10 free ISC2 SSCP practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 1,074 questions. Work through them, then open each answer to check your reasoning.
Get all 1,074 questions (US$39) · Download these 10 as a PDF
Question 1
A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:
Show answer and explanation
Correct answer: D. the optical unit must be positioned so that the sun does not shine into the aperture.
The physical installation concern for iris scanners is that direct sunlight entering the optical aperture can interfere with the scanner's ability to read the iris pattern accurately and damage the sensitive optical components. This is a documented physical installation best practice for iris recognition systems, making it a legitimate operational concern distinct from technological limitations or inherent system characteristics.
Why the other options are wrong
- A. Modern iris scanners use safe infrared light, not harmful lasers that damage eyes.
- B. While iris patterns do change slightly with age, this is a physiological factor affecting the biometric modality itself, not a physical installation problem.
- C. Iris recognition systems actually have one of the lowest false accept rates among biometric modalities.
Question 2
In Mandatory Access Control, sensitivity labels attached to object contain what information?
Show answer and explanation
Correct answer: B. The item's classification and category set
In Mandatory Access Control systems, sensitivity labels on objects contain both the classification level (e.g., Top Secret, Secret, Confidential) and a category set (e.g., compartments or handling restrictions). This two-part labeling scheme allows MAC systems to enforce access controls based on both the sensitivity level and the specific categories for which the subject has clearance.
Why the other options are wrong
- A. Classification alone is insufficient; categories are also required.
- C. Category alone cannot enforce access control; classification level is also needed.
- D. Need-to-know is a basis for Discretionary Access Control, not part of MAC sensitivity labels.
Question 3
What are the components of an object's sensitivity label?
Show answer and explanation
Correct answer: D. A single classification and a Compartment Set.
An object's sensitivity label consists of a single classification level combined with a compartment set (multiple compartments). The single classification represents the overall sensitivity level, while the compartment set represents multiple independent categories or handling restrictions that apply to that object. This structure allows for flexible and precise access control decisions.
Why the other options are wrong
- A. Classifications are singular, not a set, and it's compartments that are multiple (a set).
- B. While there is a single classification, there must be a compartment set, not a single compartment.
- C. User credentials are not part of an object's sensitivity label; labels describe the object, not the subject.
Question 4
What does it mean to say that sensitivity labels are "incomparable"?
Show answer and explanation
Correct answer: D. Neither label contains all the categories of the other.
Two sensitivity labels are incomparable when neither label dominates the other, specifically, when neither label contains all the compartments (categories) of the other. This occurs when subjects have different combinations of compartment clearances that cannot be ordered hierarchically, making access decisions ambiguous without additional policy rules.
Why the other options are wrong
- A. The number of classifications doesn't determine comparability; classification levels are hierarchical.
- B. This describes different classifications, not different compartments; compartments are what make labels incomparable.
- C. The total count of categories is less relevant than which specific categories are present in each label.
Question 5
Which of the following is true about Kerberos?
Show answer and explanation
Correct answer: C. It depends upon symmetric ciphers.
Kerberos is a symmetric-key authentication protocol developed by MIT. It uses symmetric ciphers (such as DES or AES) throughout the authentication process, including ticket encryption and session key distribution by the KDC. This shared-secret design is fundamental to how Kerberos operates.
Why the other options are wrong
- A. Kerberos relies on symmetric key cryptography, not public key cryptography.
- B. Kerberos never sends the password over the network; it is used locally to derive a symmetric key.
- D. Kerberos is a third-party authentication system (the KDC acts as a trusted intermediary), not second-party.
Question 6
Which of the following is needed for System Accountability?
Show answer and explanation
Correct answer: A. Audit mechanisms.
System accountability requires audit mechanisms to record and track user actions, system events, and access attempts. These audit logs provide the evidence trail necessary to establish who did what, when they did it, and what the consequences were, the fundamental requirement for accountability. Without auditing, accountability cannot be achieved.
Why the other options are wrong
- B. Documented design relates to transparency and evaluation, not directly to accountability mechanisms.
- C. Authorization controls access but does not create the accountability record needed to track actions.
- D. Formal verification validates design correctness but does not provide runtime accountability of user actions.
Question 7
The three classic ways of authenticating yourself to the computer security software are by something you know, by something you have, and by something:
Show answer and explanation
Correct answer: C. you are.
The three classic authentication factors are something you know (passwords, PINs), something you have (smart cards, tokens), and something you are (biometrics like fingerprints, iris patterns). Multi-factor authentication combines two or more of these factors to increase security. This framework is fundamental to authentication system design.
Why the other options are wrong
- A. "Need" is not an authentication factor.
- B. "Non-trivial" is a property of passwords but not one of the three authentication factors.
- D. "You can get" is not one of the established authentication factors.
Question 8
A timely review of system access audit records would be an example of which of the basic security functions?
Show answer and explanation
Correct answer: D. detection.
Detection is the security function that identifies when security incidents or policy violations have occurred. A timely review of audit records is a reactive measure that discovers unauthorized access or suspicious activities after they happen, which is the core purpose of detection controls. Avoidance and prevention are proactive measures that stop incidents before they occur, while deterrence discourages potential attackers through the threat of consequences.
Why the other options are wrong
- A. Avoidance means not engaging in risky activities; reviewing audit logs does not avoid risk.
- B. Deterrence discourages attacks through threat of consequences, not through reviewing historical records.
- C. Prevention stops attacks before they occur; audit review happens after access has already been granted.
Question 9
A confidential number used as an authentication factor to verify a user's identity is called a:
Show answer and explanation
Correct answer: A. PIN
A PIN (Personal Identification Number) is a confidential numeric code used as an authentication factor to verify identity. It is specifically defined as a secret number used in authentication systems. User IDs are public identifiers, passwords are alphanumeric secrets, and challenges are prompts in authentication exchanges, none of these specifically match the definition of a confidential number used for authentication.
Why the other options are wrong
- B. A User ID is a public identifier, not confidential.
- C. A password is typically alphanumeric, not exclusively a number.
- D. A challenge is a prompt in an authentication dialog, not a number used to verify identity.
Question 10
Which of the following exemplifies proper separation of duties?
Show answer and explanation
Correct answer: A. Operators are not permitted modify the system time.
Separation of duties requires that critical functions be divided among different people to prevent any single individual from having too much control. Option A demonstrates proper separation by preventing operators (who run systems) from modifying system time, which is an administrative control function. This prevents operators from altering audit trails or system records. Options B and D allow incompatible roles to overlap, while option C permits console operators to handle physical media, which are separate but compatible duties.
Why the other options are wrong
- B. Programmers using the system console violates separation of duties by combining development and operations roles.
- C. Console operators mounting tapes and disks is a compatible separation of logical and physical duties, but does not exemplify proper separation as clearly as A.
- D. Tape operators using the system console combines physical media handling with system administration, violating separation of duties.
That was 10 of 1,074.
The full ISC2 SSCP pack has all 1,074 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.