefs, goals and objectives?
PoliciesSecurity GovernanceSecurity Documentation - Question #278Security Concepts and Practices
In an organization, an Information Technology security function should:
Organizational StructureSecurity GovernanceReporting LinesChief Security Officer - Question #279Security Concepts and Practices
IT security measures should:
Security program managementSecurity strategyOrganizational security goalsTailored security - Question #280Systems and Application Security
Which of the following does not address Database Management Systems (DBMS) Security?
DBMS SecurityData ProtectionPrivacy Enhancing TechnologiesIntrusion Detection/Response - Question #281Access Controls
Which of the following security modes of operation involves the highest risk?
Security Modes of OperationMultilevel SecurityAccess Control ModelsSystem Security Risk - Question #282Systems and Application Security
During which phase of an IT system life cycle are security requirements developed?
SDLCSecurity RequirementsSecure DesignSystem Acquisition - Question #283Systems and Application Security
Which of the following phases of a system development life-cycle is most concerned with establishing a good security policy as the foundation for design?
SDLCInitiation PhaseSecurity PolicySecurity Requirements - Question #284Systems and Application Security
When considering an IT System Development Life-cycle, security should be:
SDLCSecurity by DesignSecure DevelopmentApplication Security - Question #285Systems and Application Security
Risk reduction in a system development life-cycle should be applied:
Risk ReductionSDLC SecuritySecurity IntegrationContinuous Security - Question #286Security Operations and Administration
Which of the following phases of a system development life-cycle is most concerned with maintaining proper authentication of users and processes to ensure appropriate access contro...
SDLCSecurity OperationsAuthenticationAccess Control - Question #287Security Concepts and Practices
What can be defined as: It confirms that users' needs have been met by the supplied solution?
AcceptanceUser AcceptanceSolution DeliveryProject Lifecycle - Question #288Access Controls
Which of the following statements pertaining to the security kernel is incorrect?
Security KernelReference MonitorTrusted Computing Base (TCB)Access Control Enforcement - Question #289Systems and Application Security
Which of the following best corresponds to the type of memory addressing where the address location that is specified in the program instruction contains the address of the final d...
Memory addressingIndirect addressingComputer architecture fundamentals - Question #290Access Controls
Which of the following security mode of operation does NOT require all users to have the clearance for all information processed on the system?
Security Modes of OperationMultilevel SecurityAccess Control ModelsSystem Security - Question #291Access Controls
What prevents a process from accessing another process' data?
Process isolationMemory protectionOperating system securityAccess control - Question #292Security Concepts and Practices
What can best be defined as the sum of protection mechanisms inside the computer, including hardware, firmware and software?
Trusted Computing BaseSystem Security ArchitectureSecurity Models - Question #293Security Concepts and Practices
A trusted system does NOT involve which of the following?
Trusted SystemsSecurity Policy EnforcementSecurity ArchitectureAssurance - Question #294Security Concepts and Practices
What can be described as an imaginary line that separates the trusted components of the TCB from those elements that are NOT trusted?
Security PerimeterTrusted Computing Base (TCB)Security ArchitectureSecurity Concepts - Question #295Systems and Application Security
A Security Kernel is defined as a strict implementation of a reference monitor mechanism responsible for enforcing a security policy. To be secure, the kernel must meet three basic...
Security KernelReference MonitorOperating System SecurityTrusted Computing Base - Question #296Systems and Application Security
What can best be defined as the detailed examination and testing of the security features of an IT system or product to ensure that they work correctly and effectively and do not s...
Security EvaluationSystem Security TestingSecurity AssuranceCommon Criteria - Question #297Security Concepts and Practices
Which of the following is NOT a common integrity goal?
Information IntegrityCIA TriadSecurity GoalsConfidentiality vs. Integrity - Question #298Security Concepts and Practices
When it comes to magnetic media sanitization, what difference can be made between clearing and purging information?
Media SanitizationData DisposalClearingPurging - Question #299Security Operations and Administration
What is the main issue with media reuse?
Data remanenceMedia sanitizationSecure data disposalStorage security - Question #300Security Operations and Administration
Which of the following should NOT be performed by an operator?
Operator rolesSystem operationsSeparation of dutiesJob responsibilities - Question #301Security Concepts and Practices
Which of the following is not appropriate in addressing object reuse?
Object ReuseData SanitizationData RemanenceSecure Disposal - Question #302Security Concepts and Practices
Who of the following is responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of IT systems and data?
Information Security RolesAccountabilitySystem OwnershipData Security Governance - Question #303Security Concepts and Practices
An effective information security policy should not have which of the following characteristic?
Information Security PolicyPolicy CharacteristicsSecurity GovernancePolicy Design - Question #304Security Concepts and Practices
Which of the following choice is NOT normally part of the questions that would be asked in regards to an organization's information security policy?
Information security policyPolicy vs. ProcedureSecurity governanceDisaster recovery planning