SSCP Practice Test — 1038 Free Questions Online

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

1038Practice Questions

3Study Modes

Free

TopicSort

Question 1

Security Concepts and Practices

Which of the following is not one of the three goals of Integrity addressed by the Clark-Wilson model?

A Prevention of the modification of information by unauthorized users.
B Prevention of the unauthorized or unintentional modification of information by authorized users.
C Preservation of the internal and external consistency.
D Prevention of the modification of information by authorized users.

Question 2

Network and Communications Security

Question 3

Systems and Application Security

Question 4

Risk Identification, Monitoring and Analysis

Question 5

Security Concepts and Practices

Question 6

Systems and Application Security

Question 7

Network and Communications Security

Question 8

Systems and Application Security

Question 9

Network and Communications Security

Question 10

Network and Communications Security

Question 11

Network and Communications Security

Question 12

Access Controls

Question 13

Security Concepts and Practices

Question 14

Security Concepts and Practices

Question 15

Incident Response and Recovery

Question 16

Risk Identification, Monitoring and Analysis

Question 17

Access Controls

Question 18

Access Controls

Question 19

Security Concepts and Practices

Question 20

Access Controls

Question 21

Access Controls

Question 22

Network and Communications Security

Question 23

Access Controls

Question 24

Access Controls

Question 25

Access Controls

Page 1 of 42 • Questions 1-25 of 1038

1 2 3 4 5

→

Know a question that should be here? Contribute to this exam

What would BEST define a covert channel?

A An undocumented backdoor that has been left by a programmer in an operating system
B An open system port that should be closed.
C A communication channel that allows transfer of information in a manner that violates the system's security policy.
D A trojan horse.

Which of the following statements pertaining to protection rings is false?

A They provide strict boundaries and definitions on what the processes that work within each ring can access.
B Programs operating in inner rings are usually referred to as existing in a privileged mode.
C They support the CIA triad requirements of multitasking operating systems.
D They provide users with a direct access to peripherals D

An Intrusion Detection System (IDS) is what type of control?

A A preventive control.
B A detective control.
C A recovery control.
D A directive control.

Which of the following should NOT be performed by an operator?

A Implementing the initial program load
B Monitoring execution of the system
C Data entry
D Controlling job flow

Question 6

Systems and Application Security

Question 7

Network and Communications Security

Question 8

Systems and Application Security

Question 9

Network and Communications Security

Question 10

Network and Communications Security

Question 11

Network and Communications Security

Question 12

Access Controls

Question 13

Security Concepts and Practices

Question 14

Security Concepts and Practices

Question 15

Incident Response and Recovery

Question 16

Risk Identification, Monitoring and Analysis

Question 17

Access Controls

Question 18

Access Controls

Question 19

Security Concepts and Practices

Question 20

Access Controls

Question 21

Access Controls

Question 22

Network and Communications Security

Question 23

Access Controls

Question 24

Access Controls

Question 25

Access Controls

Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of a software product?

A Estimating the cost of the changes requested
B Recreating and analyzing the problem
C Determining the interface that is presented to the user
D Establishing the priorities of requests

In the days before CIDR (Classless Internet Domain Routing), networks were commonly organized by classes. Which of the following would have been true of a
Class B network?

A The first bit of the IP address would be set to zero.
B The first bit of the IP address would be set to one and the second bit set to zero.
C The first two bits of the IP address would be set to one, and the third bit set to zero.
D The first three bits of the IP address would be set to one.

Which of the following phases of a software development life cycle normally incorporates the security specifications, determines access controls, and evaluates encryption options?

A Detailed design
B Implementation
C Product design
D Software plans and requirements

Secure Shell (SSH-2) supports authentication, compression, confidentiality, and integrity, SSH is commonly used as a secure alternative to all of the following protocols below except:

A telnet
B rlogin
C RSH
D HTTPS

Which of the following IEEE standards defines the token ring media access method?

A 802.3
B 802.11
C 802.5
D 802.2

Communications and network security relates to transmission of which of the following?

A voice
B voice and multimedia
C data and multimedia
D voice, data and multimedia

Which of the following is NOT true concerning Application Control?

A It limits end users use of applications in such a way that only particular screens are visible.
B Only specific records can be requested through the application controls
C Particular usage of the application can be recorded for audit purposes
D It is non-transparent to the endpoint applications so changes are needed to the applications and databases involved

External consistency ensures that the data stored in the database is:

A in-consistent with the real world.
B remains consistant when sent from one system to another.
C consistent with the logical world.
D consistent with the real world.

Which of the following security modes of operation involves the highest risk?

A Compartmented Security Mode
B Multilevel Security Mode
C System-High Security Mode
D Dedicated Security Mode

When first analyzing an intrusion that has just been detected and confirming that it is a true positive, which of the following actions should be done as a first step if you wish to prosecute the attacker in court?

A Back up the compromised systems.
B Identify the attacks used to gain access.
C Capture and record system information.
D Isolate the compromised systems.

The number of violations that will be accepted or forgiven before a violation record is produced is called which of the following?

A clipping level
B acceptance level
C forgiveness level
D logging level

Examples of types of physical access controls include all EXCEPT which of the following?

A badges
B locks
C guards
D passwords

Which of the following is addressed by Kerberos?

A Confidentiality and Integrity
B Authentication and Availability
C Validation and Integrity
D Auditability and Integrity

Which of the following classes is the first level (lower) defined in the TCSEC (Orange Book) as mandatory protection?

A B
B A
C C
D D

What are called user interfaces that limit the functions that can be selected by a user?

A Constrained user interfaces
B Limited user interfaces
C Mini user interfaces
D Unlimited user interfaces

What is called an automated means of identifying or authenticating the identity of a living person based on physiological or behavioral characteristics?

A Biometrics
B Micrometrics
C Macrometrics
D MicroBiometrics

Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers to verify a user's identity which permit access to system services?

A Single Sign-On
B Dynamic Sign-On
C Smart cards
D Kerberos

Which of the following is a trusted, third party authentication protocol that was developed under Project Athena at MIT?

A Kerberos
B SESAME
C KryptoKnight
D NetSP

Which of the following biometric devices offers the LOWEST CER?

A Keystroke dynamics
B Voice verification
C Iris scan
D Fingerprint

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

A Mandatory Access Control
B Discretionary Access Control
C Non-Discretionary Access Control
D Rule-based Access control

Join Us Among the Stars

SSCPPreview

About the SSCP Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25