ISC2 SSCP

What is the primary purpose of the principle of least privilege?

• ATo ensure users have access to all resources they might need
• BTo restrict users access rights to only what is strictly necessary for their job function
• CTo allow administrators unlimited access for troubleshooting
• DTo enable single sign-on across all enterprise systems

Which of the following best describes non-repudiation in information security?

• AThe ability to deny having performed an action
• BThe assurance that a user cannot deny having performed a specific action
• CThe process of removing sensitive data from systems
• DThe encryption of all communications

What does the CIA triad stand for in information security?

• AConfidentiality, Integrity, Availability
• BControl, Identification, Authentication
• CCybersecurity, Information, Assurance
• DCentral Intelligence Agency

In security governance, what is the primary role of senior management?

• AImplementing technical security controls
• BEstablishing security policies and providing adequate resources
• CPerforming daily security monitoring tasks
• DWriting security code for applications

Which security control type focuses on restoring systems after a security incident?

• APreventive control
• BDetective control
• CCorrective control
• DDeterrent control

What is the purpose of separation of duties in an organization?

• ATo ensure employees specialize in specific tasks
• BTo prevent any single individual from having complete control over a critical process
• CTo reduce the number of employees needed
• DTo simplify audit procedures

Which of the following best describes defense in depth?

• AUsing a single strong security control
• BImplementing multiple overlapping security controls to protect assets
• CFocusing only on perimeter security
• DDeploying the same security control across all systems

According to the ISC2 Code of Ethics, which action is required when a certificant discovers a violation of the code?

• AIgnore it if it does not involve the certificant directly
• BReport the violation to appropriate authorities
• CConfront the violator publicly
• DDocument the violation but take no action

What is the difference between authentication and authorization?

• AThey are the same thing
• BAuthentication verifies identity; authorization determines access rights
• CAuthentication determines access rights; authorization verifies identity
• DAuthentication is for networks; authorization is for applications

In Role-Based Access Control (RBAC), how are permissions assigned?

• ADirectly to individual users
• BBased on the users job function or role within the organization
• CRandomly assigned by the system
• DBased on the time of day

Which biometric authentication factor is considered something you are?

• ASmart card
• BFingerprint
• CPassword
• DSecurity token

What is the primary advantage of Multi-Factor Authentication (MFA)?

• AIt eliminates the need for passwords
• BIt requires multiple types of authentication factors, increasing security
• CIt is easier for users than single-factor authentication
• DIt is less expensive to implement

In Mandatory Access Control (MAC), who determines access rights?

• AIndividual users
• BData owners
• CSecurity administrators based on security labels
• DDepartment managers

Which access control model allows resource owners to determine who has access?

• AMandatory Access Control (MAC)
• BRole-Based Access Control (RBAC)
• CDiscretionary Access Control (DAC)
• DAttribute-Based Access Control (ABAC)

What is a shoulder surfing attack?

• AHacking into a network remotely
• BPhysically observing someone entering credentials
• CSending phishing emails
• DInstalling malware on a system

What is the Identity Lifecycle?

• AThe process of creating and deleting user accounts only
• BThe ongoing management of digital identities from creation to retirement
• CThe hardware replacement schedule for authentication devices
• DThe process of encrypting user credentials

What is the formula for calculating risk?

• ARisk = Threat / Vulnerability
• BRisk = Threat × Vulnerability × Impact
• CRisk = Asset Value - Countermeasure Cost
• DRisk = Probability × Loss Magnitude

Which risk treatment option involves transferring risk to a third party?

• ARisk mitigation
• BRisk acceptance
• CRisk transference
• DRisk avoidance

What is threat modeling?

• ACreating 3D models of physical threats
• BA structured approach to identifying and evaluating potential threats to a system
• CA method for encrypting threat data
• DThe process of hiring security guards

Which of the following is a quantitative risk analysis method?

• ADelphi technique
• BAnnualized Loss Expectancy (ALE)
• CBrainstorming sessions
• DExpert judgment

What is the primary purpose of security monitoring?

• ATo replace the need for firewalls
• BTo detect and respond to security events in real-time
• CTo eliminate all security threats
• DTo reduce the cost of security operations

What is a vulnerability assessment?

• AThe process of hiring security consultants
• BA systematic examination of systems to identify security weaknesses
• CA method for encrypting data
• DThe process of updating antivirus software

What is the difference between vulnerability scanning and penetration testing?

• AThere is no difference
• BVulnerability scanning identifies weaknesses; penetration testing exploits them
• CPenetration testing is only for networks; vulnerability scanning is for applications
• DVulnerability scanning is manual; penetration testing is automated

Which type of malware disguises itself as legitimate software?

• AVirus
• BWorm
• CTrojan
• DRootkit

What is the first step in the incident response process?

• AEradication
• BPreparation
• CRecovery
• DLessons learned

During which incident response phase is the threat removed from affected systems?

• ADetection
• BContainment
• CEradication
• DRecovery

What is the primary goal of containment in incident response?

• ATo identify the attacker
• BTo limit the scope and impact of the incident
• CTo prosecute the attacker
• DTo restore normal operations immediately

What is the chain of custody in digital forensics?

• AA security guard schedule
• BDocumentation tracking the handling of evidence from collection to presentation
• CA network access control list
• DAn encryption key management process

What does RTO stand for in disaster recovery planning?

• AReal-Time Operations
• BRecovery Time Objective
• CRisk Tolerance Overview
• DReturn To Operations

What is the difference between RTO and RPO?

• AThey are the same thing
• BRTO is time to recover; RPO is acceptable data loss
• CRTO is for hardware; RPO is for software
• DRTO is measured in dollars; RPO is measured in hours

Which backup type only saves files that have changed since the last backup?

• AFull backup
• BDifferential backup
• CIncremental backup
• DMirror backup

What is the primary difference between symmetric and asymmetric encryption?

• ASymmetric is faster; asymmetric uses key pairs
• BSymmetric is more secure
• CAsymmetric uses the same key for encryption and decryption
• DThere is no difference