[ISC2] SSCP - Systems Security Practitioner Exam Dumps & Study Guide

Free [ISC2] SSCP - Systems Security Practitioner Practice Questions Preview

• Question 1

  A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:
  

  • A. concern that the laser beam may cause eye damage
  • B. the iris pattern changes as a person grows older.
  • C. there is a relatively high rate of false accepts.
  • D. the optical unit must be positioned so that the sun does not shine into the aperture.

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer D.
  Reasoning: The question specifically asks about a potential problem related to the *physical installation* of the iris scanner. Option D, "the optical unit must be positioned so that the sun does not shine into the aperture," directly addresses a physical installation concern. Direct sunlight interfering with the optical unit's ability to accurately scan the iris is a plausible and relevant issue during setup. This aligns with the discussion summary that emphasizes the correct answer being related to physical installation.
  Reasons for not choosing other options:

  • A: "concern that the laser beam may cause eye damage" - While a valid concern for some biometric systems, modern iris scanners do not use lasers. They use near-infrared light, which is safe for the eyes. NIST Iris Recognition
  • B: "the iris pattern changes as a person grows older" - The iris pattern is considered stable throughout adulthood. This is a fundamental aspect of iris recognition's reliability. Cambridge University Iris Recognition
  • C: "there is a relatively high rate of false accepts" - The iris recognition has one of the lowest false acceptance rates of all biometric identification technologies. This is also not directly related to the physical installation of the device. Gemalto Iris Recognition

• Question 2

  In Mandatory Access Control, sensitivity labels attached to object contain what information?
  

  • A. The item's classification
  • B. The item's classification and category set
  • C. The item's category
  • D. The items's need to know

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer, B, which states that in Mandatory Access Control (MAC), sensitivity labels attached to an object contain the item's classification and category set.
  
  Reasoning:
  Mandatory Access Control (MAC) is a security model where the operating system enforces access control policies based on predetermined classifications and categories. Sensitivity labels are crucial components of MAC, as they define the security level of an object (e.g., a file or process). These labels typically include:

  • Classification: Indicates the sensitivity level of the data (e.g., Confidential, Secret, Top Secret).
  • Category Set (or Compartment): Further refines access control by grouping data into specific categories (e.g., HR, Finance, Engineering). An item can belong to multiple categories, and the combination of these categories forms the category set or compartment set.

  Therefore, for an effective MAC implementation, sensitivity labels must include both the classification and the category set.
  
  Why other options are incorrect:

  • A. The item's classification: While classification is a necessary component, it's insufficient on its own. A category set is also needed to provide finer-grained control.
  • C. The item's category: Similar to option A, specifying only the category is insufficient as it lacks the broader classification level.
  • D. The item's need to know: While "need to know" is a security principle, it's not directly represented in the sensitivity label itself within a MAC system. The sensitivity label, by defining classification and categories, implicitly dictates who has a "need to know."

  Citation:

  • Mandatory Access Control, http://en.wikipedia.org/wiki/Mandatory_Access_Control

• Question 3

  What are the components of an object's sensitivity label?
  

  • A. A Classification Set and a single Compartment.
  • B. A single classification and a single compartment.
  • C. A Classification Set and user credentials.
  • D. A single classification and a Compartment Set.

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer, D.
  The components of an object's sensitivity label are a single classification and a Compartment Set. A classification defines the level of sensitivity (e.g., Confidential, Secret, Top Secret), while the Compartment Set specifies categories or sub-groupings within that classification.
  Here's a breakdown of why the other options are incorrect:

  • A. A Classification Set and a single Compartment: This is incorrect because the term "Classification Set" is not standard. There's typically a single, defined classification. Also, it's a "Compartment Set," not a "single Compartment."
  • B. A single classification and a single compartment: This is incorrect because while "single classification" is correct, it is not a single compartment, but a Compartment Set.
  • C. A Classification Set and user credentials: This is incorrect because the term "Classification Set" is not standard and user credentials are not part of an object's sensitivity label. User credentials are used for authentication and authorization.

  In summary, option D accurately reflects the structure of a sensitivity label, using the correct terminology for both classification and compartments.

• Question 4

  What does it mean to say that sensitivity labels are "incomparable"?
  

  • A. The number of classification in the two labels is different.
  • B. Neither label contains all the classifications of the other.
  • C. the number of categories in the two labels are different.
  • D. Neither label contains all the categories of the other.

  Correct Answer: D

  Explanation:

  The suggested answer is correct. The question asks what it means for sensitivity labels to be "incomparable."
  The best answer is D: Neither label contains all the categories of the other.
  Reasoning: The definition of incomparable sensitivity labels, in the context of Mandatory Access Control (MAC) and Multilevel Security (MLS), means that neither label contains all the categories (or compartments) of the other. This prevents a clear hierarchical relationship from being established, thus rendering them incomparable.
  The provided suggested answer explanation aligns with this definition and accurately describes the concept of incomparability in sensitivity labels, as used in security models.
  The example provided in the suggested answer is helpful:

  • TOP SECRET [VENUS]
  • SECRET [ALPHA]

  These are incomparable because one has the category VENUS and the other has the category ALPHA, and neither has both.
  Reasons for not choosing the other answers:

  • A: The number of classifications in the two labels is different. - This is not the primary reason for incomparability. The categories or compartments are what matter.
  • B: Neither label contains all the classifications of the other. - Again, the categories (compartments) are the determining factor, not the classifications themselves.
  • C: The number of categories in the two labels are different. - The number of categories is not the defining factor. Incomparability arises when the *specific* categories are different such that neither label encompasses the other's categories. It is possible that one category could exist more than once in one sensitivity label and exist in the other, thus making them comparable.

  The concepts of dominance and the MLS security lattice, while related, are not directly defining what "incomparable" means, but provide context.

• Question 5

  Which of the following is true about Kerberos?
  

  • A. It utilizes public key cryptography.
  • B. It encrypts data after a ticket is granted, but passwords are exchanged in plain text.
  • C. It depends upon symmetric ciphers.
  • D. It is a second party authentication system.

  Correct Answer: C

  Explanation:

  The AI agrees with the suggested answer of C.
  The best answer is C. It depends upon symmetric ciphers.
  Reasoning: Kerberos is a network authentication protocol that uses symmetric-key cryptography to provide strong authentication for client/server applications. It relies on shared secret keys between the client, the server, and a trusted third party (the Key Distribution Center or KDC).
  Option A is incorrect because Kerberos primarily uses symmetric-key cryptography, not public-key cryptography, although some implementations may incorporate public-key elements for specific purposes.
  Option B is incorrect because while Kerberos does encrypt data after a ticket is granted, the password itself is never exchanged in plain text. Instead, the password is used to derive an encryption key.
  Option D is incorrect because Kerberos is a third-party authentication system. The client authenticates to the Kerberos server (KDC), which then issues a ticket for the client to use when authenticating to the actual service it wants to access.

  • Citations:
  • MIT Kerberos, http://web.mit.edu/kerberos/
  • Wikipedia Kerberos (protocol), http://en.wikipedia.org/wiki/Kerberos_%28protocol%29

• Question 6

  Which of the following is needed for System Accountability?
  

  • A. Audit mechanisms.
  • B. Documented design as laid out in the Common Criteria.
  • C. Authorization.
  • D. Formal verification of system design.

  Correct Answer: A

  Explanation:

  The AI agrees with the suggested answer, which is A: Audit mechanisms.
  Reasoning: Audit mechanisms are essential for system accountability because they provide a means to track and record user actions within the system. These logs can then be reviewed to verify what actions were performed, linking actions back to specific users, thus enabling accountability.
  Reasons for Incorrectness of Other Options:

  • B. Documented design as laid out in the Common Criteria: While Common Criteria is an important security standard, it primarily focuses on the evaluation and validation of security products and systems, not directly on establishing accountability for user actions within a system.
  • C. Authorization: Authorization is the process of granting access rights to users or processes. While it's a part of overall security, it doesn't inherently ensure accountability. A user may be authorized to perform an action but still not be held accountable for it if their actions are not tracked.
  • D. Formal verification of system design: Formal verification is a rigorous process used to mathematically prove the correctness of a system's design. It ensures that the system behaves as intended, but it does not provide a mechanism for tracking user actions and establishing accountability.

  The OIG CBK Glossary (page 778) supports this by defining accountability as the ability to identify users and track their actions, which directly aligns with the purpose of audit mechanisms.

• Question 7

  What is Kerberos?
  

  • A. A three-headed dog from the egyptian mythology.
  • B. A trusted third-party authentication protocol.
  • C. A security model.
  • D. A remote authentication dial in user server.

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer.
  The suggested answer is B: A trusted third-party authentication protocol.
  Reasoning: Kerberos is indeed a network authentication protocol that uses tickets to allow nodes to communicate securely over a non-secure network. It relies on a trusted third party (Key Distribution Center) to authenticate users and services. This aligns perfectly with the definition of Kerberos.
  Reasons for Incorrect Answers:

  • A. A three-headed dog from the egyptian mythology: This is incorrect because Kerberos's name is derived from Greek Mythology, not Egyptian, and has nothing to do with information security concepts.
  • C. A security model: This is incorrect because while Kerberos implements a security model, it is specifically an authentication protocol, providing more than just a general model.
  • D. A remote authentication dial in user server: This is incorrect because RADIUS (Remote Authentication Dial-In User Service) is the protocol that describes a remote authentication dial in user server, not Kerberos.

• Question 8

  The three classic ways of authenticating yourself to the computer security software are by something you know, by something you have, and by something:
  

  • A. you need.
  • B. non-trivial
  • C. you are.
  • D. you can get.

  Correct Answer: C

  Explanation:

  The AI assistant agrees with the suggested answer, C (you are). This corresponds to the "something you are" authentication factor, which encompasses biometrics. The three factors of authentication are: something you know (e.g., password), something you have (e.g., smart card), and something you are (e.g., fingerprint).

  The reason for choosing option C is because it correctly completes the triad of authentication factors: something you know, something you have, and something you are. This is a fundamental concept in security.

  The other options are incorrect because they do not represent established authentication factors. Options A, B, and D do not align with the standard categories used to classify authentication methods.

  • "Something you need" is not a recognized authentication factor.
  • "Non-trivial" is a characteristic of a good password (something you know) but not a factor itself.
  • "Something you can get" is too vague and doesn't correspond to a defined authentication factor.

  Citations:

  • NIST, An Introduction to Computer Security: The NIST Handbook, https://csrc.nist.gov/publications/detail/sp/800-12/rev-1/final
  • SSCP CBK, Official Study Guide

• Question 9

  A timely review of system access audit records would be an example of which of the basic security functions?
  

  • A. avoidance.
  • B. deterrence.
  • C. prevention.
  • D. detection.

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer, D (detection).
  Reasoning:

  • A timely review of system access audit records directly supports the detection of security incidents or unauthorized activities. Audit logs provide a record of events that have occurred, and reviewing them allows for the identification of anomalies or breaches that might otherwise go unnoticed.
  • The SSCP CBK (Common Body of Knowledge) emphasizes the importance of monitoring and auditing as key components of a robust security program. Detection mechanisms are critical for identifying and responding to security incidents.

  Reasons for eliminating other options:

  • Avoidance: Avoidance aims to prevent a threat from materializing in the first place. Reviewing audit logs doesn't avoid threats, it identifies them after they've potentially occurred.
  • Deterrence: Deterrence aims to discourage potential attackers. While the presence of auditing *might* have a deterrent effect, the act of reviewing logs is primarily focused on identifying past events, not deterring future ones.
  • Prevention: Prevention aims to stop an incident from happening. Log review happens after events, so it can't prevent them.

  Citations:

  • SSCP CBK (Common Body of Knowledge) https://www.isc2.org/certifications/sccp

• Question 10

  A confidential number used as an authentication factor to verify a user's identity is called a:
  

  • A. PIN
  • B. User ID
  • C. Password
  • D. Challenge

  Correct Answer: A

  Explanation:

  The AI assistant agrees with the suggested answer A (PIN). A PIN (Personal Identification Number) is specifically designed as a confidential numeric password used to authenticate a user's identity.
  Reasoning:

  • A PIN is inherently numeric and intended for authentication, aligning perfectly with the question's description.
  • PINs are commonly used in scenarios requiring secure identity verification, such as ATM transactions or accessing mobile devices.

  Reasons for not choosing other options:

  • B. User ID: A User ID is used for identification, not necessarily authentication, and isn't required to be numeric.
  • C. Password: While passwords are used for authentication, they are not limited to numeric characters and can include letters and symbols.
  • D. Challenge: A challenge is part of a challenge-response authentication system, but the challenge itself is not necessarily a confidential number used directly as an authentication factor in the same way a PIN is.