SSCP practice test

1. Question 1 · 1

   A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

   Choose one answer.

   • concern that the laser beam may cause eye damage
   • the iris pattern changes as a person grows older.
   • there is a relatively high rate of false accepts.
   • the optical unit must be positioned so that the sun does not shine into the aperture.

2. Question 2 · 1

   A confidential number used as an authentication factor to verify a user's identity is called a:

   Choose one answer.

   • PIN
   • User ID
   • Password
   • Challenge

   Read explanation

   PIN Stands for Personal Identification Number, as the name states it is a combination of numbers. The following answers are incorrect: User ID This is incorrect because a Userid is not required to be a number and a Userid is only used to establish identity not verify it. Password. This is incorrect because a password is not required to be a number, it could be any combination of characters. Challenge. This is incorrect because a challenge is not defined as a number, it could be anything.

3. Question 3 · 1

   Which of the following exemplifies proper separation of duties?

   Choose one answer.

   • Operators are not permitted modify the system time.
   • Programmers are permitted to use the system console.
   • Console operators are permitted to mount tapes and disks.
   • Tape operators are permitted to use the system console.

   Read explanation

   This is an example of Separation of Duties because operators are prevented from modifying the system time which could lead to fraud. Tasks of this nature should be performed by they system administrators. AIO defines Separation of Duties as a security principle that splits up a critical task among two or more individuals to ensure that one person cannot complete a risky task by himself. The following answers are incorrect: Programmers are permitted to use the system console. Is incorrect because programmers should not be permitted to use the system console, this task should be performed by operators. Allowing programmers access to the system console could allow fraud to occur so this is not an example of Separation of Duties.. Console operators are permitted to mount tapes and disks. Is incorrect because operators should be able to mount tapes and disks so this is not an example of Separation of Duties. Tape operators are permitted to use the system console. Is incorrect because operators should be able to use the system console so this is not an example of Separation of Duties. References: OIG CBK Access Control (page 98 - 101) AIOv3 Access Control (page 182)

4. Question 4 · 1

   Which of the following statements pertaining to access control is false?

   Choose one answer.

   • Users should only access data on a need-to-know basis.
   • If access is not explicitly denied, it should be implicitly allowed.
   • Access rights should be granted based on the level of trust a company has on a subject.
   • Roles can be an efficient way to assign rights to a type of user who performs certain tasks.

   Read explanation

   Access control mechanisms should default to no access to provide the necessary level of security and ensure that no security holes go unnoticed. If access is not explicitly allowed, it should be implicitly denied. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 4: Access Control (page 143).

5. Question 5 · 1

   Which of the following is not a logical control when implementing logical access security?

   Choose one answer.

   • access profiles.
   • userids.
   • employee badges.
   • passwords.

   Read explanation

   Employee badges are considered Physical so would not be a logical control. The following answers are incorrect: userids. Is incorrect because userids are a type of logical control. access profiles. Is incorrect because access profiles are a type of logical control. passwords. Is incorrect because passwords are a type of logical control.

6. Question 6 · 1

   What is the difference between Access Control Lists (ACLs) and Capability Tables?

   Choose one answer.

   • Access control lists are related/attached to a subject whereas capability tables are related/attached to an object.
   • Access control lists are related/attached to an object whereas capability tables are related/attached to a subject.
   • Capability tables are used for objects whereas access control lists are used for users.
   • They are basically the same.

   Read explanation

   Capability tables are used to track, manage and apply controls based on the object and rights, or capabilities of a subject. For example, a table identifies the object, specifies access rights allowed for a subject, and permits access based on the user's posession of a capability (or ticket) for the object. It is a row within the matrix. To put it another way, A capabiltiy table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL. CLEMENT NOTE: If we wish to express this very simply: Capabilities are attached to a subject and it describe what access the subject has to each of the objects on the row that matches with the subject within the matrix. It is a row within the matrix. ACL's are attached to objects, it describe who has access to the object and what type of access they have. It is a column within the matrix. The following are incorrect answers: "Access control lists are subject-based whereas capability tables are object-based" is incorrect. "Capability tables are used for objects whereas access control lists are used for users" is incorrect. "They are basically the same" is incorrect. References used for this question: CBK, pp. 191 - 192 - AIO3 p. 169

7. Question 7 · 1

   How are memory cards and smart cards different?

   Choose one answer.

   • Memory cards normally hold more memory than smart cards
   • Smart cards provide a two-factor authentication whereas memory cards don't
   • Memory cards have no processing power
   • Only smart cards can be used for ATM cards

   Read explanation

   The main difference between memory cards and smart cards is their capacity to process information. A memory card holds information but cannot process information. A smart card holds information and has the necessary hardware and software to actually process that information. A memory card holds a users authentication information, so that this user needs only type in a user ID or PIN and presents the memory card to the system. If the entered information and the stored information match and are approved by an authentication service, the user is successfully authenticated. A common example of a memory card is a swipe card used to provide entry to a building. The user enters a PIN and swipes the memory card through a card reader. If this is the correct combination, the reader flashes green and the individual can open the door and enter the building. Memory cards can also be used with computers, but they require a reader to process the information. The reader adds cost to the process, especially when one is needed for every computer. Additionally, the overhead of PIN and card generation adds additional overhead and complexity to the whole authentication process. However, a memory card provides a more secure authentication method than using only a password because the attacker would need to obtain the card and know the correct PIN. Administrators and management need to weigh the costs and benefits of a memory card implementation as well as the security needs of the organization to determine if it is the right authentication mechanism for their environment. One of the most prevalent weaknesses of memory cards is that data stored on the card are not protected. Unencrypted data on the card (or stored on the magnetic strip) can be extracted or copied. Unlike a smart card, where security controls and logic are embedded in the integrated circuit, memory cards do not employ an inherent mechanism to protect the data from exposure. Very little trust can be associated with confidentiality and integrity of information on the memory cards. The following answers are incorrect: "Smart cards provide two-factor authentication whereas memory cards don't" is incorrect. This is not necessarily true. A memory card can be combined with a pin or password to offer two factors authentication where something you have and something you know are used for factors. "Memory cards normally hold more memory than smart cards" is incorrect. While a memory card may or may not have more memory than a smart card, this is certainly not the best answer to the question. "Only smart cards can be used for ATM cards" is incorrect. This depends on the decisions made by the particular institution and is not the best answer to the question. Reference(s) used for this question: Shon Harris, CISSP All In One, 6th edition , Access Control, Page 199 and also for people using the Kindle edition of the book you can look at Locations 4647- 4650. Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Access Control ((ISC)2 Press) (Kindle Locations 2124-2139). Auerbach Publications. Kindle Edition.

8. Question 8 · 1

   What Orange Book security rating is reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions?

   Choose one answer.

   • A
   • D
   • E
   • F

   Read explanation

   D or "minimal protection" is reserved for systems that were evaluated under the TCSEC but did not meet the requirements for a higher trust level. A is incorrect. A or "Verified Protectection" is the highest trust level under the TCSEC. E is incorrect. The trust levels are A - D so "E" is not a valid trust level. F is incorrect. The trust levels are A - D so "F" is not a valid trust level. CBK, pp. 329 - 330 - AIO3, pp. 302 - 306

9. Question 9 · 1

   Smart cards are an example of which type of control?

   Choose one answer.

   • Detective control
   • Administrative control
   • Technical control
   • Physical control

10. Question 10 · 1

    What security model implies a central authority that define rules and sometimes global rules, dictating what subjects can have access to what objects?

    Choose one answer.

    • Flow Model
    • Discretionary access control
    • Mandatory access control
    • Non-discretionary access control

11. Question 11 · 1

    Which of the following statements pertaining to biometrics is false?

    Choose one answer.

    • Increased system sensitivity can cause a higher false rejection rate
    • The crossover error rate is the point at which false rejection rate equals the false acceptance rate.
    • False acceptance rate is also known as Type II error.
    • Biometrics are based on the Type 2 authentication mechanism.

    Read explanation

    Authentication is based on three factor types: type 1 is something you know, type 2 is something you have and type 3 is something you are. Biometrics are based on the Type 3 authentication mechanism. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 37).

12. Question 12 · 1

    What refers to legitimate users accessing networked services that would normally be restricted to them?

    Choose one answer.

    • Spoofing
    • Piggybacking
    • Eavesdropping
    • Logon abuse D

13. Question 13 · 1

    Which of the following is not a two-factor authentication mechanism?

    Choose one answer.

    • Something you have and something you know.
    • Something you do and a password.
    • A smartcard and something you are.
    • Something you know and a password.

    Read explanation

    Something you know and a password fits within only one of the three ways authentication could be done. A password is an example of something you know, thereby something you know and a password does not constitute a two-factor authentication as both are in the same category of factors. A two-factor (strong) authentication relies on two different kinds of authentication factors out of a list of three possible choice: something you know (e.g. a PIN or password), something you have (e.g. a smart card, token, magnetic card), something you are is mostly Biometrics (e.g. a fingerprint) or something you do (e.g. signature dynamics). TIP FROM CLEMENT: On the real exam you can expect to see synonyms and sometimes sub-categories under the main categories. People are familiar with Pin, Passphrase, Password as subset of Something you know. However, when people see choices such as Something you do or Something you are they immediately get confused and they do not think of them as subset of Biometrics where you have Biometric implementation based on behavior and physilogical attributes. So something you do falls under the Something you are category as a subset. Something your do would be signing your name or typing text on your keyboard for example. Strong authentication is simply when you make use of two factors that are within two different categories. Reference(s) used for this question: Shon Harris, CISSP All In One, Fifth Edition, pages 158-159

14. Question 14 · 1

    Which of the following access control models requires defining classification for objects?

    Choose one answer.

    • Role-based access control
    • Discretionary access control
    • Identity-based access control
    • Mandatory access control

    Read explanation

    With mandatory access control (MAC), the authorization of a subject's access to an object is dependant upon labels, which indicate the subject's clearance, and classification of objects. The Following answers were incorrect: Identity-based Access Control is a type of Discretionary Access Control (DAC), they are synonymous. Role Based Access Control (RBAC) and Rule Based Access Control (RuBAC or RBAC) are types of Non Discretionary Access Control (NDAC). Tip: When you have two answers that are synonymous they are not the right choice for sure. There is only one access control model that makes use of Label, Clearances, and Categories, it is Mandatory Access Control, none of the other one makes use of those items. Reference(s) used for this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 33).

15. Question 15 · 1

    Which of the following statements pertaining to Kerberos is false?

    Choose one answer.

    • The Key Distribution Center represents a single point of failure.
    • Kerberos manages access permissions.
    • Kerberos uses a database to keep a copy of all users' public keys.
    • Kerberos uses symmetric key cryptography.

    Read explanation

    Kerberos is a trusted, credential-based, third-party authentication protocol that uses symmetric (secret) key cryptography to provide robust authentication to clients accessing services on a network. One weakness of Kerberos is its Key Distribution Center (KDC), which represents a single point of failure. The KDC contains a database that holds a copy of all of the symmetric/secret keys for the principals. Reference(s) used for this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page40).

Paid access to all 96 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.