Systems Security Certified Practitioner (SSCP) Practice Exam

These questions are part of the practice quiz. Start practicing

• Which type of software can prevent, detect, and potentially correct malicious activities?
• Which security principle focuses on ensuring that data is accessible when needed?
• What is the name of the free program used for encrypting and decrypting emails?
• What is the principle of separation of duties?
• Which process involves evaluating the effectiveness of security controls?
• Which type of controls are considered management policies, procedures, and guidelines that impact the entire system?
• What is used in mission critical systems to lock down information based on sensitivity levels?
• What is the main difference between symmetric and asymmetric encryption?
• What does encryption achieve in data security?
• Which protocol is used for directory services, often including user authentication?
• What does the term 'attack surface' refer to in cybersecurity?
• Which of the following is an example of Public Key cryptography?
• Which protocol was developed by Visa and MasterCard to secure electronic transactions?
• What is the primary purpose of access control lists (ACLs)?
• What part of a virus program is considered the most dangerous?
• An intrusion detection system is classified as which type of countermeasure?
• In the context of information security, what does 'confidentiality' refer to?
• What category does not pertain to the AAAs of information security?
• What is the main goal of implementing a firewall in a network?
• What is the first step in the incident response process?
• What is the primary objective of the SSCP certification?
• Which type of attack involves intercepting communication between two parties?
• Risk assessment involves constant monitoring. Is this statement true or false?
• What is the primary purpose of user training in information security?
• Which of the following best describes Information Security policies?
• What is the goal of incident recovery?
• If a company starts billing you for services like caller ID without your permission, what is this practice called?
• What is one major benefit of regular security training for employees?
• What is a common characteristic of Denial of Service (DoS) attacks?
• Are Macintosh computers at risk for viruses?
• Which cryptographic technique is used to ensure data integrity?
• Which process involves actively monitoring and analyzing security events to identify potential threats?
• What best defines residual risk?
• Which major vendor integrated TACACS into its product offerings for AAA architecture?
• Which layer of the OSI model is responsible for encryption?
• What does ‘phishing’ refer to?
• Which is the primary purpose of a firewall?
• Which domain is focused on information security management practices?
• What principle ensures that access to sensitive data is restricted to only those who need it to perform their job?
• Which method can be employed to ensure data confidentiality?
• How many service ports are available?
• Does a true network security audit include an audit for modems?
• What is the primary purpose of implementing strong password policies?
• What is the primary goal of a penetration test?
• What is a common characteristic of a password audit?
• Which statement accurately describes a characteristic of quantitative analysis in risk assessment?
• Which framework offers guidelines for developing cybersecurity risk management programs?
• What type of scanning is not used in biometrics?
• What does the term ‘zero-trust security model’ mean?
• What file system is known for its numerous security flaws?
• What is the role of security policies in an organization?
• Which type of attack takes advantage of programming errors to gain additional privileges on a machine?
• Is it true that only key members of the staff need to be educated in disaster recovery procedures?
• Who is responsible for creating and communicating security policies?
• What does the term "countermeasure" refer to in information security?
• Which range defines "well known ports"?
• What is the purpose of conducting regular risk assessments?
• What is the importance of patch management?
• If you see a long string of characters at the beginning or end of an email message, what could it indicate?
• What is the main goal of a security audit?
• What does SET stand for in the context of payment security?
• What is a common characteristic of a DDoS attack?
• What does the ability to adjust access control to the exact amount of permission necessary refer to?
• What principle ensures that users have only the access necessary to perform their job functions?
• What tool is used by network administrators to capture packets from a network?
• Is a security policy a rigid set of rules that must be followed explicitly to be effective?
• How are information security policies best described?
• Which protocol sends passwords in clear text, while the other encrypts them?
• What is an effective method for detecting advanced persistent threats (APTs)?
• What type of security incident does a salami attack best illustrate?
• Which organization is responsible for listing port assignments?
• What does a vulnerability assessment focus on?
• What type of virus resides in a Word or Excel document?
• What is the significance of having an incident response plan?
• What is the primary purpose of an intrusion detection system (IDS)?
• How do firewalls contribute to network security?
• How frequently should passwords be changed, according to standard recommendations?
• Which domain deals with security evaluation and incident response?
• What is the primary goal of an information security policy?
• What is the difference between a vulnerability assessment and a penetration test?
• What is the main purpose of intrusion detection systems (IDS)?
• What are the two types of Intrusion Detection Systems?
• What is an example of a physical security control?
• Multi-partite viruses are known for which of the following behaviors?
• Which element is NOT a traditional part of a firewall?
• What is an effective method to protect against social engineering attacks?
• Which action is crucial during the digital evidence collection process to maintain a chain of custody?
• Which of the following is NOT a characteristic of RSA?
• Are privacy violations considered as serious as security violations today?
• What is malware?
• What is an essential guideline for a good password policy?
• Which statistical method can be utilized for evaluating the effectiveness of security controls?
• What type of attack interrupts the TCP three-way handshake and results in half-open connections?
• Which concept controls access based on rules defined by security policies?
• Which domain addresses incident management and resolution?
• Which of the following tools can be used for security in Unix/Linux environments?
• Which of the following is a method to protect information integrity within a system?
• What is the primary goal of a risk management program?
• In the context of security, what does the term 'hardening' refer to?
• Which security measure helps protect against unauthorized access to sensitive information?
• Integrity is best defined as:
• Is it accurate to state that the IDEA algorithm remains unbroken by brute force?
• How often should organizations update their security policies?
• What concept best represents Availability in computing resources?
• In a Public Key Infrastructure (PKI), what is the role of a directory server?
• Which biometric method uses the unique patterns of the retina?
• Which programming model is designed to separate data and functionality for security reasons?
• What term is used to describe bogus messages that spread via email forwarding?
• What type of control deals with system auditing and usability?
• In which domain would you explore software development lifecycle security practices?
• Which motivations have been noted for virus writers?
• Which of the following should NOT be done when gathering digital evidence?
• What is the primary function of a security camera?
• In cybersecurity, what does DLP stand for?
• What is the role of a digital signature?
• What term describes a virus that has been reported as replicating and causing harm to computers?
• In which domain would you find the concept of asset management?
• Which security principle focuses on dividing job responsibilities to prevent fraud?
• What type of code executes on an end user's machine from a web browser?
• Which of the following is a common method for securing passwords?
• Which of the following is NOT an encryption algorithm?
• Which type of intrusion detection system is focused on monitoring individual machines?
• The formula Vulnerability x Threat = RISK exemplifies which concept?
• Which of the following statements about privacy and security violations is correct?
• Which domain covers risk identification and assessment?
• Countermeasures address security concerns in which of the following categories?
• Which term describes the process of verifying the identity of a person or device?
• What is social engineering in the context of cybersecurity?
• What is the primary goal of vulnerability management?
• The IDEA algorithm used in PGP is how many bits long?
• What is the main difference between a logic bomb and a stealth virus?
• In the context of access control models, what does RBAC stand for?
• In public key cryptography, what is the function of public keys?
• What does the acronym ‘SIEM’ stand for in security technologies?
• Are cable modems generally considered more secure than DSL connections?
• What is classified as a form of Malware that triggers based on a specific condition?
• In security architecture, what does the principle of defense in depth entail?
• What is the purpose of preventive controls in security management?
• Smart cards serve as a secure alternative to which of the following security mechanisms?
• What type of attack can use a botnet to overwhelm a target system?
• Are hackers and crackers considered to be two distinctly different groups?
• What is the minimum recommended length of a security policy?
• What is the preferred method of protecting sensitive data in transit?
• What security standard is often used with Internet Key Exchange (IKE)?
• Which of the following is an example of a physical security control?
• What is the main goal of an incident response plan?
• What type of control involves using policies and procedures to mitigate risk?
• What are the key elements of secure coding practices?
• Each of the following is a valid step in handling incidents except:
• What aspect of cybersecurity is primarily concerned with protecting data from unauthorized access or corruption?
• Which option is primarily focused on protecting data from unauthorized access?
• Which method focuses on ensuring ongoing maintenance of security policies through reviews and updates?
• What is the goal of encryption in data transmission?
• What is multi-factor authentication (MFA)?
• Authentication, ________, and __________ are the AAAs of information security.
• Which of the following attacks is not categorized as an unauthorized access method?
• Which media type is managed at the Physical Layer (Layer 1) of the OSI model?
• What is an incident response plan (IRP)?
• Which of the following best defines cryptography?
• Which of the following is a common outcome of effective vulnerability management?
• What does the term ‘phishing’ refer to in cybersecurity?
• Can companies be sued for privacy violations?
• Which of the following is not a key component of risk management?
• What is the significance of GDPR in data protection?
• What is the primary benefit of implementing a robust incident response plan?
• What function do multi-partite viruses combine?
• What is a disaster recovery plan (DRP)?
• What is the main function of a VPN (Virtual Private Network)?
• What type of attack aims to exploit weaknesses in a system through unauthorized access?
• Digital Certificates use which protocol?
• Which organization is responsible for the timely distribution of information security intelligence data?
• What is enforced by Passfilt.dll in terms of password requirements?
• What does SSL stand for in the context of web security?
• Which of the following is a key component of an effective incident response plan?
• Which of these virus incidents did not occur in 1999?
• What is the role of a Certificate Authority (CA) in PKI?
• What is the purpose of penetration testing?
• What does a salami attack typically involve?
• When an employee departs from a company, what action should be taken regarding their network access account?
• What is a common use of digital certificates?
• What does the term ‘data breach’ refer to?
• Which of the following encompasses the entire security standpoint of the product development life cycle?
• What is the key length of the DES encryption standard?
• What access control question confirms the identity of a person trying to log on?
• What technology is primarily used for securing communication over a computer network?
• What does decentralized access control allow file owners to do regarding access rights?
• What is a potential risk of allowing too much network access for terminated employees?
• Which of the following statements best describes the importance of data backups?
• A one-way hash converts a string of random length into what type of encrypted string?
• Which one of these formulas is used in Quantitative risk analysis?
• Which security policy involves transferring the risk of loss to another party?
• In cybersecurity practices, what does SIEM stand for?
• What primarily differentiates computer abuse from computer crime?
• What is the role of a Security Information and Event Management (SIEM) system?
• What is an electronically generated record that ties a user's ID to their public key called?
• What does the acronym CIA stand for in security terms?
• A password audit checks for what?
• Layer 4 of the OSI model corresponds to which layer of the DoD model?
• Which assessment term refers to examining historical incidents to identify patterns in security
• In the context of information security, what is 'social engineering'?
• What is the role of an information security policy?
• What does RADIUS stand for?
• What type of access control allows users to control access to their resources?
• Which incident is NOT associated with the year 1999?
• Which of the following is a characteristic of passwords that should be avoided?
• In the past, many companies had been hesitant to report computer crimes. True or False?
• Identify three types of firewalls from the options below:
• What is the most secure method for storing backup tapes?
• What are the main objectives of countermeasures? (Select all that apply)
• Which domain focuses on the configuration and monitoring of systems?
• What does multi-factor authentication enhance?
• Who is primarily responsible for identifying and managing organizational risks?
• What does incident response usually involve?
• Which of the following best describes encryption in cybersecurity?
• What is the primary goal of using the principle of Least Privilege in security?
• Is wiretapping classified as a passive network attack?
• What does digital forensics involve?
• What term describes the risk that remains after countermeasures have been deployed?
• What is a key benefit of implementing encryption technologies?
• Which model is often implemented to enhance security in an organization's network?
• Which type of virus changes its code order each time it replicates to another machine?
• What are the core concepts of business continuity planning (BCP)?
• Identifying a potential security threat before it occurs is known as what?
• Which of the following represents a widely recognized list of security vulnerabilities?
• What type of access control is based on permissions granted to the user, often referred to as "need to know" access?
• What is a primary distinction between EDI and e-Commerce?
• What is the term used for intentionally embedding secret data into a picture or some form of media?
• What type of software is specifically designed to prevent unauthorized access and altercations in computer systems?
• Which of the following best describes a firewall's role in network security?
• Which security control would provide the best protection for sensitive data in a physical environment?
• In security terms, what does ‘sandboxing’ mean?
• Trend Analysis in security commonly involves the examination of which type of files?
• What are the main goals of an information security program?
• Which password characteristic is least desired in a secure system?
• Which low-tech attack is effective in gaining unauthorized access to network systems?
• Is it true that only law enforcement personnel are qualified to perform computer forensic investigations?
• What broader concept does the concept of Separation of Duties support in security practices?