SSCP Exam Questions for Success (Updated)

Protecting information and systems has become critical for companies in the wake of rising cyber security threats. In this regard, the System Security Certified Practioner (SSCP) profession has become alluring to Information Technology (IT) professionals. With time, the demand for such professionals is increasing. You can become an SSCP-certified professional after clearing its test, for which you can prepare by reading the SSCP Exam Questions.   

According to the PayScale salary analysis, the average base salary of an SSCP professional is about £35,000 in the United Kingdom. Read this blog to learn the various SSCP Exam Questions, start preparing for the test and clear it on your first attempt. 

Table of Contents 

1) SSCP Exam domains 

2) List of SSCP sample questions and answers 

      a) Select an example of a non-discretionary access control system from the options. 

      b) What should organizations consider as a priority when allowing external access to their LANs through the internet? 

c) What is the smartcard’s principal function in a PKI? 

3) Conclusion 

SSCP Exam domains 

Following is the table with a list of SSCP domains representing the average weight of each domain. This could help you plan your exam preparation and utilise time effectively by dividing sufficient learning time for each domain according to its importance.
 

SSCP Domains	Average weight
Security Operations and Administration	16%
Access Controls	15%
Risk Identification, Monitoring and Analysis	15%
Incident Response and Recovery	14%
Cryptography	9%
Network and Communications Security	16%
Systems and Application Security	15%
Total	100%

Register with Systems Security Certified Practitioner (SSCP) training to upgrade and build your career in information security. Sign up now! 

List of SSCP sample questions and answers  

The following is a list of SSCP exam questions and answers that can help assess your knowledge and give an insight into how the SSCP Exam Questions will be framed. 

1) Select an example of a non-discretionary access control system from the options.   

a) MAC   

b) File ACLs  

c) DAC  

d) Visitor list  

Answer: MAC  

2) Which of the following actions can be taken as part of a business continuity plan?  

a) Relocating to a cold site   

b) Restoring from backup tapes  

c) Implementing RAID  

d) Restarting business operations  

Answer: Implementing RAID  

3) Which of the below uses the technology involving fingerprint, retina, and iris scans to authenticate the access requested by the individual?  

a) Micrometric  

b) Biometrics   

c) Macro metrics  

d) Micro Biometrics  

Answer: Biometrics  

4) An attacker is using the spaces and tabs in a text file to store data. Which of the following best describes this?  

a) Encoding  

b) Hashing  

c) Steganography  

d) Encryption  

Answer: Steganography  

5) What is the main purpose of Single sign-on (SSO)?  

a) Authorisation  

b) Authentication  

c) Confidentiality  

d) Availability  

Answer: Authentication  

6) An enterprise wishes to choose a specific alternate site to minimise operational interruption in the event of an incident. So, which of the following options would work best for the objective?  

a) Hot site  

b) Warm site  

c) Mobile site  

d) Cold site  

Answer: Hot site  

7) Which of the following options would you use to securely protect a wireless network of an office having 10 users without adding unnecessary administrative work?  

a) WEP (with AES)  

b) WEP-Enterprise   

c) WPA2 (with AES)  

d) WPA2-Enterprise  

Answer: WPA2 (with AES)  

8) When you visit a website, a pop-up notification notifies you that your computer is at risk and requires the missing patch or download immediately. So, which of the following does the website notification contain?  

a) Virus   

b) PUA  

c) Spyware  

d) Scareware  

Answer: Scareware  

9) To restrict access by a subject (an active entity, such as a person or a process) to an object (a file) entail setting up:   

a) Access Matrix  

b) Identification controls  

c) Access Rules  

d) Access terminal  

Answer: Access Rules  

10) How many types of authentication factors are present?  

a) 2  

b) 3  

c) 5  

d) 4  

Answer: 3  

11) Recently, Tara discovered a security problem on her network. What should she do at this point that should be her top priority?  

a) Eradication  

b) Recovery  

c) Detection  

d) Containment  

Answer: Containment  

12) The following sets have the least upper bound of values and the greatest lower bound of values. Which of the below options suits this statement?  

a) Rule model   

b) Mandatory model  

c) Lattice model   

d) Discretionary model  

Answer: Lattice model  

13) Which user interface limits the functions selected by a user?  

a) Limited user interface  

b) Mini user interface  

c) Constrained user interface  

d) Unlimited user interface  

Answer: Constrained user interface  

14) The act of a user presenting an identity to a system to log on with an ID is called:  

a) Authentication  

b) Identification  

c) Authorisation  

d) Confidentiality  

Answer: Identification  

15) Which of the following might be a potential problem with the physical installation of the iris scanner when using the iris pattern within a biometric?  

a) Concern that the laser beam might harm the individual's eyes  

b) The optical unit must be placed to prevent sunlight from entering the aperture  

c) The iris pattern changes as the individual's age increase  

d) A large percentage of false acceptance occurs  

Answer: The optical unit must be placed to prevent sunlight from entering the aperture  

16) Which of the following is needed for System Accountability?  

a) Authorisation  

b) Documented design  

c) Audit mechanisms  

d) Formal verification of system design  

Answer: Audit mechanisms  

17) When implementing logical access security, which of the below options does not meet the criteria of logical control?  

a) Employee badges   

b) Access profiles  

c) User Id  

c) Passwords  

Answer: Employee badges  

18) Which of these options explains Kerberos?  

a) A remote authentication dial-in user server   

b) A three-headed dog from the Egyptian mythology  

c) A trusted third-party security authentication protocol  

d) A security models  

Answer: A trusted third-party security authentication protocol  

19) What should organisations consider as a priority when allowing external access to their LANs through the internet?  

a) Plan for considering proper authentication options  

b) Plan for giving the user his account usage details  

c) Plan for implementing workstation locking mechanisms  

d) Plan for protecting the modem pool  

Answer: Plan for considering proper authentication options  

20) An authentication factor using a confidential number to verify a user's identity is termed a:  

a) Password   

b) PIN  

c) User ID  

d) Recovery  

Answer: PIN 

21) Select an option that would assist the most in Host Based intrusion detection.  

a) Access control lists  

b) Security clearances  

c) Host-based authentication  

d) Audit trails  

Answer: Audit trails  

22) One of the primary mathematical models related to multilevel-security computer systems (Often used to control classified information) was developed by: 

a) Clark and Wilson  

b) Diffie and Hellman  

c) Gasser and Lipner  

d) Bell and LaPadula  

Answer: Bell and LaPadula  

23) Which of the following attacks can grab information about network users' passwords?  

a) Data Diddling  

b) IP Spoofing  

c) Smurfing  

d) Sniffing  

Answer: Sniffing  

24) The point at which a system decides to take some sort of action when an action repeats a preset number of times is called:  

a) Clipping level  

b) Acceptance level  

c) Forgiveness level  

d) Logging level  

Answer: Clipping level  

25) What are the physical characteristics measured by a biometric device scanning the retina?  

a) The amount of light reaching the retina  

b) The pattern of retinal blood vessels  

c) Amount of light reflected by the retina  

d) The pattern of light receptors at the back of the eye  

Answer: The pattern of retinal blood vessels  

26) The Orange Book, a computer security policy, is based on: 

a) Data encryption standard  

b) Kerberos  

c) Bell-LaPadula model  

d) Tempest  

Answer: The bell-LaPadula model  

27) Which of the following is the most reliable authentication method for creating a one-time password valid for a short duration for remote access?  

a) Variable callback system  

b) Fixed callback system  

c) Synchronous token   

d) A Merger of callback and caller ID  

Answer: Synchronous token  

28) Which of the following is true of two-factor authentication?  

a) Two-hand geometry measurements are necessary  

b) Single sign-on technology is not used  

c) It depends on two separate identity proofs  

d) It makes use of an RSA public-key signature based on big prime numbers  

Answer: It depends on two separate identity proofs  

29) Which of the options below is not a wireless proximity card that detects the system?  

a) Passive device  

b) Field-powered device  

c) Magnetically striped card   

d) Transponder  

Answer: Magnetically striped card  

30) Which of the options given below does not come under the type of motion detector?  

a) Passive infrared sensors  

b) Photoelectric sensor   

c) Microwave Sensor  

d) Ultrasonic Sensor  

Answer: Photoelectric sensor  

31) Which of the following security models allows the application of specific rules to regulate subject-to-object interactions when the subject's clearance is compared to the object's classification?  

a) Biba model  

b) Access Matrix model  

c) Take-Grant model  

d) Bell-LaPadula model  

Answer: The Bell-LaPadula model  

32) Which of the following model specifies that a table of subjects and objects indicates what actions the subjects can take upon individual objects?  

a) Take-Grant model  

b) Access Control Matrix model   

c) Bell-LaPadula model  

d) Biba model  

Answer: Access Control Matrix model  

33) Which of the following options utilises public key cryptography to distribute secret keys and offers more support for access control to solve some flaws of Kerberos?  

a) RADIUS  

b) SESAME   

c) KryptoKnight  

d) TACACS+  

Answer: SESAME  

34) The "vulnerability of a facility" to damage or attack may be determined by all the following options except which one?  

a) Inspection  

b) Security budget   

c) History of losses  

d) Security controls  

Answer: Security budget  

35) What is the smartcard's principal function in a PKI?  

a) Transparent renewal of user keys  

b) Simple transfer of certificates between users   

c) Quick encryption of raw data using hardware   

d) Use of tamper-resistant microprocessors to store and process sensitive information  

Answer: Use of tamper-resistant microprocessors to store and process sensitive information  

36) What does the field of Crime Prevention Through Environmental Design (CPTED) outline?  

a) It describes how effective physical environment design can lower crime by directly influencing human behaviour.  

b) It describes how effective logical environment design can lower crime by directly influencing human behaviour.  

c) It describes how a detective control environment's effective design can lower crime by directly influencing human behaviour.  

d) It describes how an administrative control environment with the right design can lower crime by directly influencing human behaviour.  

Answer: It describes how effective physical environment design can lower crime by directly influencing human behaviour.  

37) Early in the development of biometric identification systems, it became clear that the only basis for complete identification could be the individual's physical characteristics. This prompted the need to respond to two questions:  

a) What was the individual's sex and age?  

b) What portion of their body should be used, and how to successfully identify them?  

c) What was the individual's age and degree of income?   

d) What was the individual's voice like, and what were their habits?  

Answer: What portion of their body should be used, and how to successfully identify them?  

38) Which of the following is necessary to control access to information systems and their associated networks?  

a) Authenticity, discretion, and accessibility  

b) Availability and integrity.  

c) Integrity, confidentiality, and availability   

d) Availability, sincerity, secrecy, and integrity  

Answer: Integrity, confidentiality, and availability  

39) Access control and encryption are two examples of technical controls that can be implemented in the operating system, as software programmes or as additional hardware/software components. Which pairing does this set of controls, often called logical controls, represent?  

a) Preventive/Administrative Pairing  

b) Preventive/Physical Pairing  

c) Preventive/Technical Pairing   

d) Detective/Technical Pairing  

Answer: Preventive/Technical Pairing  

40) Name the user interface that can limit the user functionality choices  

a) Limited user interfaces   

b) Constrained user interfaces  

c) Mini user interfaces  

d) Unlimited user interfaces  

Answer: Constrained user interfaces 


 

Conclusion 

We hope you learned about the different SSCP Exam Questions by reading this blog. We aimed at giving you a hint on how to prepare for the SSCP Exam. This can help you practice with a few SSCP sample questions and find opportunities by analysing the level of improvement required. 

Register with SSCP Training now if you are interested in enhancing your skills or are willing to pursue a career in information security.