268 free ISC2 SSCP practice questions from the CertStash pack of 1,074, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 268 free here, all 1,074 in the pack, and each step includes the one before it.
Get all 1,074 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:
Show answer and explanation
Correct answer: D. the optical unit must be positioned so that the sun does not shine into the aperture.
The physical installation concern for iris scanners is that direct sunlight entering the optical aperture can interfere with the scanner's ability to read the iris pattern accurately and damage the sensitive optical components. This is a documented physical installation best practice for iris recognition systems, making it a legitimate operational concern distinct from technological limitations or inherent system characteristics.
Why the other options are wrong
- A. Modern iris scanners use safe infrared light, not harmful lasers that damage eyes.
- B. While iris patterns do change slightly with age, this is a physiological factor affecting the biometric modality itself, not a physical installation problem.
- C. Iris recognition systems actually have one of the lowest false accept rates among biometric modalities.
Question 2
In Mandatory Access Control, sensitivity labels attached to object contain what information?
Show answer and explanation
Correct answer: B. The item's classification and category set
In Mandatory Access Control systems, sensitivity labels on objects contain both the classification level (e.g., Top Secret, Secret, Confidential) and a category set (e.g., compartments or handling restrictions). This two-part labeling scheme allows MAC systems to enforce access controls based on both the sensitivity level and the specific categories for which the subject has clearance.
Why the other options are wrong
- A. Classification alone is insufficient; categories are also required.
- C. Category alone cannot enforce access control; classification level is also needed.
- D. Need-to-know is a basis for Discretionary Access Control, not part of MAC sensitivity labels.
Question 3
What are the components of an object's sensitivity label?
Show answer and explanation
Correct answer: D. A single classification and a Compartment Set.
An object's sensitivity label consists of a single classification level combined with a compartment set (multiple compartments). The single classification represents the overall sensitivity level, while the compartment set represents multiple independent categories or handling restrictions that apply to that object. This structure allows for flexible and precise access control decisions.
Why the other options are wrong
- A. Classifications are singular, not a set, and it's compartments that are multiple (a set).
- B. While there is a single classification, there must be a compartment set, not a single compartment.
- C. User credentials are not part of an object's sensitivity label; labels describe the object, not the subject.
Question 4
What does it mean to say that sensitivity labels are "incomparable"?
Show answer and explanation
Correct answer: D. Neither label contains all the categories of the other.
Two sensitivity labels are incomparable when neither label dominates the other, specifically, when neither label contains all the compartments (categories) of the other. This occurs when subjects have different combinations of compartment clearances that cannot be ordered hierarchically, making access decisions ambiguous without additional policy rules.
Why the other options are wrong
- A. The number of classifications doesn't determine comparability; classification levels are hierarchical.
- B. This describes different classifications, not different compartments; compartments are what make labels incomparable.
- C. The total count of categories is less relevant than which specific categories are present in each label.
Question 5
Which of the following is true about Kerberos?
Show answer and explanation
Correct answer: C. It depends upon symmetric ciphers.
Kerberos is a symmetric-key cryptography-based authentication protocol developed by MIT. It uses symmetric ciphers (like DES or AES) for encryption throughout the authentication process, including ticket encryption and session key establishment. This is fundamental to Kerberos's design and operation.
Why the other options are wrong
- A. Kerberos relies on symmetric key cryptography, not public key cryptography.
- B. Kerberos encrypts passwords as well; it uses symmetric encryption for the entire authentication exchange.
- D. Kerberos is a third-party authentication system (involving the KDC as a trusted intermediary), not second-party.
Question 6
Which of the following is needed for System Accountability?
Show answer and explanation
Correct answer: A. Audit mechanisms.
System accountability requires audit mechanisms to record and track user actions, system events, and access attempts. These audit logs provide the evidence trail necessary to establish who did what, when they did it, and what the consequences were, the fundamental requirement for accountability. Without auditing, accountability cannot be achieved.
Why the other options are wrong
- B. Documented design relates to transparency and evaluation, not directly to accountability mechanisms.
- C. Authorization controls access but does not create the accountability record needed to track actions.
- D. Formal verification validates design correctness but does not provide runtime accountability of user actions.
Question 7
What is Kerberos?
Show answer and explanation
Correct answer: B. A trusted third-party authentication protocol.
Kerberos is a trusted third-party authentication protocol that provides secure authentication services in network environments. It was developed at MIT and is named after the mythological three-headed dog, but the protocol itself is specifically a third-party authentication mechanism that uses a Key Distribution Center (KDC) as a trusted intermediary.
Why the other options are wrong
- A. While Kerberos is named after the mythological creature, the question asks what Kerberos is in IT security context.
- C. Kerberos is a protocol, not a security model.
- D. RADIUS (Remote Authentication Dial-In User Service) is a different authentication protocol from Kerberos.
Question 8
The three classic ways of authenticating yourself to the computer security software are by something you know, by something you have, and by something:
Show answer and explanation
Correct answer: C. you are.
The three classic authentication factors are something you know (passwords, PINs), something you have (smart cards, tokens), and something you are (biometrics like fingerprints, iris patterns). Multi-factor authentication combines two or more of these factors to increase security. This framework is fundamental to authentication system design.
Why the other options are wrong
- A. "Need" is not an authentication factor.
- B. "Non-trivial" is a property of passwords but not one of the three authentication factors.
- D. "You can get" is not one of the established authentication factors.
Question 9
A timely review of system access audit records would be an example of which of the basic security functions?
Show answer and explanation
Correct answer: D. detection.
Detection is the security function that identifies when security incidents or policy violations have occurred. A timely review of audit records is a reactive measure that discovers unauthorized access or suspicious activities after they happen, which is the core purpose of detection controls. Avoidance and prevention are proactive measures that stop incidents before they occur, while deterrence discourages potential attackers through the threat of consequences.
Why the other options are wrong
- A. Avoidance means not engaging in risky activities; reviewing audit logs does not avoid risk.
- B. Deterrence discourages attacks through threat of consequences, not through reviewing historical records.
- C. Prevention stops attacks before they occur; audit review happens after access has already been granted.
Question 10
A confidential number used as an authentication factor to verify a user's identity is called a:
Show answer and explanation
Correct answer: A. PIN
A PIN (Personal Identification Number) is a confidential numeric code used as an authentication factor to verify identity. It is specifically defined as a secret number used in authentication systems. User IDs are public identifiers, passwords are alphanumeric secrets, and challenges are prompts in authentication exchanges, none of these specifically match the definition of a confidential number used for authentication.
Why the other options are wrong
- B. A User ID is a public identifier, not confidential.
- C. A password is typically alphanumeric, not exclusively a number.
- D. A challenge is a prompt in an authentication dialog, not a number used to verify identity.
What people say about the full SSCP pack 5.0 from 13
Cleared my ISC2 Certified SSCP Exam with the help of Certstash Dumps. It is a perfect blend of an amazing set of questions and concepts. With their wonderful service, I was able to score 90% on the Systems Security Certified Practitioner Exam.
The materials on this site helped me pass my SSCP exam with ease. I would recommend them to anyone who wants a easy passing grade!
Cert Stash is a dream come true for those who want to work in information security. This site not only helps you pass the SSCP exam but also provides invaluable resources that will help your career grow and succeed!
Question 11
Which of the following recovery plan test results would be most useful to management?
Show answer and explanation
Correct answer: A. elapsed time to perform various activities.
Elapsed time to perform various activities is most useful to management because it provides quantifiable, measurable data that directly indicates operational capability and recovery effectiveness. Management needs metrics showing whether recovery timeframes meet RTO (Recovery Time Objective) targets and can identify bottlenecks. This objective measurement enables evidence-based decisions on resource allocation and plan refinement.
Why the other options are wrong
- B. A list of successful and unsuccessful activities provides only qualitative pass/fail information without performance insight.
- C. Amount of work completed is subjective and does not directly measure recovery capability or timeline feasibility.
- D. Description of each activity is process documentation rather than performance metrics relevant to management decision-making.
Question 12
Kerberos can prevent which one of the following attacks?
Show answer and explanation
Correct answer: B. playback (replay) attack.
Kerberos prevents replay attacks through the use of timestamps and nonces in its authentication protocol. When a client requests authentication, Kerberos includes a timestamp in the ticket. The server validates that the timestamp is within an acceptable time window (typically 5 minutes), preventing an attacker from capturing and replaying old authentication credentials. This is a fundamental design feature of the Kerberos protocol.
Why the other options are wrong
- A. Tunneling attacks are network-level attacks that Kerberos does not specifically address or prevent.
- C. Destructive attacks involve data destruction or system damage, which Kerberos authentication mechanisms cannot prevent.
- D. Process attacks target running processes and are not prevented by Kerberos authentication.
Question 13
Knowledge-based Intrusion Detection Systems (IDS) are more common than:
Show answer and explanation
Correct answer: C. Behavior-based IDS
Behavior-based IDS (anomaly detection) is less common than knowledge-based IDS in practical deployments. Knowledge-based systems using signature analysis have been the industry standard for decades due to their accuracy with known threats, while behavior-based systems require more sophisticated tuning and generate higher false positive rates, limiting their widespread adoption.
Why the other options are wrong
- A. Network-based IDS is actually very common and widely deployed alongside knowledge-based systems.
- B. Host-based IDS is commonly deployed in enterprise environments and is more prevalent than behavior-based approaches.
- D. Application-based IDS exists but is less commonly discussed in certification contexts than the other three options.
Question 14
Which of the following would assist the most in Host Based intrusion detection?
Show answer and explanation
Correct answer: A. audit trails.
Audit trails are comprehensive logs of system activities, user actions, and security events that record what happened on a host system. Host-based intrusion detection systems analyze these audit trails to identify suspicious patterns, unauthorized access attempts, and malicious activities. Audit trails provide the detailed event data necessary for detection and analysis. Access control lists prevent unauthorized access, security clearances determine authorization levels, and host-based authentication verifies identity, none of these directly assist in detecting intrusions the way audit trails do.
Why the other options are wrong
- B. Access control lists are preventive controls that restrict access but do not detect intrusions.
- C. Security clearances determine authorization levels but do not provide detection capabilities.
- D. Host-based authentication verifies user identity but does not detect intrusion attempts or suspicious activities.
Question 15
Which of the following is the most critical item from a disaster recovery point of view?
Show answer and explanation
Correct answer: A. Data
Data is the most critical item from a disaster recovery point of view because it represents the irreplaceable business assets and intellectual capital. Hardware, software, applications, and communication infrastructure can all be rebuilt, replaced, or restored, but the loss of critical data may be permanent and unrecoverable, making it the highest priority for protection in any disaster recovery plan.
Why the other options are wrong
- B. Hardware and software, while important, can be replaced or rebuilt.
- C. Communication links can be re-established through alternative providers or infrastructure.
- D. Software applications can be reinstalled, restored, or replaced more easily than lost data.
Question 16
What is the name of the first mathematical model of a multi-level security policy used to define the concept of a secure state, the modes of access, and rules for granting access?
Show answer and explanation
Correct answer: D. Bell-LaPadula Model
The Bell-LaPadula Model, published in 1973, was the first formal mathematical model of multi-level security policy. It established foundational concepts including the definition of a secure state, access modes, and security rules. It introduced the concepts of confidentiality levels and clearances. The Clark-Wilson Model came later and focused on integrity. The Harrison-Ruzzo-Ullman Model addresses the safety problem in access control matrices. Rivest and Shamir are known for cryptographic contributions, not security policy models.
Why the other options are wrong
- A. Clark and Wilson Model was developed later and focuses on data integrity and separation of duties, not confidentiality.
- B. Harrison-Ruzzo-Ullman Model addresses safety in access control systems, not multi-level security policy definition.
- C. Rivest and Shamir are cryptographers known for RSA encryption, not creators of security policy models.
Question 17
In Synchronous dynamic password tokens:
Show answer and explanation
Correct answer: A. The token generates a new password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
Synchronous dynamic password tokens generate a new, unique password at fixed time intervals based on an internal clock, typically using time-based encryption with a secret key. This is the defining characteristic of time-synchronous tokens like TOTP, which produce unique values that are verified by the authentication system at the same synchronized interval.
Why the other options are wrong
- B. The passwords generated are unique, not non-unique; that is the entire security benefit of dynamic tokens.
- C. The password must be entered into the system along with the PIN for multi-factor authentication to work properly.
- D. The authentication entity must verify that the entered password is valid and was entered within the correct time window, not invalid.
Question 18
Which of the following is an example of a passive attack?
Show answer and explanation
Correct answer: B. Shoulder surfing
Shoulder surfing is a passive attack where an attacker observes a user's actions without direct interaction, such as watching someone enter a password. Passive attacks involve eavesdropping and monitoring without altering data. Denying services and brute-force cracking are active attacks that attempt to modify or disrupt systems, and smurfing is a DDoS attack.
Why the other options are wrong
- A. Denying services is an active attack that disrupts system availability.
- C. Brute-force password cracking is an active attack attempting to gain unauthorized access.
- D. Smurfing is a DDoS amplification attack, which is an active attack on availability.
Question 19
Which of the following statements pertaining to biometrics is false?
Show answer and explanation
Correct answer: D. Biometrics are based on the Type 2 authentication mechanism.
Statement D is false because biometrics are based on Type 3 (something you are) authentication, not Type 2 (something you have). Statements A, B, and C are all correct: increased sensitivity does increase false rejection rate, the crossover error rate is where FRR equals FAR, and FAR is indeed Type II error.
Why the other options are wrong
- A. This statement is true; higher sensitivity in biometric systems increases false rejections of legitimate users.
- B. This statement is true; the crossover error rate (CER) is the defined point where false rejection equals false acceptance.
- C. This statement is true; false acceptance rate is statistically termed Type II error in hypothesis testing.
Question 20
What is called the formal acceptance of the adequacy of a system's overall security by the management?
Show answer and explanation
Correct answer: C. Accreditation
Accreditation is the formal, official acceptance by management of the adequacy of a system's overall security posture. It represents management's authorization and acknowledgment that security is acceptable for operational use. Certification is the technical assessment process; acceptance is informal agreement; evaluation is the assessment activity. Accreditation is the formal management decision following technical certification.
Why the other options are wrong
- A. Certification is the technical assessment, not management's formal acceptance.
- B. Acceptance is too informal; accreditation is the formal management recognition.
- D. Evaluation is the assessment process, not the formal management acceptance decision.
Question 21
Which type of attack involves impersonating a user or a system?
Show answer and explanation
Correct answer: B. Spoofing attack
A spoofing attack involves impersonating a user, system, or service by forging credentials or falsifying identity information to gain unauthorized access or deceive network participants. This includes IP spoofing, MAC spoofing, and email spoofing. Smurfing is a DDoS attack, spamming involves unwanted bulk messages, and sniffing passively captures network traffic.
Why the other options are wrong
- A. Smurfing is a DDoS amplification attack using ICMP echo requests, not impersonation.
- C. Spamming involves sending unsolicited bulk messages, not impersonating users or systems.
- D. Sniffing is passive network traffic capture, not active impersonation.
Question 22
If an operating system permits shared resources such as memory to be used sequentially by multiple users/application or subjects without a refresh of the objects/ memory area, what security problem is MOST likely to exist?
Show answer and explanation
Correct answer: A. Disclosure of residual data.
When shared resources like memory are allocated sequentially to multiple users/applications without clearing (refreshing) the memory area first, sensitive data left by previous users becomes accessible to subsequent users. This is the classic residual data disclosure vulnerability, where uninitialized or uncleared memory contains traces of previous operations that can be read by unauthorized parties.
Why the other options are wrong
- B. Privileged execution state is typically gained through exploitation of access control flaws, not memory refresh issues.
- C. Covert channels are indirect communication methods that bypass normal security controls; they require intentional design to exploit timing or storage characteristics.
- D. Deadly embrace (deadlock) is a denial of service condition arising from circular wait dependencies, unrelated to memory refresh problems.
Question 23
The Terminal Access Controller Access Control System (TACACS) employs which of the following?
Show answer and explanation
Correct answer: A. a user ID and static password for network access
TACACS (Terminal Access Controller Access Control System) employs a user ID and static password for network access. This is the traditional authentication mechanism used by TACACS for remote access control, particularly for administrative and network device access. While TACACS+ (the enhanced version) can support dynamic passwords and other advanced features, the original TACACS uses static password authentication.
Why the other options are wrong
- B. TACACS does not primarily employ dynamic passwords; that is a feature of enhanced versions.
- C. Symmetric password is not a recognized authentication terminology in the TACACS context.
- D. Asymmetric password is not a recognized authentication mechanism for TACACS.
Question 24
How are memory cards and smart cards different?
Show answer and explanation
Correct answer: C. Memory cards have no processing power
Smart cards contain a microprocessor and can perform computations, while memory cards are passive storage devices with no processing capability. This fundamental architectural difference is the key distinction between these two types of cards. Memory cards are simply storage media, whereas smart cards can authenticate, encrypt, and execute cryptographic operations independently.
Why the other options are wrong
- A. While often true in capacity, this is not the defining difference between card types.
- B. Two-factor authentication capability depends on implementation, not the card type itself; memory cards can also be part of 2FA systems.
- D. Both smart cards and memory cards can be used in ATM systems; smart cards are simply more common due to their processing abilities.
Question 25
Which of the following is a trusted, third party authentication protocol that was developed under Project Athena at MIT?
Show answer and explanation
Correct answer: A. Kerberos
Kerberos is a trusted, third-party authentication protocol developed at MIT under Project Athena. It uses a Key Distribution Center (KDC) as the trusted third party to authenticate users and services on a network. SESAME, KryptoKnight, and NetSP are other authentication protocols but were not developed at MIT under Project Athena.
Why the other options are wrong
- B. SESAME is a different authentication protocol developed later as an enhancement to Kerberos, not the MIT Project Athena protocol.
- C. KryptoKnight is an authentication protocol but was not developed at MIT under Project Athena.
- D. NetSP is an authentication protocol but was not developed at MIT under Project Athena.
Question 26
Which of the following forms of authentication would most likely apply a digital signature algorithm to every bit of data that is sent from the claimant to the verifier?
Show answer and explanation
Correct answer: B. Continuous authentication
Continuous authentication applies cryptographic verification (such as digital signatures) to every bit of data transmitted between the claimant and verifier throughout the entire session, not just at initial login. This ongoing verification distinguishes it from other methods that authenticate only at session start. Dynamic, encrypted, and robust authentication refer to different aspects of authentication strength or responsiveness but do not specifically denote the application of digital signatures to every data bit continuously.
Why the other options are wrong
- A. Dynamic authentication adjusts requirements based on risk factors, not necessarily applying signatures to all data.
- C. Encrypted authentication encrypts credentials but does not specifically apply digital signatures to every data bit.
- D. Robust authentication implies strength but does not specifically refer to continuous bit-level signature application.
Question 27
Which of the following can best eliminate dial-up access through a Remote Access Server as a hacking vector?
Show answer and explanation
Correct answer: B. Installing the Remote Access Server outside the firewall and forcing legitimate users to authenticate to the firewall.
Placing the Remote Access Server outside the firewall and requiring legitimate users to authenticate to the firewall creates a security boundary that controls dial-up access. This architectural approach means that even if someone dials into the RAS, they cannot access internal resources without passing through firewall authentication. Option A uses better protocols but doesn't eliminate the attack vector; C is ineffective for security; D is impractical for legitimate remote access.
Why the other options are wrong
- A. While TACACS+ provides stronger authentication than basic methods, it doesn't eliminate the dial-up attack vector if the RAS is accessible externally
- C. Ring count settings on modems have no meaningful security impact against hacking attempts
- D. Isolating modems to non-networked hosts defeats the purpose of remote access and is impractical
Question 28
Which of the following would NOT violate the Due Diligence concept?
Show answer and explanation
Correct answer: D. Latest security patches for servers being installed as per the Patch Management process
Due Diligence requires organizations to implement reasonable security measures and maintain them properly. Installing the latest security patches according to a formal Patch Management process demonstrates active, ongoing compliance with due diligence obligations. Options A (outdated policies), B (data owners not establishing protection foundations), and C (not taking mandatory vacations, indicating possible security control fatigue or failure) all represent failures in due diligence by not maintaining reasonable security standards.
Why the other options are wrong
- A. Outdated security policies violate due diligence by failing to address current threats.
- B. Data owners failing to establish protection foundations violates the foundational aspect of due diligence.
- C. Skipping mandatory vacations can indicate inadequate segregation of duties and control weaknesses, violating due diligence.
Question 29
The Orange Book is founded upon which security policy model?
Show answer and explanation
Correct answer: B. The Bell LaPadula Model
The Orange Book (Department of Defense Trusted Computer System Evaluation Criteria) is founded upon the Bell-LaPadula confidentiality model. This model defines mandatory access control policies with security levels and compartments, forming the theoretical foundation for the Orange Book's criteria for evaluating trusted computer systems.
Why the other options are wrong
- A. The Biba Model is an integrity-focused model, while the Orange Book is primarily based on the confidentiality-focused Bell-LaPadula model.
- C. The Clark-Wilson Model is an integrity model developed later and is not the foundation for the Orange Book.
- D. TEMPEST is a government program concerning emissions security, not a security policy model underlying the Orange Book.
Question 30
The throughput rate is the rate at which individuals, once enrolled, can be processed and identified or authenticated by a biometric system. Acceptable throughput rates are in the range of:
Show answer and explanation
Correct answer: C. 10 subjects per minute.
Acceptable throughput rates for biometric systems are generally in the range of 10 subjects per minute. This rate allows sufficient time for each individual to be properly processed, identified, or authenticated while maintaining reasonable operational efficiency. This metric is important for assessing whether a biometric system can handle the required volume of users in practical deployment scenarios.
Why the other options are wrong
- A. 100 subjects per minute is unrealistically high for maintaining accuracy and quality biometric processing.
- B. 25 subjects per minute exceeds typical acceptable throughput standards for most biometric systems.
- D. 50 subjects per minute is too high for maintaining proper biometric authentication quality and accuracy.
Question 31
The typical computer fraudsters are usually persons with which of the following characteristics?
Show answer and explanation
Correct answer: C. They hold a position of trust
The defining characteristic of typical computer fraudsters is that they hold a position of trust. Fraud statistics consistently show that most computer fraud is committed by insiders, employees with legitimate access and trusted positions, who exploit their access for fraudulent purposes. This distinguishes computer fraud from other crimes.
Why the other options are wrong
- A. Many computer fraudsters have no previous law enforcement contact; they are often first-time offenders.
- B. While some fraud involves conspiracy, many computer frauds are committed by individuals acting alone.
- D. This is too vague and general; deviation from norms could describe any criminal, not specifically computer fraudsters.
Question 32
Which of the following are NOT a countermeasure to traffic analysis?
Show answer and explanation
Correct answer: B. Eavesdropping.
Eavesdropping is not a countermeasure to traffic analysis; it is rather a threat or attack method itself. Countermeasures to traffic analysis include padding messages (to obscure message lengths), sending noise (to mask real traffic patterns), and using Faraday cages (to prevent electromagnetic eavesdropping). Eavesdropping is what an attacker performs when conducting traffic analysis, not a defensive measure against it.
Why the other options are wrong
- A. Padding messages is a legitimate countermeasure that obscures actual message lengths.
- C. Sending noise is a valid countermeasure that masks traffic patterns by adding dummy traffic.
- D. A Faraday cage is a legitimate countermeasure that prevents electromagnetic interception.
Question 33
Sensitivity labels are an example of what application control type?
Show answer and explanation
Correct answer: A. Preventive security controls
Sensitivity labels are a preventive security control because they are applied to information before it can be mishandled, preventing unauthorized disclosure or misuse. By classifying data with sensitivity labels, organizations establish a preventive framework that guides how information should be protected, accessed, and handled. This labeling mechanism works to prevent security violations from occurring in the first place rather than detecting or correcting them after they happen.
Why the other options are wrong
- B. Sensitivity labels are not detective controls; they don't identify violations after the fact.
- C. They are not compensating controls; they are standard preventive controls.
- D. Sensitivity labels are security controls, not specifically accuracy controls.
Question 34
Which of the following statements pertaining to biometrics is FALSE?
Show answer and explanation
Correct answer: C. User can be authenticated by what he knows.
The false statement is C. Biometrics authenticate users based on what they ARE (physical attributes like fingerprints, iris patterns) or what they DO (behavior like keystroke dynamics or voice), not on what they KNOW. Knowledge-based authentication (passwords, passphrases) is specifically excluded from biometric authentication. Options A, B, and D are all true statements about biometric systems.
Why the other options are wrong
- A. User behavior can absolutely be used for biometric authentication through keystroke dynamics, voice patterns, and gait analysis.
- B. Unique physical attributes are the primary basis for biometric authentication systems like fingerprints and iris scans.
- D. The crossover error rate (CER) is indeed the standard metric for determining biometric system accuracy, where FAR equals FRR.
Question 35
Rule-Based Access Control (RuBAC) access is determined by rules. Such rules would fit within what category of access control ?
Show answer and explanation
Correct answer: C. Non-Discretionary Access Control (NDAC)
Rule-Based Access Control (RuBAC) falls within Non-Discretionary Access Control (NDAC) because the rules are centrally defined and enforced by the system administrator rather than by individual resource owners. Rules are predetermined conditions that determine access, making access decisions non-discretionary at the individual level.
Why the other options are wrong
- A. Discretionary Access Control allows resource owners to decide who has access; rules-based decisions are centrally enforced, not discretionary.
- B. While Mandatory Access Control uses rules based on security labels, RuBAC is more broadly categorized as Non-Discretionary.
- D. Lattice-based access control is a mathematical model for MAC, not the category encompassing rule-based approaches.
Question 36
As a result of a risk assessment, your security manager has determined that your organization needs to implement an intrusion detection system that can detect unknown attacks and can watch for unusual traffic behavior, such as a new service appearing on the network. What type of intrusion detection system would you select?
Show answer and explanation
Correct answer: D. Traffic anomaly-based
Traffic anomaly-based IDS detection identifies unknown attacks by establishing baselines of normal network behavior and alerting on deviations, including unusual services appearing on the network. This approach can detect zero-day attacks and novel threats that signature-based systems would miss. Protocol anomaly and pattern matching rely on known signatures, while stateful matching analyzes connection states but not behavioral anomalies.
Why the other options are wrong
- A. Protocol anomaly detection focuses on protocol violations, not unknown attacks or unusual traffic behavior patterns.
- B. Pattern matching is signature-based and cannot detect unknown attacks without pre-existing signatures.
- C. Stateful matching tracks connection states but does not detect behavioral anomalies or new services appearing.
Question 37
In the CIA triad, what does the letter A stand for?
Show answer and explanation
Correct answer: C. Availability
In the CIA triad, the letter 'A' stands for Availability, representing the assurance that information and systems are accessible and usable upon demand by authorized users. The three pillars are Confidentiality (preventing unauthorized access), Integrity (ensuring accuracy and completeness), and Availability (ensuring timely access).
Why the other options are wrong
- A. Auditability is an important security principle but is not part of the foundational CIA triad.
- B. Accountability relates to traceability and responsibility but is not represented by 'A' in the CIA triad.
- D. Authentication is a security mechanism but does not represent the 'A' in the CIA triad.
Question 38
Which of the following attacks could capture network user passwords?
Show answer and explanation
Correct answer: B. Sniffing
Sniffing is a passive network attack where an attacker captures unencrypted network traffic, including credentials and passwords transmitted over the network. A network sniffer intercepts data packets traveling across the network and can extract sensitive information like usernames and passwords if they are sent in cleartext or using weak encryption.
Why the other options are wrong
- A. Data diddling involves unauthorized modification of data, not capturing passwords.
- C. IP Spoofing involves forging IP addresses to impersonate a legitimate host but does not directly capture passwords.
- D. Smurfing is a denial-of-service attack that uses ICMP echo requests and does not capture passwords.
Question 39
Which of the following logical access exposures INVOLVES CHANGING data before, or as it is entered into the computer?
Show answer and explanation
Correct answer: A. Data diddling
Data diddling is the technique of altering or manipulating data before or as it enters a computer system. It involves unauthorized modification of data at input time, such as changing values on forms or intercepting keystrokes. Salami techniques involve small thefts aggregated over time; Trojan horses are malicious programs; viruses are self-replicating code, none of these specifically define the act of changing data at entry point.
Why the other options are wrong
- B. Salami techniques involve small incremental thefts, not data modification at entry.
- C. Trojan horses are malicious programs, not specifically data-modification attacks.
- D. Viruses are self-replicating malicious code, not data diddling mechanisms.
Question 40
Which access control model achieves data integrity through well-formed transactions and separation of duties?
Show answer and explanation
Correct answer: A. Clark-Wilson model
The Clark-Wilson model specifically achieves data integrity through well-formed transactions and separation of duties. It ensures that only authorized, well-defined transactions modify data, and requires multiple parties (separation of duties) to approve critical operations. This prevents unauthorized and inconsistent modifications to maintain data integrity.
Why the other options are wrong
- B. The Biba model focuses on preventing unauthorized modifications but does not emphasize well-formed transactions and separation of duties.
- C. The non-interference model addresses information flow security rather than data integrity through transactions and separation of duties.
- D. Sutherland model is not a recognized standard model for achieving data integrity through transactions and separation of duties.
Question 41
Which of the following steps is NOT one of the eight detailed steps of a Business Impact Assessment (BIA):
Show answer and explanation
Correct answer: A. Notifying senior management of the start of the assessment.
Notifying senior management of the start of the assessment is not one of the eight detailed steps of a BIA. While senior management involvement is important, notifying them is typically a preliminary action rather than one of the formal eight steps. The eight steps include identifying critical functions, data gathering, documenting dependencies, calculating impacts (financial and operational), establishing recovery priorities, and developing recommendations.
Why the other options are wrong
- B. Creating data gathering techniques is one of the eight BIA steps.
- C. Identifying critical business functions is one of the eight BIA steps.
- D. Calculating the risk for each business function is one of the eight BIA steps.
Question 42
Who is ultimately responsible for the security of computer based information systems within an organization?
Show answer and explanation
Correct answer: C. The management team.
Ultimate responsibility for information system security within an organization rests with senior management. While technical teams implement and maintain security controls, management is accountable for establishing security policy, allocating resources, defining acceptable risk levels, and ensuring compliance. This responsibility cannot be delegated away; it remains with organizational leadership.
Why the other options are wrong
- A. Tech support provides operational security but not ultimate organizational responsibility.
- B. Operations teams execute security procedures but are not ultimately accountable.
- D. Training teams support security awareness but do not bear ultimate responsibility.
Question 43
What is the primary role of smartcards in a PKI?
Show answer and explanation
Correct answer: D. Tamper resistant, mobile storage and application of private keys of the users
The primary role of smartcards in PKI infrastructure is to serve as tamper-resistant, portable devices that securely store and apply users' private keys. Smartcards provide hardware-based protection against key theft and unauthorized access, while remaining mobile so users can carry their credentials. This is their defining characteristic in PKI implementations.
Why the other options are wrong
- A. Transparent key renewal is a PKI process feature, not a smartcard role.
- B. Certificate distribution is a PKI function, not specific to smartcards.
- C. Fast hardware encryption of raw data is not the primary smartcard function in PKI.
Question 44
Which of the following statements pertaining to protection rings is false?
Show answer and explanation
Correct answer: D. They provide users with a direct access to peripherals D
Protection rings provide controlled access through mediated layers, but they explicitly prevent direct user access to peripherals. Direct peripheral access would bypass the security model that protection rings enforce. Users in outer rings cannot directly access peripherals; they must request access through privileged inner rings, maintaining the security boundary that is the entire purpose of the ring architecture.
Why the other options are wrong
- A. Protection rings do provide strict boundaries and definitions on process access.
- B. Inner ring programs do operate in privileged mode with higher access levels.
- C. Protection rings do support CIA triad requirements in multitasking operating systems by enforcing access control.
Question 45
What is called the percentage at which the False Rejection Rate equals the False Acceptance Rate?
Show answer and explanation
Correct answer: C. Crossover Error Rate (CER)
The Crossover Error Rate (CER) is the point at which False Rejection Rate (FRR) equals False Acceptance Rate (FAR). This represents the system's sensitivity balance point and is often used as a single metric to evaluate overall biometric system accuracy, lower CER indicates better system performance.
Why the other options are wrong
- A. False Rejection Rate is a separate metric; CER is where FRR equals FAR, not FRR itself.
- B. False Acceptance Rate is a separate metric; CER is where FRR equals FAR, not FAR itself.
- D. Failure to Enroll Rate (FTE/FER) measures inability to initially capture a biometric template, not the equality point of error rates.
Question 46
Which of the following is NOT a technique used to perform a penetration test?
Show answer and explanation
Correct answer: A. traffic padding
Traffic padding is a defensive technique used to add dummy data to communications to obscure actual traffic patterns and protect against traffic analysis attacks. It is NOT a penetration testing technique. Scanning and probing, war dialing, and sniffing are all active penetration testing methodologies used to discover vulnerabilities and gather information about target systems.
Why the other options are wrong
- B. Scanning and probing are fundamental penetration testing techniques used to identify open ports and services.
- C. War dialing is a penetration testing technique used to discover modems and remote access points on a network.
- D. Sniffing is a penetration testing technique used to capture and analyze network traffic for sensitive information.
Question 47
A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:
Show answer and explanation
Correct answer: A. Mandatory Access Control
Mandatory Access Control (MAC) is a centralized access control model where a central authority (the system or organization) determines what subjects can access based on organizational security policy, not individual discretion. The key term 'central authority determines' directly matches the MAC definition where access decisions are enforced by the system according to pre-defined security policies.
Why the other options are wrong
- B. Discretionary Access Control allows individual resource owners to determine access, not a central authority.
- C. Non-Discretionary Access Control is not a standard access control model term; MAC is the correct term for centralized policy-based control.
- D. Rule-based Access Control is a general category; MAC is the specific model matching the description of central authority policy enforcement.
Question 48
What IDS approach relies on a database of known attacks?
Show answer and explanation
Correct answer: A. Signature-based intrusion detection
Signature-based intrusion detection relies on a database of known attack signatures or patterns. The IDS compares network traffic and system activity against this predefined database to identify attacks that match known malicious signatures.
Why the other options are wrong
- B. Statistical anomaly-based detection uses baselines and statistical analysis rather than a database of known attacks.
- C. Behavior-based intrusion detection analyzes behavioral patterns rather than relying on a database of known attack signatures.
- D. Network-based intrusion detection refers to deployment location, not the approach of using a database of known attacks.
Question 49
What is called a sequence of characters that is usually longer than the allotted number for a password?
Show answer and explanation
Correct answer: A. passphrase
A passphrase is a sequence of characters (usually words or a sentence) that is typically longer than a standard password. Passphrases provide increased security through length while often being easier for users to remember than random character passwords. They exceed the typical character limits imposed on passwords.
Why the other options are wrong
- B. Cognitive phrase is not a standard security term and does not refer to longer character sequences.
- C. Anticipated phrase is not a recognized authentication credential type.
- D. Real phrase is not a recognized authentication credential type in security terminology.
Question 50
In Discretionary Access Control the subject has authority, within certain limitations,
Show answer and explanation
Correct answer: B. to specify what objects can be accessible.
In Discretionary Access Control (DAC), the subject (typically the owner of a resource) has the authority to specify which objects are accessible and by whom. This is the defining characteristic of DAC, the discretion rests with the resource owner to set access permissions, unlike non-discretionary controls where a central authority makes these decisions.
Why the other options are wrong
- A. DAC explicitly permits subjects to specify accessible objects; no independent third party is required.
- C. DAC allows detailed specification, not just aggregate-level controls without understanding.
- D. While subjects can specify in detail, option B is the more precise and standard definition of DAC authority.
Question 51
In order to enable users to perform tasks and duties without having to go through extra steps it is important that the security controls and mechanisms that are in place have a degree of?
Show answer and explanation
Correct answer: C. Transparency
Transparency in security controls is important so that users can perform their tasks without excessive friction or constant awareness of security mechanisms. Transparent controls enforce security while remaining largely invisible to users, enabling productivity without additional steps.
Why the other options are wrong
- A. Complexity in security controls increases difficulty and user burden rather than enabling task performance.
- B. Non-transparency creates friction and requires users to be constantly aware of security mechanisms, hindering productivity.
- D. While simplicity is somewhat related, transparency is the more precise term addressing how controls should function relative to user awareness.
Question 52
Recovery Site Strategies for the technology environment depend on how much downtime an organization can tolerate before the recovery must be completed. What would you call a strategy where the alternate site is internal, standby ready, with all the technology and equipment necessary to run the applications?
Show answer and explanation
Correct answer: C. Internal Hot Site
An internal hot site is a backup facility located within the organization's infrastructure that is continuously maintained and ready to assume operations immediately with all necessary technology and equipment already in place. The key distinguishing factors are that it is internal (within the organization), hot (fully operational and ready), and has complete redundancy of systems and data.
Why the other options are wrong
- A. External hot sites are located outside the organization's facilities, not internal as described in the question.
- B. Warm sites have some equipment and data but are not fully ready to run immediately like hot sites; they require some startup time.
- D. Dual data centers is a broader infrastructure strategy, not the specific term for an internal standby site with complete equipment readiness.
Question 53
Access Control techniques do not include which of the following?
Show answer and explanation
Correct answer: D. Random Number Based Access Control
Random Number Based Access Control is not a recognized access control technique. Established techniques include Rule-Based Access Control (policies based on rules and conditions), Role-Based Access Control (permissions assigned through roles), and Mandatory Access Control (system-enforced labels and security levels). Random numbers have no legitimate role in access control decision-making.
Why the other options are wrong
- A. Rule-Based Access Control is a recognized technique using conditional rules.
- B. Role-Based Access Control is one of the most widely used access control models.
- C. Mandatory Access Control is a fundamental access control approach.
Question 54
Which of the following is covered under Crime Insurance Policy Coverage?
Show answer and explanation
Correct answer: D. Money and Securities
Money and securities are covered under Crime Insurance Policy Coverage, which protects against theft, embezzlement, and fraudulent acts involving cash and negotiable instruments. Crime insurance specifically addresses coverage for monetary losses due to criminal activity. Inscribed documents, manuscripts, and accounts receivable are covered under different policy types such as valuable paper insurance or accounts receivable insurance.
Why the other options are wrong
- A. Inscribed, printed and written documents are covered under valuable paper insurance, not crime insurance.
- B. Manuscripts are covered under valuable paper insurance, not crime insurance.
- C. Accounts receivable are covered under accounts receivable insurance, not crime insurance.
Question 55
The following is NOT a security characteristic we need to consider while choosing a biometric identification systems:
Show answer and explanation
Correct answer: B. cost
When evaluating biometric identification systems for security purposes, relevant characteristics include the data acquisition process, enrollment process, and speed/user interface, all directly affecting system security and usability. Cost is a budgetary and procurement consideration, not a security characteristic. While cost matters in implementation decisions, it does not determine whether a biometric system is secure or suitable from a security perspective.
Why the other options are wrong
- A. Data acquisition process is critical to biometric accuracy and security.
- C. Enrollment process security directly affects system integrity and user identity validation.
- D. Speed and user interface affect security by influencing user compliance and system reliability.
Question 56
Prior to a live disaster test also called a Full Interruption test, which of the following is most important?
Show answer and explanation
Correct answer: D. Conduct of a successful Parallel Test
Conducting a successful Parallel Test prior to a Full Interruption test is most important because it allows the organization to validate recovery procedures in a controlled environment without risking business operations. A Parallel Test verifies that recovery mechanisms function correctly before attempting a live interruption test, ensuring confidence in the plan and identifying issues that must be resolved before the more disruptive full interruption exercise.
Why the other options are wrong
- A. Restoring files is a component of test execution but less critical than pre-testing validation.
- B. While documenting expected findings is useful, it does not mitigate the primary risk of conducting an untested interruption.
- C. Physical security arrangements, while necessary, are logistical concerns less critical than ensuring the recovery plan actually works.
Question 57
Which of the following test makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems?
Show answer and explanation
Correct answer: B. Security testing
Security testing specifically validates that a modified or new system includes appropriate access controls and does not introduce security vulnerabilities that could compromise other systems or the organization. This testing examines authentication, authorization, encryption, and other security mechanisms. Recovery testing addresses system restoration, stress/volume testing examines performance under load, and interface testing validates system interconnections, none focus on security controls and vulnerability assessment.
Why the other options are wrong
- A. Recovery testing focuses on system restoration and continuity after failures.
- C. Stress/volume testing evaluates system performance under heavy loads and extreme conditions.
- D. Interface testing validates data exchange and compatibility between systems.
Question 58
Which of the following is the FIRST step in protecting data's confidentiality?
Show answer and explanation
Correct answer: C. Identify which information is sensitive
Before implementing any technical controls, you must first identify which information is sensitive and requires protection. This discovery and classification phase is foundational, you cannot effectively apply encryption, firewalls, or access controls without knowing what data needs protection and why. Starting with technical measures without understanding your sensitive data is inefficient and may leave critical information unprotected.
Why the other options are wrong
- A. Installing a firewall is a network-level measure that assumes you already know what to protect.
- B. Implementing encryption without identifying sensitive data wastes resources on non-critical information.
- D. Reviewing access rights is appropriate only after identifying which data requires confidentiality protection.
Question 59
Which of the following control pairings include: organizational policies and procedures, pre-employment background checks, strict hiring practices, employment agreements, employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks?
Show answer and explanation
Correct answer: A. Preventive/Administrative Pairing
All items listed, hiring practices, background checks, employment agreements, termination procedures, vacation scheduling, security awareness training, and access sign-up procedures, are organizational policies and administrative practices designed to prevent security violations before they occur. These are characteristic of preventive/administrative control pairing.
Why the other options are wrong
- B. Technical controls involve technology like encryption and firewalls, not employment and training procedures.
- C. Physical controls involve access cards, locks, and surveillance systems, not human resource practices.
- D. Detective controls identify violations after the fact, and this list emphasizes prevention, not detection.
Question 60
Who is responsible for initiating corrective measures and capabilities used when there are security violations?
Show answer and explanation
Correct answer: C. Management
Management is responsible for initiating corrective measures and capabilities when security violations occur. While auditors detect violations, security administrators implement controls, and data owners protect data, it is management's responsibility to direct and authorize the corrective actions and resource allocation needed to address security breaches and establish response capabilities.
Why the other options are wrong
- A. Information systems auditors detect and report violations but do not initiate corrective measures.
- B. Security administrators implement measures but do not have authority to initiate corrective action.
- D. Data owners protect their data but are not responsible for organizational-level corrective measures.
Question 61
The Reference Validation Mechanism that ensures the authorized access relationships between subjects and objects is implementing which of the following concept:
Show answer and explanation
Correct answer: A. The reference monitor.
The reference monitor is the core security mechanism that enforces access control policies by mediating all access requests between subjects and objects. It validates every reference to ensure authorized access relationships are maintained, making it the fundamental implementation that ensures subjects can only access objects they have permission to use.
Why the other options are wrong
- B. DAC is a type of access control policy that the reference monitor may enforce, but DAC itself is not the mechanism that validates references.
- C. The security kernel is the hardware/software foundation that implements the reference monitor, but the reference monitor is the specific validation mechanism.
- D. MAC is another type of access control policy that the reference monitor may enforce, but MAC is not the validation mechanism itself.
Question 62
External consistency ensures that the data stored in the database is:
Show answer and explanation
Correct answer: D. consistent with the real world.
External consistency ensures that data stored in the database is consistent with the real world. This means that the data accurately reflects real-world entities, relationships, and values. It is a key concept in the Clark-Wilson integrity model, representing the agreement between the logical database state and actual real-world conditions.
Why the other options are wrong
- A. This is the opposite of external consistency; data should be consistent with the real world, not inconsistent.
- B. This describes transmission consistency rather than external consistency.
- C. Logical consistency refers to internal consistency, not external consistency with the real world.
Question 63
Which of the following statements pertaining to RADIUS is incorrect:
Show answer and explanation
Correct answer: D. Most RADIUS servers can work with DIAMETER servers.
While RADIUS servers can act as proxies (A), support redundancy through secondary servers (B), and have built-in database connectivity (C), the statement about RADIUS servers working with DIAMETER is misleading. DIAMETER is a separate, more advanced protocol designed as an AAA successor to RADIUS, not something that RADIUS servers typically have built-in capability to work with directly as peers.
Why the other options are wrong
- A. RADIUS servers legitimately function as proxies for forwarding requests to other authentication domains
- B. Most RADIUS clients do support queries to secondary RADIUS servers for redundancy and failover
- C. Most RADIUS server implementations include database connectivity for billing and reporting functions
Question 64
Which of the following statements pertaining to Kerberos is TRUE?
Show answer and explanation
Correct answer: A. Kerberos does not address availability
Statement A is true: Kerberos does not address availability. Kerberos focuses on authentication and authorization through symmetric key cryptography but does not provide mechanisms to prevent denial-of-service attacks or ensure service availability. Kerberos does use symmetric keys, does address integrity through authentication, and does provide confidentiality through encryption.
Why the other options are wrong
- B. This is false; Kerberos provides integrity through its authentication mechanisms and message authentication codes.
- C. This is false; Kerberos fundamentally depends on symmetric key cryptography for all its operations.
- D. This is false; Kerberos provides confidentiality through symmetric encryption of messages and tickets.
Question 65
Who should direct short-term recovery actions immediately following a disaster?
Show answer and explanation
Correct answer: C. Disaster Recovery Manager.
The Disaster Recovery Manager should direct short-term recovery actions immediately following a disaster because this role is specifically designated, trained, and authorized to coordinate emergency response activities. While the CEO provides overall strategic direction and the COO may oversee broader operations, the DR Manager possesses the specialized expertise and operational authority to execute immediate tactical recovery decisions and coordinate with technical teams.
Why the other options are wrong
- A. The CIO may be involved but focuses on IT infrastructure rather than directing overall recovery actions.
- B. The COO may coordinate broader operational recovery but is not typically the immediate director of short-term technical recovery actions.
- D. The CEO provides strategic oversight but should not be directly involved in tactical short-term recovery direction.
Question 66
According to private sector data classification levels, how would salary levels and medical information be classified?
Show answer and explanation
Correct answer: D. Confidential.
Salary levels and medical information are highly sensitive personal data that would cause significant harm if disclosed. In standard private sector classification schemes, such information is classified as Confidential, the highest sensitivity level requiring maximum protection. Public (A) applies to information with no sensitivity. Internal Use Only (B) applies to general business information. Restricted (C) is below Confidential in some schemes but Confidential is the standard classification for sensitive personal data.
Why the other options are wrong
- A. Public classification is for information with no sensitivity or that should be disclosed.
- B. Internal Use Only applies to general business information, not highly sensitive personal data.
- C. Restricted may be used in some schemes but Confidential is the standard classification for salary and medical data.
Question 67
Which type of password provides maximum security because a new password is required for each new log-on?
Show answer and explanation
Correct answer: A. One-time or dynamic password
One-time or dynamic passwords provide maximum security because a new password is generated and required for each new log-on session. This eliminates the risk of password replay attacks and compromised credentials being reused, as each authentication instance requires a unique password that is valid only once.
Why the other options are wrong
- B. Cognitive passwords rely on personal knowledge questions, which are less secure than one-time passwords and can be compromised if information becomes public.
- C. Static passwords remain the same across sessions, making them vulnerable to replay attacks and providing less security than one-time passwords.
- D. Passphrases are longer sequences of characters but are still static if reused, providing less security than one-time dynamic passwords.
Question 68
The primary service provided by Kerberos is which of the following?
Show answer and explanation
Correct answer: C. authentication
Kerberos is primarily an authentication service within a network environment. It provides mutual authentication between clients and servers using tickets and a trusted third party (the Key Distribution Center), ensuring that both parties can verify each other's identity within a networked system.
Why the other options are wrong
- A. Non-repudiation ensures a user cannot deny their actions; while Kerberos provides authentication, it is not its primary service.
- B. Confidentiality is supported through encryption in Kerberos, but authentication is the primary service it provides.
- D. Authorization (access control) is handled by separate systems; Kerberos focuses on authentication, not authorization decisions.
Question 69
Ensuring least privilege does not require:
Show answer and explanation
Correct answer: B. Ensuring that the user alone does not have sufficient rights to subvert an important process.
Least privilege requires identifying the user's job (A), determining minimum required privileges (C), and restricting to only those privileges (D). However, ensuring that a user alone cannot subvert an important process addresses separation of duties and dual control, which is a separate security principle from least privilege. Least privilege focuses on what access a single user needs, not on preventing that user from acting alone on critical processes.
Why the other options are wrong
- A. Identifying job function is essential to determine what privileges are needed.
- C. Determining minimum required privileges is a core component of least privilege.
- D. Restricting users to required privileges and nothing more is the definition of least privilege.
Question 70
What does the Clark-Wilson security model focus on?
Show answer and explanation
Correct answer: B. Integrity
The Clark-Wilson security model focuses on integrity, particularly data integrity and preventing unauthorized modification or corruption of data. It uses well-formed transactions and separation of duties to maintain data integrity. While accountability is supported through audit trails, the primary focus is ensuring that data remains accurate and unaltered.
Why the other options are wrong
- A. Confidentiality is the focus of models like Bell-LaPadula, not Clark-Wilson.
- C. While accountability is a component through audit mechanisms, integrity is the primary focus.
- D. Availability is not the primary concern of the Clark-Wilson model.
Question 71
Which of the following Intrusion Detection Systems (IDS) uses a database of attacks, known system vulnerabilities, monitoring current attempts to exploit those vulnerabilities, and then triggers an alarm if an attempt is found?
Show answer and explanation
Correct answer: A. Knowledge-Based ID System
Knowledge-Based IDS (also called signature-based IDS) maintains a database of known attacks and system vulnerabilities, monitors for attempts to exploit those vulnerabilities, and generates alarms when matches are found. This matches the description exactly. Options B, C, and D refer to different IDS types that use different detection methodologies not based on a vulnerability database approach.
Why the other options are wrong
- B. Application-Based IDS focuses on application-layer monitoring, not database-driven vulnerability detection.
- C. Host-Based IDS monitors individual host activity, not a centralized attack database.
- D. Network-Based IDS can use knowledge-based approaches but is defined by deployment location, not by this specific functional characteristic.
Question 72
Which access control model was proposed for enforcing access control in government and military applications?
Show answer and explanation
Correct answer: A. Bell-LaPadula model
The Bell-LaPadula model was specifically designed for government and military applications to enforce confidentiality through mandatory access control. It uses security labels and clearance levels to prevent unauthorized information disclosure, establishing 'no read up, no write down' rules essential for classified information protection in government and military contexts.
Why the other options are wrong
- B. The Biba model focuses on integrity rather than confidentiality for government/military applications.
- C. Sutherland model is not a standard access control model proposed for government/military applications.
- D. The Brewer-Nash model addresses conflict of interest in commercial environments, not government/military applications.
Question 73
Due care is not related to:
Show answer and explanation
Correct answer: C. Profit
Due care is a legal and ethical standard referring to the level of care that a reasonable person would exercise in similar circumstances. It is fundamentally connected to good faith (A), the prudent man standard (B), and acting in the best interest of stakeholders (D). Profit (C) is an economic motive unrelated to the concept of due care, which is about responsibility, diligence, and reasonableness rather than financial gain.
Why the other options are wrong
- A. Good faith is directly related to the concept of due care.
- B. The prudent man standard is a foundational concept of due care.
- D. Acting in the best interest of others is central to due care obligations.
Question 74
What is considered the most important type of error to avoid for a biometric access control system?
Show answer and explanation
Correct answer: B. Type II Error
Type II Error (false negatives/false non-match rate) is the most critical error to avoid in biometric access control systems because it represents unauthorized users being accepted as legitimate. This creates a direct security breach, whereas Type I Error (false positives/false match rate) denies legitimate users but doesn't compromise security.
Why the other options are wrong
- A. Type I Error represents rejecting authorized users, which is an inconvenience rather than a security failure.
- C. Combined Error Rate is less specific than focusing on the error type that represents actual security risk.
- D. Crossover Error Rate is a metric but not the most important characteristic to assess; the direction of error matters more.
Question 75
What is a common problem when using vibration detection devices for perimeter control?
Show answer and explanation
Correct answer: A. They are vulnerable to non-adversarial disturbances.
Vibration detection devices for perimeter control are commonly affected by non-adversarial disturbances such as wind, animal movement, traffic vibrations, and weather-related ground movement. These false alarms represent a significant operational challenge because they reduce system reliability and operator confidence. While electronic defeat, weather effects, and installation depth may be considerations, the primary documented problem is susceptibility to legitimate environmental vibrations that trigger false alarms.
Why the other options are wrong
- B. Electronic defeat is possible but not the most common practical problem encountered in field deployments.
- C. While weather can affect sensors, this is a secondary concern compared to non-adversarial vibration sources.
- D. Frost line burial is a technical installation requirement, not a common operational problem with the devices.
Question 76
What is the main issue with media reuse?
Show answer and explanation
Correct answer: B. Data remanence
Data remanence is the residual representation of digital data that remains even after deletion or formatting attempts. This is the primary security concern with media reuse because sensitive data can be recovered from improperly sanitized media. While degaussing, media destruction, and purging are all methods used to address remanence, the main issue itself is the presence of recoverable data on reused media.
Why the other options are wrong
- A. Degaussing is a solution to data remanence, not the main issue.
- C. Media destruction is one method to prevent reuse issues, not the issue itself.
- D. Purging is a technique to address remanence, not the core problem.
Question 77
What is the Biba security model concerned with?
Show answer and explanation
Correct answer: D. Integrity
The Biba security model is specifically designed to protect integrity, ensuring that data is not modified by unauthorized users or processes. It focuses on maintaining data accuracy and consistency rather than controlling information disclosure, making integrity its primary concern.
Why the other options are wrong
- A. Confidentiality is the primary focus of the Bell-LaPadula model, not Biba.
- B. Reliability is not a core security model objective addressed by Biba.
- C. Availability is not the main concern of the Biba integrity model.
Question 78
In which of the following model are Subjects and Objects identified and the permissions applied to each subject/object combination are specified. Such a model can be used to quickly summarize what permissions a subject has for various system objects.
Show answer and explanation
Correct answer: A. Access Control Matrix model
The Access Control Matrix model explicitly identifies subjects (users, processes) and objects (files, resources) and creates a matrix showing what permissions each subject has for each object. This allows for a quick summary of all permissions in a system and is the standard model for representing discretionary access control relationships.
Why the other options are wrong
- B. The Take-Grant model focuses on how rights can be transferred between subjects and objects, not on specifying permissions in a matrix format.
- C. The Bell-LaPadula model is a confidentiality-focused model concerned with security levels and classification, not permission matrices.
- D. The Biba model is an integrity-focused model concerned with preventing unauthorized modifications, not permission matrices.
Question 79
Which of the following can be used as a covert channel?
Show answer and explanation
Correct answer: A. Storage and timing.
Covert channels are methods of communication that violate security policy by transmitting information in ways not intended for communication. Storage channels (using shared resources like disk space) and timing channels (exploiting variations in system response time) are the two primary classifications of covert channels recognized in security literature. Low bits, permissions, and classification are not established covert channel categories.
Why the other options are wrong
- B. Low bits are not a recognized covert channel type; timing and storage are the standard classifications.
- C. Permissions are access control mechanisms, not covert channel vectors.
- D. Classification levels are data labeling schemes, not covert channel methods.
Question 80
Which of the following would be the MOST serious risk where a systems development life cycle methodology is inadequate?
Show answer and explanation
Correct answer: D. The project will fail to meet business and user needs.
An inadequate systems development life cycle methodology creates the most serious risk of failing to meet business and user needs. While late delivery, cost overruns, and incompatibility are negative outcomes, they are secondary consequences. The fundamental purpose of SDLC is to ensure that systems are developed to satisfy actual business requirements and user expectations. Without adequate methodology, there is no systematic way to capture, validate, and ensure those needs are met throughout development.
Why the other options are wrong
- A. Late completion is a scheduling risk but does not address the core purpose of development.
- B. Cost overruns result from poor planning but are a financial rather than fundamental risk.
- C. Incompatibility is a technical risk but does not address whether user needs are satisfied.
Question 81
Which of the following statements pertaining to using Kerberos without any extension is false?
Show answer and explanation
Correct answer: C. Kerberos uses public key cryptography.
The false statement is that Kerberos uses public key cryptography. Kerberos uses symmetric key cryptography (specifically DES, 3DES, or AES in standard implementations), not asymmetric/public key cryptography. It relies on a shared secret (password) and symmetric encryption for authentication between clients, servers, and the Key Distribution Center.
Why the other options are wrong
- A. A client can be impersonated through password-guessing is true; weak passwords are vulnerable.
- B. Kerberos is a third-party authentication protocol is true; it uses a KDC as a trusted third party.
- D. Kerberos provides robust authentication is true; it is widely used for strong authentication in enterprise environments.
Question 82
Which of the following is most appropriate to notify an internal user that session monitoring is being conducted?
Show answer and explanation
Correct answer: A. Logon Banners
Logon banners are the most appropriate and direct mechanism to notify users that session monitoring is being conducted. They appear at login, before a user establishes a session, providing clear notice at the point of access when users expect and are most receptive to security notices. This method ensures all users see the notification and documents consent.
Why the other options are wrong
- B. Wall posters are not reliable for notification since not all users may see them, and they do not provide consistent documentation of notice.
- C. Employee handbooks are too general and not sufficiently prominent or timely for session monitoring notifications.
- D. Written agreements are important but less practical as the primary notification mechanism since they require processing outside the login flow.
Question 83
What are called user interfaces that limit the functions that can be selected by a user?
Show answer and explanation
Correct answer: A. Constrained user interfaces
Constrained user interfaces are designed to limit the functions and options available to users, restricting them to only those selections appropriate for their role or security level. This controls what actions users can perform by reducing available choices in the interface itself.
Why the other options are wrong
- B. Limited user interfaces is not the standard terminology used in security control frameworks.
- C. Mini user interfaces refers to size or format, not functional restriction for security purposes.
- D. Unlimited user interfaces would provide unrestricted access, the opposite of the intended control.
Question 84
It is a violation of the "separation of duties" principle when which of the following individuals access the software on systems implementing security?
Show answer and explanation
Correct answer: D. systems programmer
A systems programmer who implements security software while also having access to that same security system creates a violation of separation of duties, allowing them to modify security controls without oversight or review. Security administrators, analysts, and systems auditors have distinct roles that support checks and balances; however, a programmer implementing and then accessing security systems consolidates too much control in one person.
Why the other options are wrong
- A. Security administrators properly manage security controls as part of their role
- B. Security analysts assess and review security but don't typically implement access controls
- C. Systems auditors review controls independently and should not implement them
Question 85
Which of the following is NOT a basic component of security architecture?
Show answer and explanation
Correct answer: A. Motherboard
A motherboard is a hardware component but is NOT considered a basic component of security architecture. Security architecture typically focuses on functional and logical components like the CPU, storage, and I/O devices that process, store, and transmit data. The motherboard is infrastructure that connects these elements but is not itself a security architecture component.
Why the other options are wrong
- B. The CPU is a core security component responsible for executing security functions and cryptographic operations.
- C. Storage devices are fundamental security components for storing sensitive data and implementing protections.
- D. Peripherals and I/O devices are security components through which data enters and exits the system.
Question 86
Which of the following Operation Security controls is intended to prevent unauthorized intruders from internally or externally accessing the system, and to lower the amount and impact of unintentional errors that are entering the system?
Show answer and explanation
Correct answer: B. Preventative Controls
Preventative Controls are designed to stop unauthorized access and intrusions before they occur, as well as to reduce unintentional errors from entering the system. They work proactively to block threats and mistakes at the point of entry, preventing problems rather than responding to them.
Why the other options are wrong
- A. Detective Controls identify and respond to unauthorized access after it has occurred, not prevent it.
- C. Corrective Controls remediate damage after a security incident, not prevent unauthorized access.
- D. Directive Controls establish policies and procedures but do not directly prevent unauthorized access.
Question 87
A prolonged high voltage is a:
Show answer and explanation
Correct answer: C. surge
A surge is a prolonged increase in voltage above normal levels. It differs from a spike by duration; surges last longer and represent sustained high-voltage conditions.
Why the other options are wrong
- A. A spike is momentary high voltage, whereas a surge is prolonged.
- B. A blackout is complete power loss, not high voltage.
- D. A fault is a general term and does not specifically describe prolonged high voltage.
Question 88
The Computer Security Policy Model the Orange Book is based on is which of the following?
Show answer and explanation
Correct answer: A. Bell-LaPadula
The Bell-LaPadula model is the security policy framework upon which the U.S. Department of Defense's Orange Book (Trusted Computer System Evaluation Criteria) is based. The Bell-LaPadula model defines security properties including the simple security property (no read up) and the star property (no write down), establishing mandatory access control principles. These concepts are foundational to the Orange Book's evaluation criteria for computer security.
Why the other options are wrong
- B. The Data Encryption Standard (DES) is a cryptographic algorithm, not a security policy model.
- C. Kerberos is an authentication protocol, not the policy model underlying the Orange Book.
- D. Tempest refers to shielding against electromagnetic emissions, not a security policy model.
Question 89
What prevents a process from accessing another process' data?
Show answer and explanation
Correct answer: B. Process isolation
Process isolation is the primary mechanism that prevents one process from accessing another process's data. It creates a logical separation at the OS level, ensuring that each process operates within its own protected memory space and cannot directly access or modify the memory or resources of other processes.
Why the other options are wrong
- A. Memory segmentation is a memory management technique but not the primary mechanism preventing inter-process data access.
- C. The reference monitor enforces access control policies but operates as part of process isolation, not instead of it.
- D. Data hiding is an application-level concept, not a system-level mechanism for preventing process-to-process data access.
Question 90
What can best be defined as high-level statements, beliefs, goals and objectives?
Show answer and explanation
Correct answer: B. Policies
Policies are high-level statements that articulate beliefs, goals, and objectives of an organization regarding security. Standards are specific technical requirements, guidelines are recommendations for implementation, and procedures are detailed step-by-step instructions. Policies form the top of the documentation hierarchy and set the strategic direction.
Why the other options are wrong
- A. Standards are specific technical and operational requirements, not high-level statements.
- C. Guidelines are recommendations for how to implement policies, not high-level goal statements.
- D. Procedures are detailed step-by-step instructions, not high-level strategic statements.
Question 91
The number of violations that will be accepted or forgiven before a violation record is produced is called which of the following?
Show answer and explanation
Correct answer: A. clipping level
The clipping level (also called threshold) is a security auditing concept that defines the number of violations that will be tolerated or recorded before generating a formal violation report. It allows administrators to filter out minor or isolated incidents and focus on patterns or repeated violations. This prevents log flooding from trivial events while ensuring that significant security concerns are documented.
Why the other options are wrong
- B. Acceptance level is not standard security terminology for audit violation thresholds.
- C. Forgiveness level is not a recognized term in security audit configuration.
- D. Logging level refers to the verbosity or detail of log messages, not violation tolerance.
Question 92
How often should a Business Continuity Plan be reviewed?
Show answer and explanation
Correct answer: C. At least once a year
Industry best practice and most IT certification standards require Business Continuity Plans to be reviewed at least annually. This frequency ensures the plan remains current with organizational changes, technology updates, and lessons learned, while not being so frequent as to create unnecessary overhead. Annual reviews allow sufficient time to identify meaningful changes and implement updates systematically.
Why the other options are wrong
- A. Monthly reviews are excessive and create unnecessary administrative burden without proportional benefit.
- B. Semi-annual reviews, while more frequent than necessary, are not the standard recommended interval in most frameworks.
- D. Quarterly reviews are overly frequent for routine updates and only appropriate for high-risk environments or post-incident reassessment.
Question 93
Which of the following is most likely to be useful in detecting intrusions?
Show answer and explanation
Correct answer: C. Audit trails
Audit trails record system and network activities, creating a detailed log of events that can be analyzed to detect suspicious behavior, unauthorized access attempts, and intrusion indicators. IDS systems rely heavily on audit trail data to identify potential security incidents.
Why the other options are wrong
- A. Access control lists prevent unauthorized access but do not directly help detect intrusions that have already occurred.
- B. Security labels classify data sensitivity but are not primarily used for detecting intrusion activities.
- D. Information security policies define the security framework but do not themselves detect intrusions without detection mechanisms.
Question 94
What is the primary goal of setting up a honeypot?
Show answer and explanation
Correct answer: D. To know when certain types of attacks are in progress and to learn about attack techniques so the network can be fortified.
The primary goal of a honeypot is to learn about attack methodologies and techniques by observing attackers in a controlled environment, which enables defensive improvements. While honeypots do lure attackers (A) and can track them (B), these are tactical effects rather than the primary strategic goal. Option C oversimplifies the concept. The learning and intelligence-gathering function (D) is what makes honeypots valuable for security fortification.
Why the other options are wrong
- A. Luring attackers is a tactic, not the primary goal of a honeypot.
- B. Tracking hackers is a secondary benefit, not the primary purpose.
- C. While honeypots are sacrificial, this description doesn't capture their true intelligence-gathering purpose.
Question 95
Which of the following is most affected by denial-of-service (DOS) attacks?
Show answer and explanation
Correct answer: D. Availability
Denial-of-service attacks primarily target availability by overwhelming systems with traffic or requests, making legitimate services inaccessible to authorized users. While DoS attacks may incidentally affect other security attributes, availability is the core CIA triad component that DoS attacks are specifically designed to compromise.
Why the other options are wrong
- A. Confidentiality is not the primary concern of DoS attacks; they do not focus on unauthorized data disclosure.
- B. Integrity is not directly affected by DoS attacks, which do not typically modify data.
- C. Accountability is not the main impact; DoS attacks disable services rather than affect user tracking.
Question 96
Which of the following biometric parameters are better suited for authentication use over a long period of time?
Show answer and explanation
Correct answer: A. Iris pattern
Iris patterns remain stable and consistent throughout a person's lifetime, making them highly suitable for long-term authentication. The iris is protected by the eye's interior location, resistant to environmental damage and aging changes. Voice patterns, signature dynamics, and retina patterns all change over time due to aging, illness, accent variation, and wear, making them less reliable for extended periods.
Why the other options are wrong
- B. Voice patterns change due to age, illness, emotional state, and environmental factors over time.
- C. Signature dynamics are subject to significant variation due to aging, injury, and psychological factors.
- D. Retina patterns can deteriorate with age and medical conditions, making them less stable long-term than iris patterns.
Question 97
The scope and focus of the Business continuity plan development depends most on:
Show answer and explanation
Correct answer: B. Business Impact Analysis (BIA)
The Business Impact Analysis (BIA) identifies critical functions, recovery priorities, and resource requirements, which directly determines the scope and focus of BCP development. The BIA findings dictate what must be protected and recovered, forming the foundation for all subsequent planning decisions.
Why the other options are wrong
- A. While senior management provides direction, the BIA provides the analytical basis for scope.
- C. Scope initiation is part of the process but depends on BIA findings.
- D. Committee skills support execution but don't determine scope direction like BIA findings do.
Question 98
Which of the following security controls might force an operator into collusion with personnel assigned organizationally within a different function in order to gain access to unauthorized data?
Show answer and explanation
Correct answer: A. Limiting the local access of operations personnel
Limiting the local access of operations personnel is a control that implements separation of duties by restricting what any single operator can access locally. This forces individuals seeking unauthorized data access to collaborate with personnel in other functional areas, requiring collusion rather than allowing a single person to breach security. By compartmentalizing access privileges, no single person can unilaterally gain unauthorized access to sensitive information.
Why the other options are wrong
- B. Job rotation reduces the risk of fraud and collusion by moving personnel between roles, but does not specifically force collusion as a requirement.
- C. Management monitoring of audit logs is a detective control that identifies unauthorized access after the fact, not a preventive control that forces collusion.
- D. Regular password changes is an access control mechanism that strengthens authentication but does not directly force collusion requirements.
Question 99
What is the difference between Advisory and Regulatory security policies?
Show answer and explanation
Correct answer: C. Advisory policies are not mandated. Regulatory policies must be implemented.
Regulatory policies are mandatory requirements that must be implemented to comply with laws, regulations, or contractual obligations. Advisory policies are recommendations or guidelines that organizations should follow but are not legally or contractually mandated, allowing more discretion in implementation.
Why the other options are wrong
- A. Advisory and regulatory policies are fundamentally different in their enforcement nature and mandatory status.
- B. The relationship between detail level and policy type is reversed; detail level does not determine whether a policy is regulatory or advisory.
- D. This states the opposite of the correct relationship; advisory policies are not mandated while regulatory ones are.
Question 100
Which of the following phases of a software development life cycle normally incorporates the security specifications, determines access controls, and evaluates encryption options?
Show answer and explanation
Correct answer: A. Detailed design
The detailed design phase is where security specifications are formally incorporated into the system architecture. This phase involves determining access controls, evaluating encryption options, and establishing security requirements that will guide implementation. While software plans and requirements establish high-level security needs, detailed design translates these into concrete security mechanisms. Implementation executes the design, and product design is earlier stage conceptualization.
Why the other options are wrong
- B. Implementation phase executes the security design but does not determine or evaluate security specifications.
- C. Product design is typically a higher-level phase before detailed design and does not include specific security specification details.
- D. Software plans and requirements establishes what security is needed but not the technical details of how to implement it.
Question 101
Controls to keep password sniffing attacks from compromising computer systems include which of the following?
Show answer and explanation
Correct answer: C. one-time passwords and encryption.
Password sniffing attacks capture unencrypted passwords transmitted over networks. To defend against this, encryption protects passwords in transit, making captured data unreadable. One-time passwords (OTPs) are single-use credentials that become invalid after use, so even if an attacker sniffs them, they cannot be replayed. Together, encryption and one-time passwords provide defense against sniffing: encryption protects static credentials in transit, and OTPs ensure that even intercepted passwords cannot be reused. Static passwords are vulnerable, and recurring passwords offer no protection against sniffing.
Why the other options are wrong
- A. Static and recurring passwords are both vulnerable to sniffing attacks; neither provides protection.
- B. Encryption helps, but recurring passwords can still be sniffed and reused by attackers.
- D. Static passwords are vulnerable to sniffing; one-time passwords alone cannot protect against sniffing of other credential types.
Question 102
The National Institute of Standards and Technology (NIST) standard pertaining to perimeter protection states that critical areas should be illuminated up to?
Show answer and explanation
Correct answer: C. Illiminated at eight feet high with at least two foot-candles
According to NIST standards for perimeter protection, critical areas should be illuminated at eight feet high with at least two foot-candles of light. This level of illumination is sufficient to detect intruders and potential security threats while being cost-effective and practical for most facilities. Two foot-candles provides adequate visibility without excessive energy consumption.
Why the other options are wrong
- A. Nine feet high with three foot-candles exceeds NIST recommendations and is unnecessarily costly.
- B. Eight feet high with three foot-candles exceeds the minimum standard requirement of two foot-candles.
- D. Nine feet high is higher than the NIST standard of eight feet, making it unnecessarily expensive.
Question 103
Which software development model is actually a meta-model that incorporates a number of the software development models?
Show answer and explanation
Correct answer: C. The Spiral model
The Spiral model is a meta-model that incorporates elements of multiple software development approaches, including waterfall, iterative development, and risk management. It cycles through planning, risk analysis, engineering, and evaluation phases, allowing it to combine techniques from various methodologies. The waterfall and modified waterfall are linear sequential models, while CPM is a project management tool, not a meta-model encompassing other development models.
Why the other options are wrong
- A. The Waterfall model is a linear sequential approach, not a meta-model incorporating other models.
- B. The modified Waterfall model is still primarily sequential, not a meta-model.
- D. The Critical Path Model is a project management technique for scheduling, not a software development meta-model.
Question 104
Which of the following describes a computer processing architecture in which a language compiler or pre-processor breaks program instructions down into basic operations that can be performed by the processor at the same time?
Show answer and explanation
Correct answer: A. Very-Long Instruction-Word Processor (VLIW)
Very-Long Instruction-Word (VLIW) processors are designed so that the compiler or pre-processor breaks instructions into basic operations that can be executed simultaneously by the processor. The compiler explicitly schedules multiple operations into long instruction words, enabling parallel execution at the hardware level.
Why the other options are wrong
- B. CISC uses complex instructions that may require multiple cycles; the compiler doesn't break them into parallel operations by design.
- C. RISC uses simpler instructions but doesn't specifically involve the compiler breaking instructions into operations for parallel execution.
- D. Super Scalar architecture uses hardware to dynamically detect and execute independent instructions in parallel, not compiler-driven decomposition.
Question 105
Which of the following BEST explains why computerized information systems frequently fail to meet the needs of users?
Show answer and explanation
Correct answer: C. Inadequate user participation in defining the system's requirements.
Inadequate user participation in defining system requirements is the primary reason computerized systems fail to meet user needs. When users are not involved in specifying requirements, the development team may build systems that don't address actual business problems or user workflows. User participation ensures that requirements capture what is actually needed and that acceptance criteria are clear from the beginning.
Why the other options are wrong
- A. Inadequate QA tools may affect quality but don't directly cause systems to miss user needs if requirements were properly defined.
- B. While user needs do change, this is managed through proper requirements gathering and change control, not the root cause.
- D. Inadequate project management causes schedule and budget issues but doesn't directly explain why systems miss business needs.
Question 106
Which of the following is NOT a compensating measure for access violations?
Show answer and explanation
Correct answer: D. Security awareness
Security awareness is NOT a compensating measure for access violations; it is a preventive control designed to reduce violations from occurring. Compensating measures are implemented after a control fails to mitigate the impact of violations that have already occurred. Backups, business continuity planning, and insurance all address the consequences of access violations after they happen, making them compensating measures.
Why the other options are wrong
- A. Backups are compensating measures that recover data compromised by access violations.
- B. Business continuity planning mitigates the impact of access violations and ensures service restoration.
- C. Insurance compensates for financial losses resulting from access violations.
Question 107
Business Continuity and Disaster Recovery Planning (Primarily) addresses the:
Show answer and explanation
Correct answer: A. Availability of the CIA triad
Business Continuity and Disaster Recovery Planning primarily address the Availability aspect of the CIA triad. These disciplines focus on ensuring that systems, data, and business operations remain accessible and operational despite disruptions or disasters. While confidentiality and integrity are important security considerations, BC/DR's fundamental objective is maintaining availability.
Why the other options are wrong
- B. Confidentiality is primarily addressed through access controls and encryption, not BC/DR planning.
- C. Integrity is primarily addressed through change management and data validation controls, not BC/DR planning.
- D. While BC/DR may touch on all three, the primary focus is specifically on availability, not all three equally.
Question 108
Which of the following is most appropriate to notify an external user that session monitoring is being conducted?
Show answer and explanation
Correct answer: A. Logon Banners
Logon Banners are most appropriate to notify external users that session monitoring is being conducted. Banners displayed at login provide immediate, visible notice to all users before they access the system, creating an effective legal record that users were informed of monitoring. This occurs at the point of access when users interact with the system, making it the most direct and enforceable notification method for external users accessing systems remotely or through public interfaces.
Why the other options are wrong
- B. Wall posters are not effective for external users who may not have physical access to office locations.
- C. Employee Handbook is not appropriate for external users and may not be distributed to them.
- D. Written agreement requires prior arrangement and is not as immediate as a logon banner for all external users.
Question 109
In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person. This raised the necessity of answering 2 questions :
Show answer and explanation
Correct answer: B. what part of body to be used and how to accomplish identification that is viable
When biometric identification systems were being developed, the two critical questions that needed to be answered were: (1) which part of the body could be used for identification, and (2) how to accomplish viable identification using those physical attributes. Option B correctly addresses both of these foundational questions that emerged early in biometric system design.
Why the other options are wrong
- A. Sex and age are demographic characteristics, not the fundamental technical questions about which body parts and methods to use for biometric identification.
- C. Age and income level are not relevant to the core technical challenge of biometric identification system design.
- D. Voice and habits may be biometric factors, but they don't address the fundamental questions of which body parts are suitable and how to accomplish viable identification.
Question 110
How would nonrepudiation be best classified as?
Show answer and explanation
Correct answer: A. A preventive control
Nonrepudiation is a preventive control. By binding an action to its originator, for example with digital signatures and logging, it prevents a party from successfully denying having sent a message or performed a transaction, and deters them from attempting it.
Why the other options are wrong
- B. Logical describes how a control is implemented, not its function, and nonrepudiation is classified by the preventive function it serves.
- C. Nonrepudiation does not repair damage or restore systems after an incident, so it is not corrective.
- D. Nonrepudiation is not a substitute put in place because a primary control is unavailable, so it is not compensating.
Question 111
Which of the following is NOT a characteristic of a host-based intrusion detection system?
Show answer and explanation
Correct answer: A. A HIDS does not consume large amounts of system resources
HIDS systems DO consume large amounts of system resources by continuously monitoring system logs, processes, memory, and file system activity on individual hosts. This high resource consumption is a known disadvantage of HIDS implementations. The other options are all true characteristics: HIDS can analyze system logs and resources, detect unauthorized changes, and notify administrators of unusual events.
Why the other options are wrong
- B. HIDS can analyze system logs, processes, and resources, this is a correct characteristic.
- C. Detecting unauthorized changes to systems is a core function of HIDS.
- D. Notifying administrators of unusual events is a standard HIDS capability.
Question 112
What security model is dependent on security labels?
Show answer and explanation
Correct answer: C. Mandatory access control
Mandatory Access Control (MAC) is dependent on security labels affixed to both subjects and objects. The system enforces access decisions based on comparing these labels according to a defined security policy, making labels fundamental to MAC operation.
Why the other options are wrong
- A. Discretionary access control is based on object owner discretion, not security labels.
- B. Label-based access control is not a standard security model; it describes a characteristic of MAC but is not the formal model name.
- D. Non-discretionary access control is another term for mandatory access control but doesn't specifically emphasize the label dependency.
Question 113
Which of the following usually provides reliable, real-time information without consuming network or host resources?
Show answer and explanation
Correct answer: A. network-based IDS
Network-based IDS (NIDS) provides real-time information by passively monitoring network traffic without requiring installation on individual hosts or consuming significant host resources. It analyzes packets at the network perimeter, making it efficient and non-intrusive compared to host-based approaches that consume CPU and memory on each monitored system.
Why the other options are wrong
- B. Host-based IDS consumes significant host resources including CPU, memory, and disk I/O on the monitored system.
- C. Application-based IDS requires integration with specific applications and consumes application resources.
- D. Firewall-based IDS is less common and still requires processing resources to analyze traffic rules.
Question 114
What does the (star) property mean in the Bell-LaPadula model?
Show answer and explanation
Correct answer: C. No write down
The star (*) property in the Bell-LaPadula model enforces 'no write down,' meaning a subject at a higher security level cannot write information to a lower security level. This prevents classified information from flowing down to lower classification levels and protects confidentiality.
Why the other options are wrong
- A. No write up is not the star property; write up is restricted by other rules.
- B. No read up is the simple security property, not the star property.
- D. No read down is not a primary constraint; the model allows reading at equal or lower levels.
Question 115
Which of the following statements pertaining to access control is false?
Show answer and explanation
Correct answer: B. If access is not explicitly denied, it should be implicitly allowed.
Statement B is false. The correct principle in access control is that if access is NOT explicitly ALLOWED, it should be implicitly DENIED (deny-by-default). This is a fundamental security principle ensuring that users only get the minimum necessary permissions. The statement suggests the opposite, that anything not explicitly denied should be allowed, which would create significant security vulnerabilities. Options A, C, and D all represent correct access control principles.
Why the other options are wrong
- A. The need-to-know principle is fundamental to access control and ensures users access only necessary information.
- C. Access rights based on trust levels is a valid access control approach, particularly in military and classified environments.
- D. Role-based access control is an efficient and widely-used method for assigning rights based on job functions and responsibilities.
Question 116
A prolonged complete loss of electric power is a:
Show answer and explanation
Correct answer: B. blackout
A blackout is a prolonged or complete loss of electric power. This term encompasses both momentary and sustained power outages, representing a total interruption of electrical service.
Why the other options are wrong
- A. A brownout is prolonged low voltage, not complete power loss.
- C. A surge is high voltage, not power loss.
- D. A fault is a general electrical failure term, less specific than blackout.
Question 117
Which of the following questions is less likely to help in assessing physical access controls?
Show answer and explanation
Correct answer: B. Is the operating system configured to prevent circumvention of the security software and application controls?
Question B about operating system configuration to prevent security software circumvention relates to logical/technical controls, not physical access controls. Questions A, C, and D directly assess physical access security: management review of access lists, physical access devices for facilities, and visitor escort procedures are all core physical security controls.
Why the other options are wrong
- A. Regular management review of physical access lists is essential for physical access control assessment.
- C. Keys and access devices for computer rooms and media libraries are direct physical access control measures.
- D. Visitor sign-in and escort procedures are fundamental physical access security controls.
Question 118
Which property ensures that only the intended recipient can access the data and nobody else?
Show answer and explanation
Correct answer: A. Confidentiality
Confidentiality is the security property that ensures only authorized individuals can access sensitive data. It protects information from unauthorized disclosure to unintended recipients through encryption, access controls, and other protective measures.
Why the other options are wrong
- B. Capability is not a standard CIA triad component and does not relate to data access restrictions.
- C. Integrity ensures data has not been altered, not that only intended recipients can access it.
- D. Availability ensures data is accessible when needed, not that it is restricted to intended recipients only.
Question 119
Which security model introduces access to objects only through programs?
Show answer and explanation
Correct answer: C. The Clark-Wilson model
The Clark-Wilson security model introduces the concept that subjects access objects only through programs or transformation procedures (TPs). This mediated access approach ensures that all modifications to objects go through controlled, auditable programs rather than direct access, providing integrity assurance through constrained write operations.
Why the other options are wrong
- A. The Biba model focuses on integrity through a hierarchical structure but doesn't specifically mandate access through programs.
- B. Bell-LaPadula emphasizes confidentiality and does not specifically require access through intermediary programs.
- D. The information flow model concerns the flow of data between security levels, not access mediation through programs.
Question 120
Memory management in TCSEC levels B3 and A1 operating systems may utilize "data hiding". What does this mean?
Show answer and explanation
Correct answer: A. System functions are layered, and none of the functions in a given layer can access data outside that layer.
In TCSEC B3 and A1 systems, data hiding through layered system architecture means that functions are organized in protection layers or rings, and no function within one layer can access data or memory outside that layer. This compartmentalization ensures that even if one layer is compromised, data in other layers remains protected and isolated.
Why the other options are wrong
- B. While auditing processes may have protected memory, this is not what data hiding specifically means in the context of memory layering and compartmentalization.
- C. Restricting write access to ring zero is a specific protection mechanism but does not define data hiding in the architectural layering sense.
- D. Data hiding is an architectural and access control mechanism, not a form of encryption cipher.
Question 121
How should a doorway of a manned facility with automatic locks be configured?
Show answer and explanation
Correct answer: B. It should be configured to be fail-safe.
A manned facility doorway with automatic locks should be configured to be fail-safe, meaning that if power is lost or a system failure occurs, the door unlocks rather than remaining locked. This ensures that occupants can exit safely during emergencies, which is a critical safety requirement. A fail-secure configuration would lock the door on failure, trapping occupants inside, an unacceptable safety hazard. Fail-safe configuration is the standard security and safety practice for automated door systems in occupied facilities.
Why the other options are wrong
- A. Fail-secure would trap occupants inside during emergencies, creating a life safety hazard.
- C. A door delay cipher lock is an alternative access control method but doesn't address the fail-safe requirement.
- D. Anti-piggybacking measures are a separate concern from fail-safe/fail-secure configuration.
Question 122
Which of the following is not a preventive login control?
Show answer and explanation
Correct answer: A. Last login message
A last login message is a detective control that informs users of previous access attempts after authentication succeeds, allowing them to detect unauthorized login attempts. Preventive controls stop unauthorized access before it occurs: password aging enforces periodic changes, minimum password length requires stronger passwords, and account expiration automatically disables old accounts. The last login message only notifies, it does not prevent.
Why the other options are wrong
- B. Password aging is a preventive control that forces regular password updates.
- C. Minimum password length is a preventive control that strengthens password requirements.
- D. Account expiration is a preventive control that automatically blocks access after a set period.
Question 123
What can best be defined as the sum of protection mechanisms inside the computer, including hardware, firmware and software?
Show answer and explanation
Correct answer: C. Trusted computing base
The Trusted Computing Base (TCB) is defined as the sum of all protection mechanisms, including hardware, firmware, and software, that work together to enforce a security policy. It encompasses the complete set of components responsible for security enforcement in a system.
Why the other options are wrong
- A. A trusted system is a broader concept that uses a TCB but is not the sum of protection mechanisms itself.
- B. The security kernel is a component within the TCB, not the sum of all protection mechanisms.
- D. A security perimeter is a conceptual boundary around trusted components, not the mechanisms themselves.
Question 124
Which of the following biometric devices has the lowest user acceptance level?
Show answer and explanation
Correct answer: A. Retina Scan
Retina scan biometrics has the lowest user acceptance level among common biometric methods. This is because retina scanning requires close proximity to the scanner, direct eye contact, and can feel invasive to users. Additionally, there are concerns about eye-related health issues and discomfort. In contrast, fingerprint scans, hand geometry, and signature recognition are less intrusive and more user-friendly.
Why the other options are wrong
- B. Fingerprint scans have higher user acceptance than retina scans.
- C. Hand geometry has higher user acceptance than retina scans.
- D. Signature recognition has higher user acceptance than retina scans.
Question 125
Which of the following is NOT a factor related to Access Control?
Show answer and explanation
Correct answer: B. authenticity
Authenticity is NOT a primary factor related to Access Control in the traditional sense. The core factors of access control are confidentiality (protecting information from unauthorized disclosure), integrity (ensuring information is not modified without authorization), and availability (ensuring authorized users can access resources when needed). These three form the foundation of access control objectives. Authenticity relates to identity verification, which is a component of authentication that precedes access control, not access control itself.
Why the other options are wrong
- A. Integrity is a fundamental access control objective ensuring data is not altered by unauthorized parties.
- C. Confidentiality is a core access control principle protecting information from unauthorized disclosure.
- D. Availability is essential to access control, ensuring authorized users can access protected resources.
Question 126
What is one disadvantage of content-dependent protection of information?
Show answer and explanation
Correct answer: A. It increases processing overhead.
Content-dependent protection requires the system to examine and analyze the actual content of information to make access control decisions. This analysis is computationally expensive and requires the system to process and inspect data in detail before granting access, resulting in significant processing overhead compared to simpler label-based or attribute-based protection mechanisms.
Why the other options are wrong
- B. Content-dependent protection does not inherently require additional password entry; it operates at the system level for access control.
- C. Data locking is not an inherent disadvantage of content-dependent protection; this method does not systematically lock data.
- D. Content-dependent protection does not limit individual address space; it operates orthogonally to memory address allocation.
Question 127
To be admissible in court, computer evidence must be which of the following?
Show answer and explanation
Correct answer: A. Relevant
To be admissible in court, computer evidence must be relevant, meaning it must have a direct bearing on the case and tend to prove or disprove a fact of consequence. Relevance is the fundamental requirement under evidence rules. Decryption, editing, and whether evidence is incriminating are separate considerations that don't determine basic admissibility.
Why the other options are wrong
- B. Evidence does not need to be decrypted to be admissible; encrypted data can be admitted with proper authentication and explanation.
- C. Evidence must not be edited; editing would actually render it inadmissible as it compromises integrity.
- D. Evidence need not be incriminating to be admissible; exculpatory evidence is equally admissible.
Question 128
What is the main concern with single sign-on?
Show answer and explanation
Correct answer: A. Maximum unauthorized access would be possible if a password is disclosed.
The primary security concern with single sign-on (SSO) is that if a user's single password or credential is compromised, an attacker gains access to all systems and resources that user is authorized to access. This creates a single point of failure where one compromised credential results in maximum unauthorized access across multiple systems and applications, rather than compromising access to just one system.
Why the other options are wrong
- B. SSO actually reduces the security administrator's workload by centralizing authentication rather than increasing it.
- C. SSO typically makes password management easier for users since they need to remember only one password, not multiple ones.
- D. SSO does not increase user access rights; it only changes the authentication mechanism, not authorization levels.
Question 129
An alternative to using passwords for authentication in logical or technical access control is:
Show answer and explanation
Correct answer: B. biometrics
Biometrics represents a primary alternative to password-based authentication for logical and technical access control. Biometric systems use unique physical or behavioral characteristics (fingerprints, iris scans, facial recognition, etc.) to verify identity without requiring users to remember or manage passwords, providing both enhanced security and user convenience.
Why the other options are wrong
- A. Managing without passwords entirely is not practical or feasible in most systems.
- C. This option is not a meaningful alternative authentication method.
- D. Physical access control is a different domain and not an alternative to password authentication for logical access.
Question 130
Controlling access to information systems and associated networks is necessary for the preservation of their:
Show answer and explanation
Correct answer: B. Confidentiality, integrity, and availability.
The fundamental security objectives for information systems are confidentiality (preventing unauthorized access), integrity (ensuring data accuracy and completeness), and availability (ensuring timely access to information). These three pillars form the CIA triad, which is the cornerstone of information security. Access controls directly protect these three attributes.
Why the other options are wrong
- A. While confidentiality is correct, authenticity is not one of the three core security objectives that access controls primarily preserve; the triad is CIA, not authenticity-based.
- C. This omits confidentiality, which is a primary objective of access control.
- D. This includes authenticity, which is not part of the standard CIA triad for information system security objectives.
Question 131
Which of the following best describes signature-based detection?
Show answer and explanation
Correct answer: C. Compare system activity, looking for events or sets of events that match a predefined pattern of events that describe a known attack.
Signature-based detection compares system activity against predefined patterns that represent known attacks. This method identifies threats by matching observed events to a database of known attack signatures. It is effective for detecting known threats but cannot detect previously unknown (zero-day) attacks that lack established signatures.
Why the other options are wrong
- A. Comparing source code is static analysis, not signature-based detection of runtime activity.
- B. Detecting behavior patterns of new attacks describes anomaly-based detection, not signature-based detection.
- D. Comparing network nodes and objects is not the focus of signature-based detection, which examines event patterns.
Question 132
The control measures that are intended to reveal the violations of security policy using software and hardware are associated with:
Show answer and explanation
Correct answer: B. Detective/technical
Detective controls using software and hardware technologies such as intrusion detection systems, logging mechanisms, and monitoring tools are designed to identify and reveal security policy violations after they occur. This represents the detective/technical pairing that uses technology to discover breaches.
Why the other options are wrong
- A. Preventive/physical controls prevent violations through barriers and locks, not detection.
- C. Detective/physical controls identify violations through physical means like guard patrols, not software and hardware systems.
- D. Detective/administrative controls reveal violations through procedures and audits, not through software and hardware technology.
Question 133
Password management falls into which control category?
Show answer and explanation
Correct answer: C. Preventive
Password management falls into the preventive control category because it prevents unauthorized access by ensuring strong credentials and proper credential handling. Preventive controls stop security violations before they occur. While password management has technical aspects, the control type classification (preventive, detective, or compensating) is based on its function, prevention of unauthorized access.
Why the other options are wrong
- A. Compensating controls mitigate damage after violations occur; password management prevents violations from happening.
- B. Detective controls identify violations after they occur; password management stops violations before they happen.
- D. Technical is not a standard control type classification in security frameworks; the primary categories are preventive, detective, and compensating.
Question 134
Which access control model is best suited in an environment where a high security level is required and where it is desired that only the administrator grants access control?
Show answer and explanation
Correct answer: B. MAC
Mandatory Access Control (MAC) is best suited for high-security environments because only system administrators can grant access based on fixed security policies; users cannot modify access controls. This centralized, non-discretionary approach ensures strict enforcement of security requirements.
Why the other options are wrong
- A. DAC allows object owners to grant access, giving too much discretion for high-security environments.
- C. Access control matrix is a data structure, not a model suited to high-security requirements.
- D. TACACS is an authentication and authorization protocol, not an access control model.
Question 135
Which of the following would be the best criterion to consider in determining the classification of an information asset?
Show answer and explanation
Correct answer: A. Value
Value is the best criterion for determining information classification because it reflects the impact of loss, disclosure, or modification of the asset. Higher-value assets warrant higher classification levels and stronger protection. Age (B) does not determine sensitivity or importance. Useful life (C) relates to asset management, not classification needs. Personal association (D) is subjective and not a business-driven classification criterion.
Why the other options are wrong
- B. Age of information does not determine its classification level or protection requirements.
- C. Useful life relates to asset lifecycle management, not to information sensitivity classification.
- D. Personal association is subjective and not a professional criterion for determining classification levels.
Question 136
In an organization, an Information Technology security function should:
Show answer and explanation
Correct answer: C. Be lead by a Chief Security Officer and report directly to the CEO.
Best practice security governance requires IT security to be led by a Chief Security Officer (or Chief Information Security Officer) who reports directly to the CEO or equivalent executive level. This ensures security receives appropriate organizational authority and resources, maintains independence from IT operations, and prevents conflicts of interest where IT might prioritize availability over security.
Why the other options are wrong
- A. Placing security within IT operations compromises its independence and authority.
- B. Reporting to specialized units like legal or insurance separates security from technology implementation.
- D. Reporting to the IT function prevents security from having adequate independence and executive authority.
Question 137
In an organization where there are frequent personnel changes, non-discretionary access control using Role Based Access Control (RBAC) is useful because:
Show answer and explanation
Correct answer: B. the access controls are based on the individual's role or title within the organization.
RBAC is particularly useful during frequent personnel changes because access control is tied to the individual's role or job title rather than to the person. When personnel change, you simply reassign the role to a new person without needing to reconfigure individual access permissions, making administration much more efficient.
Why the other options are wrong
- A. This is vague and doesn't explain the specific advantage of RBAC.
- C. This is factually incorrect; RBAC is explicitly based on roles and titles.
- D. While partially correct, option B is more direct and precise in explaining why RBAC handles personnel changes well.
Question 138
What does the simple integrity axiom mean in the Biba model?
Show answer and explanation
Correct answer: B. No read down
The Biba simple integrity axiom states that a subject cannot read data at a lower integrity level, known as no read down. This prevents trusted subjects from being contaminated by less trustworthy data.
Why the other options are wrong
- A. No write down is the Bell-LaPadula star property for confidentiality, not a Biba rule.
- C. No read up is the Bell-LaPadula simple security property, not the Biba simple integrity axiom.
- D. No write up is the Biba star integrity axiom, not the simple integrity axiom.
Question 139
Which of the following protocol was used by the INITIAL version of the Terminal Access Controller Access Control System TACACS for communication between clients and servers?
Show answer and explanation
Correct answer: C. UDP
The original TACACS (Terminal Access Controller Access Control System) used UDP for communication between clients and servers. Modern TACACS+ (the enhanced version) uses TCP port 49 instead, which provides better reliability and security. The question specifically asks about the initial version, which employed UDP similar to early RADIUS.
Why the other options are wrong
- A. TCP was not used in the initial TACACS protocol; TACACS+ later switched to TCP
- B. SSL is an encryption/security protocol not related to TACACS transport
- D. SSH is a modern secure shell protocol not available during TACACS initial design
Question 140
Why do buffer overflows happen? What is the main cause?
Show answer and explanation
Correct answer: B. Because of improper parameter checking within the application
Buffer overflows occur fundamentally because applications fail to properly validate and check input parameters before writing data into fixed-size buffers. Without adequate bounds checking and input validation, an attacker can write more data than the buffer can hold, overwriting adjacent memory. This is the root cause; while buffers do have size limits (option A), the actual cause of the vulnerability is the lack of defensive programming practices.
Why the other options are wrong
- A. While true that buffers have capacity limits, this is a characteristic of buffers, not the cause of overflow vulnerabilities.
- C. Ease of exploitation is a consequence of buffer overflows, not their cause.
- D. Buffer overflows occur regardless of total system memory availability; the issue is local buffer size management, not system resources.
Question 141
Which of the following is not a logical control when implementing logical access security?
Show answer and explanation
Correct answer: C. employee badges.
Logical controls are implemented in software and systems to restrict access to data and resources. Employee badges are a physical control, a tangible security mechanism used at facility entry points. Access profiles, userids, and passwords are all logical controls implemented through software systems to manage who can access what resources and when. Logical access security operates at the system and application level, not the physical facility level.
Why the other options are wrong
- A. Access profiles are logical controls that define what resources a user can access.
- B. Userids are logical controls that identify and authenticate users in systems.
- D. Passwords are logical controls that verify identity and grant access to systems.
Question 142
Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?
Show answer and explanation
Correct answer: B. Single Sign-On (SSO)
Single Sign-On (SSO) directly provides all the listed advantages: users can employ stronger passwords since they only need to remember one, administration is simplified with a single credential system, and users experience faster access to resources across the environment without repeated logins. Smart cards are a credential storage mechanism, symmetric ciphers address encryption, and PKI addresses public key infrastructure, none provide these specific authentication workflow benefits.
Why the other options are wrong
- A. Smart cards are credential storage devices but don't inherently provide SSO capabilities or password management advantages.
- C. Symmetric ciphers are encryption algorithms unrelated to authentication or password administration benefits.
- D. PKI provides key infrastructure but doesn't directly enable stronger passwords, easier administration, or unified credentials across systems.
Question 143
Which of the following is true of two-factor authentication?
Show answer and explanation
Correct answer: D. It relies on two independent proofs of identity.
Two-factor authentication requires two independent proofs of identity, typically from different authentication categories (something you know, something you have, or something you are). This combination significantly increases security by requiring an attacker to compromise multiple authentication mechanisms.
Why the other options are wrong
- A. RSA public-key signatures are a single factor (something you know/have) and do not define two-factor authentication.
- B. Two-factor authentication does not require hand geometry measurements; it uses various combinations like password plus token or biometric plus PIN.
- C. Two-factor authentication does not inherently preclude single sign-on; they are independent concepts and can coexist.
Question 144
What is the difference between Access Control Lists (ACLs) and Capability Tables?
Show answer and explanation
Correct answer: B. Access control lists are related/attached to an object whereas capability tables are related/attached to a subject.
Access Control Lists (ACLs) are attached to objects and list which subjects can access them, while Capability Tables are attached to subjects and list which objects they can access. They are inverse representations of the same access control matrix: ACLs organize by object, capability tables organize by subject.
Why the other options are wrong
- A. This reverses the correct relationship between ACLs and capability tables.
- C. Both are used for both subjects and objects; they are just organized differently.
- D. While conceptually related as matrix views, they have distinct organizational approaches and attachment points.
Question 145
Which of the following access control models is based on sensitivity labels?
Show answer and explanation
Correct answer: B. Mandatory access control
Mandatory Access Control (MAC) is based on sensitivity labels assigned to both subjects and objects. These labels (such as classification levels) determine access decisions based on security policy rules, not user discretion. The system enforces access based on comparing label hierarchies.
Why the other options are wrong
- A. DAC is based on the discretion of the object owner, not sensitivity labels.
- C. Rule-based access control is a policy-driven model but is not fundamentally based on sensitivity labels.
- D. RBAC is based on user roles and responsibilities, not sensitivity labels.
Question 146
What is it called when a computer uses more than one CPU in parallel to execute instructions?
Show answer and explanation
Correct answer: A. Multiprocessing
Multiprocessing is the use of multiple CPUs (processors) in parallel to execute instructions simultaneously. This is distinct from multitasking (single CPU switching between tasks), multithreading (multiple threads within a process), and parallel running (informal term). Multiprocessing specifically refers to the hardware-level use of multiple physical processors executing in true parallel.
Why the other options are wrong
- B. Multitasking involves a single CPU rapidly switching between multiple tasks.
- C. Multithreading refers to multiple threads within a single process, not multiple CPUs.
- D. Parallel running is not a standard technical term for multi-CPU execution.
Question 147
To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up:
Show answer and explanation
Correct answer: B. Access Matrix
An Access Matrix is the fundamental mechanism used to control access by subjects (active entities like users or processes) to objects (passive entities like files or resources). The access matrix specifies which subjects have what permissions on which objects, forming the basis for implementing access control decisions.
Why the other options are wrong
- A. Access Rules describe how access decisions are made, but do not establish the actual mapping of subjects to objects and permissions.
- C. Identification controls verify who a user is, but do not control what resources they can access.
- D. An access terminal is a physical device for user interaction, not a mechanism for controlling subject-to-object access.
Question 148
Which of the following choice is NOT normally part of the questions that would be asked in regards to an organization's information security policy?
Show answer and explanation
Correct answer: C. What are the actions that need to be performed in case of a disaster?
Questions regarding actions to be performed in case of disaster relate to incident response and business continuity planning, not information security policy establishment. Security policy questions typically focus on policy development, definition, ownership, governance, and compliance monitoring. Disaster response procedures are separate from foundational security policy questions, though they may be referenced within a broader security framework.
Why the other options are wrong
- A. Who is involved in establishing security policy is a fundamental policy question.
- B. Where the security policy is defined is a critical organizational question.
- D. Who monitors compliance is a core governance and accountability question.
Question 149
Which of the following rules is least likely to support the concept of least privilege?
Show answer and explanation
Correct answer: D. Only data to and from critical systems and applications should be allowed through the firewall.
Least privilege is about granting each subject only the specific rights needed to perform a task, and a firewall rule set that simply permits all traffic to and from critical systems and applications is far broader than that: it authorizes entire hosts and application flows rather than the minimum required services, ports, and directions of traffic. It also inverts the priority, since the traffic to the most sensitive systems is exactly what should be most tightly filtered. The other statements each directly reduce the number or scope of privileges held by users and processes.
Why the other options are wrong
- A. Minimizing the number of administrative accounts directly limits how many subjects hold elevated privileges, which is a core least-privilege practice.
- B. Having administrators perform routine work such as reading mail from ordinary accounts keeps privileged credentials out of everyday tasks, a textbook application of least privilege.
- C. Tightly restricting permissions on tools attackers could exploit limits the capabilities available to any given account, supporting least privilege.
Question 150
Which of the following classes is defined in the TCSEC (Orange Book) as discretionary protection?
Show answer and explanation
Correct answer: A. C
Class C in the TCSEC (Orange Book) is defined as the discretionary protection level. It requires discretionary access control (DAC) mechanisms and is the first formal class in the rating system, sitting above Division D (minimal protection).
Why the other options are wrong
- B. Class B defines mandatory protection requirements, not discretionary protection.
- C. Class A is the highest assurance class with verified design, not a discretionary protection class.
- D. Division D is minimal protection and does not provide discretionary access control requirements.
Question 151
What is the PRIMARY use of a password?
Show answer and explanation
Correct answer: C. Authenticate the user.
The primary use of a password is to authenticate the user, to verify that the person claiming to be a specific user actually is that person. Authentication is the verification of identity. While passwords can facilitate file access and user segregation as secondary effects, their fundamental security purpose is authentication. Identification (option B) is the process of claiming an identity, whereas authentication is proving that claim.
Why the other options are wrong
- A. Allowing access to files is a consequence of authentication, not the primary purpose of the password itself.
- B. Identification is the process of claiming who you are; authentication is proving the claim, making authentication primary.
- D. Segregating user accesses is a policy implementation that follows authentication, not its primary purpose.
Question 152
Which of the following protection devices is used for spot protection within a few inches of the object, rather than for overall room security monitoring?
Show answer and explanation
Correct answer: B. Capacitance detectors
Capacitance detectors are proximity detectors designed for spot protection within a few inches of a protected object, making them ideal for protecting individual items like safes, artwork, or sensitive equipment. They detect changes in the capacitance field around the object and trigger alarms when someone approaches within the protected zone, rather than monitoring an entire room.
Why the other options are wrong
- A. Wave pattern motion detectors are designed for area protection and monitor larger spaces, not individual objects.
- C. Field-powered devices are a broad category and not specifically designed for spot protection of objects.
- D. Audio detectors monitor sound levels and are used for area monitoring, not spot protection of individual items.
Question 153
Which of the following is NOT a fundamental component of an alarm in an intrusion detection system?
Show answer and explanation
Correct answer: D. Response
The fundamental components of an IDS alarm system are the sensor (detects events), communications (transmits alert), and enunciator (announces/displays the alarm). Response is an action taken after an alarm is generated, but it is not a fundamental component of the alarm mechanism itself. Response is a separate process that follows alarm generation.
Why the other options are wrong
- A. Communications is fundamental for transmitting alarm signals from sensor to monitoring systems.
- B. Enunciator is fundamental as it announces or displays the alarm to operators.
- C. Sensor is fundamental as it detects the security event that triggers the alarm.
Question 154
Which of the following is the most important consideration in locating an alternate computing facility during the development of a disaster recovery plan?
Show answer and explanation
Correct answer: A. It is unlikely to be affected by the same disaster.
The most critical consideration when selecting an alternate computing facility is that it must not be vulnerable to the same disaster that affects the primary site. If both facilities are in the same geographic or infrastructure zone, a single disaster could disable both, defeating the purpose of disaster recovery entirely. While proximity for operational speed and user access is important, these are secondary to ensuring the backup site is actually protected from the same risks.
Why the other options are wrong
- B. Operational speed is important but secondary to ensuring the facility is protected from the same disaster.
- C. User proximity is a convenience factor but less critical than protection from the same disaster.
- D. Airport and hotel proximity are logistical conveniences, not primary disaster recovery considerations.
Question 155
What would BEST define a covert channel?
Show answer and explanation
Correct answer: C. A communication channel that allows transfer of information in a manner that violates the system's security policy.
A covert channel is a communication channel that allows the transfer of information in a manner that violates the system's security policy. It exploits legitimate system mechanisms to transmit information through an unauthorized path, circumventing normal security controls. Covert channels can be timing-based, storage-based, or exploit other system characteristics to leak information in ways that were not intended by system designers.
Why the other options are wrong
- A. While backdoors are security risks, they are intentionally created code paths, not covert channels.
- B. Open ports that should be closed are configuration errors, not covert channels.
- D. Trojan horses are malicious code, not specifically covert channels.
Question 156
An effective information security policy should not have which of the following characteristic?
Show answer and explanation
Correct answer: B. Be designed with a short- to mid-term focus
An effective information security policy should have a long-term strategic focus, not merely a short- to mid-term focus. Security policies define foundational principles, governance structures, and compliance requirements that must endure over time. A short-term focus would result in reactive, inconsistent security posture. Effective policies include separation of duties, stakeholder understanding and support, and clear responsibility and authority definitions.
Why the other options are wrong
- A. Separation of duties is a key characteristic of effective security policies.
- C. Understandability and stakeholder support are essential for policy effectiveness.
- D. Specifying responsibility and authority is a fundamental policy requirement.
Question 157
Which of the following is responsible for MOST of the security issues?
Show answer and explanation
Correct answer: C. Personnel
Personnel are responsible for the majority of security breaches and issues through negligence, social engineering, misuse of access, policy violations, and human error. This is well-established in security literature and statistics. Outside espionage (A) represents a small percentage of incidents. Hackers (B) are external threats but cause fewer total incidents than insider threats. Equipment failure (D) is operational risk, not primarily a security issue.
Why the other options are wrong
- A. Outside espionage is uncommon compared to insider threats and human error.
- B. Hackers represent external threats but are responsible for far fewer incidents than personnel.
- D. Equipment failure is an availability concern, not a primary security threat vector.
Question 158
Which of the following choices describe a Challenge-response tokens generation?
Show answer and explanation
Correct answer: A. A workstation or system that generates a random challenge string that the user enters into the token when prompted along with the proper PIN.
Challenge-response tokens operate by having the system generate a random challenge that the user inputs into their token along with their PIN. The token then cryptographically processes this challenge to produce a response, which the user submits back to the system for verification. This proves possession of the correct token and knowledge of the correct PIN.
Why the other options are wrong
- B. The system generates a random challenge, not a login ID; login IDs are static identifiers, not random values.
- C. While tokens are hardware devices, this describes what they are, not how challenge-response generation works.
- D. The authentication mechanism must determine whether the owner should be authenticated based on the token's response.
Question 159
What would be considered the biggest drawback of Host-based Intrusion Detection systems (HIDS)?
Show answer and explanation
Correct answer: A. It can be very invasive to the host operating system
The primary drawback of host-based IDS is that it must run with elevated privileges and deeply integrate with the operating system to monitor all activities, potentially destabilizing the system, consuming excessive resources, and creating security vulnerabilities through its own presence and necessary permissions.
Why the other options are wrong
- B. Monitoring only the host system is not a drawback but rather the intended function of HIDS.
- C. Eliminating encryption limits is actually an advantage of HIDS, not a drawback, as it can inspect decrypted data at the host level.
- D. Increased visibility and control compared to NIDS is an advantage of HIDS, not a drawback.
Question 160
Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental hardware/ software units. Such controls, also known as logical controls, represent which pairing?
Show answer and explanation
Correct answer: B. Preventive/Technical Pairing
Technical controls using encryption, access control lists, and similar mechanisms built into operating systems, applications, or hardware/software units are logical controls designed to prevent unauthorized access and violations. They represent the preventive/technical pairing that stops security incidents through technological means.
Why the other options are wrong
- A. Administrative controls involve policies and procedures, not encryption and technical access controls.
- C. Physical controls involve doors, locks, and environmental protections, not encryption.
- D. Detective controls reveal violations after they occur, whereas encryption and access controls actively prevent them.
Question 161
Which of the following statements pertaining to software testing approaches is correct?
Show answer and explanation
Correct answer: C. The test plan and results should be retained as part of the system's permanent documentation.
Option C is correct because test plans and test results should be retained as permanent documentation of the system, providing an audit trail and reference for future maintenance and support. Option A is backwards, bottom-up testing detects interface errors later, not earlier. Option B about top-down approach is closer to correct but less universally applicable than C. Option D is incorrect because black box testing does not examine procedural detail; it treats the system as a black box and tests only inputs and outputs, not internal implementation.
Why the other options are wrong
- A. This is backwards; bottom-up testing detects interface errors later in the process, not earlier.
- B. While top-down can detect critical module errors earlier, this is less universally correct than C.
- D. Black box testing is not predicated on examining procedural detail; it ignores internal implementation and focuses on behavior.
Question 162
Several analysis methods can be employed by an IDS, each with its own strengths and weaknesses, and their applicability to any given situation should be carefully considered. There are two basic IDS analysis methods that exists. Which of the basic method is more prone to false positive?
Show answer and explanation
Correct answer: B. Anomaly Detection
Anomaly Detection is more prone to false positives because it relies on establishing baselines of normal behavior and flagging deviations. Legitimate but unusual activities can trigger alerts, especially in dynamic environments where normal behavior varies significantly.
Why the other options are wrong
- A. Pattern Matching (signature analysis) is more precise with known attacks and generates fewer false positives, though it misses unknown attacks.
- C. Host-based intrusion detection is a deployment method, not an analysis method; it can use either approach.
- D. Network-based intrusion detection is a deployment method, not an analysis method; false positives depend on the underlying detection technique used.
Question 163
Single Sign-on (SSO) is characterized by which of the following advantages?
Show answer and explanation
Correct answer: B. Convenience and centralized administration
Single Sign-On provides two primary advantages: convenience for users (one login for multiple systems) and centralized administration (managing credentials and access policies from one location). While data and network administration may benefit secondarily, the core advantages are user convenience and centralized administrative control of authentication.
Why the other options are wrong
- A. Incomplete; SSO offers benefits beyond just user convenience.
- C. Centralized data administration is not a primary characteristic of SSO.
- D. Centralized network administration is not a primary characteristic of SSO.
Question 164
In non-discretionary access control using Role Based Access Control (RBAC), a central authority determines what subjects can have access to certain objects based on the organizational security policy. The access controls may be based on:
Show answer and explanation
Correct answer: B. The individual's role in the organization
RBAC determines access based on the individual's role or position within the organization. Access rights are assigned to roles rather than individual users, and individuals receive permissions based on the roles they occupy. This is the core principle that makes RBAC effective in organizations.
Why the other options are wrong
- A. RBAC is based on individual roles, not societal roles.
- C. RBAC is specifically based on the individual's organizational role, not group dynamics.
- D. Group dynamics and master-slave relationships are not relevant to RBAC principles.
Question 165
Which of the following is NOT a type of motion detector?
Show answer and explanation
Correct answer: A. Photoelectric sensor
A photoelectric sensor is NOT a type of motion detector. Photoelectric sensors detect the presence or absence of an object by emitting light and measuring reflections; they detect object presence, not motion. The other options are all active motion detection technologies that sense movement through infrared radiation, microwave signals, or ultrasonic waves.
Why the other options are wrong
- B. Passive infrared sensors detect motion by sensing changes in heat radiation emitted by moving objects.
- C. Microwave sensors detect motion by emitting microwave signals and analyzing reflections for movement patterns.
- D. Ultrasonic sensors detect motion by emitting ultrasonic waves and analyzing Doppler shifts caused by moving objects.
Question 166
Network-based Intrusion Detection systems:
Show answer and explanation
Correct answer: A. Commonly reside on a discrete network segment and monitor the traffic on that network segment.
Network-based IDS systems are typically deployed on a discrete network segment (often on a span port or tap) where they can passively monitor all traffic flowing through that segment. This strategic placement allows them to observe network communications without being inline with the traffic. Option B contradicts the placement requirement, C claims they don't monitor traffic (contradicting their function), and D confuses network-based IDS with host-based IDS.
Why the other options are wrong
- B. Network-based IDS must reside on a discrete segment to effectively monitor that segment's traffic.
- C. Network-based IDS specifically monitors the traffic on their network segment; that is their primary function.
- D. This describes Host-based IDS, not Network-based IDS.
Question 167
Which of the following is used to interrupt the opportunity to use or perform collusion to subvert operation for fraudulent purposes?
Show answer and explanation
Correct answer: B. Rotation of duties
Rotation of duties interrupts the opportunity for collusion and fraud by ensuring no single individual has control over a complete fraudulent transaction or process for an extended period. By rotating who performs critical functions, it becomes more difficult for employees to collude together to subvert operations for fraudulent purposes.
Why the other options are wrong
- A. Key escrow involves holding encryption keys with a trusted third party and does not directly prevent collusion for fraud.
- C. Need-to-know limits access but does not specifically interrupt the opportunity for collusion between multiple parties.
- D. Least privilege limits individual permissions but does not prevent two or more individuals from colluding to commit fraud.
Question 168
Which of the following is best defined as a circumstance in which a collection of information items is required to be classified at a higher security level than any of the individual items that comprise it?
Show answer and explanation
Correct answer: A. Aggregation
Aggregation occurs when a collection of information items, each individually classified at a lower security level, must be classified at a higher level when considered together. This is because the combination of seemingly innocuous pieces of information can reveal more sensitive details than any individual item, creating a higher overall classification requirement.
Why the other options are wrong
- B. Inference is the ability to deduce additional information from available data, which is related but not the specific definition of aggregation.
- C. Clustering is a data organization technique unrelated to security classification levels.
- D. Collision refers to different inputs producing the same output in cryptographic functions, not to classification of combined information items.
Question 169
In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-object interactions take place?
Show answer and explanation
Correct answer: A. Bell-LaPadula model
The Bell-LaPadula model is specifically designed for confidentiality protection by comparing a subject's clearance level to an object's classification level and enforcing rules (like the simple security property and the star property) to control how interactions occur between different classification levels.
Why the other options are wrong
- B. The Biba model focuses on integrity by preventing unauthorized modification, not on comparing clearance to classification.
- C. The Access Matrix model represents permissions directly without the concept of clearance levels and classification comparisons.
- D. The Take-Grant model focuses on the transfer of rights between subjects and objects, not clearance-to-classification comparisons.
Question 170
Which of the following is considered the weakest link in a security system?
Show answer and explanation
Correct answer: A. People
People are widely recognized as the weakest link in security systems because human behavior, error, and social engineering are difficult to control technically. Even robust software, hardware, and communication systems can be compromised through user negligence, password sharing, social engineering, or failure to follow security procedures. Technical controls can be perfected, but human factors remain unpredictable.
Why the other options are wrong
- B. Software can be patched, updated, and hardened against vulnerabilities
- C. Communications security can be strengthened through encryption and protocols
- D. Hardware security can be physically controlled and monitored
Question 171
Which TCSEC level is labeled Controlled Access Protection?
Show answer and explanation
Correct answer: B. C2
C2 is the TCSEC level labeled Controlled Access Protection. It includes discretionary access controls, accountability mechanisms, and audit capabilities. C1 is Discretionary Security Protection, B1 is Labeled Security Protection, and C3 is not a standard TCSEC level designation (the scale runs C1, C2, B1, B2, B3, A1).
Why the other options are wrong
- A. C1 is labeled Discretionary Security Protection, not Controlled Access Protection.
- C. C3 is not a valid TCSEC classification level.
- D. B1 is labeled Labeled Security Protection, not Controlled Access Protection.
Question 172
In biometrics, "one-to-many" search against database of stored biometric images is done in:
Show answer and explanation
Correct answer: B. Identification
Identification uses a one-to-many search where a biometric sample is compared against a database of stored biometric templates to determine who the person is. The system searches through multiple records to find a match, rather than verifying a claimed identity.
Why the other options are wrong
- A. Authentication is one-to-one verification of a claimed identity, not one-to-many searching.
- C. Identities is not a biometric process or term in this context.
- D. Identity-based access control determines what an authenticated user can access, not the search process itself.
Question 173
Which of the following is BEST defined as a physical control?
Show answer and explanation
Correct answer: B. Fencing
Fencing is a tangible, physical barrier that restricts unauthorized access to facilities and assets. It is a concrete control measure you can touch and see. Monitoring (A) is a logical control involving system analysis. Identification and authentication (C) are logical controls involving credentials. Logical access control mechanisms (D) are by definition logical, not physical controls.
Why the other options are wrong
- A. Monitoring of system activity is a logical control, not physical.
- C. Identification and authentication are logical controls implemented through software and systems.
- D. Logical access control mechanisms are explicitly logical controls, not physical.
Question 174
There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI). When we compare them side by side, Kerberos tickets correspond most closely to which of the following?
Show answer and explanation
Correct answer: C. public-key certificates
Kerberos tickets correspond most closely to public-key certificates in PKI. Both are issued by a trusted authority (Kerberos server or Certificate Authority), contain identifying information about the subject, are digitally signed by the issuing authority, and are presented to third parties to prove the holder's identity and authorization.
Why the other options are wrong
- A. Public keys are not issued by a central authority in the same way and are not comparable to tickets in function.
- B. Private keys are secret and kept by the user; they are not presented to third parties like tickets are.
- D. Private-key certificates are not a standard PKI concept; the equivalent in PKI is public-key certificates, not private-key certificates.
Question 175
When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?
Show answer and explanation
Correct answer: A. Dual Control
Dual control (also called two-person rule) requires two or more authorized individuals to combine their knowledge, credentials, or actions to access sensitive systems or information. This prevents any single person from gaining unauthorized access and provides accountability through shared responsibility.
Why the other options are wrong
- B. Need to know restricts access based on job requirements but does not require multiple persons to combine knowledge.
- C. Separation of duties divides responsibilities across multiple people to prevent fraud but does not specifically require concurrent combined knowledge for access.
- D. Segregation of duties is a synonym for separation of duties and has the same distinction as option C.
Question 176
Examples of types of physical access controls include all EXCEPT which of the following?
Show answer and explanation
Correct answer: D. passwords
Physical access controls are tangible, physical mechanisms that restrict or monitor entry to locations or assets. Badges, locks, and guards are all physical controls that operate in the real world. Passwords are logical/technical controls that exist in software and systems, not physical controls. They authenticate users to computer systems rather than controlling physical access to buildings or areas.
Why the other options are wrong
- A. Badges are physical credentials used to grant or deny entry to secured areas.
- B. Locks are fundamental physical barriers that prevent unauthorized access.
- C. Guards are human personnel who monitor and control physical access to locations.
Question 177
Which of the following is related to physical security and is not considered a technical control?
Show answer and explanation
Correct answer: D. Locks
Locks are physical security devices that prevent unauthorized access to facilities or equipment without relying on technology or computer systems. In contrast, access control mechanisms, intrusion detection systems, and firewalls are all technical controls that depend on software or electronic systems.
Why the other options are wrong
- A. Access control mechanisms are technical controls implemented through computer systems.
- B. Intrusion Detection Systems are software-based technical controls that monitor networks and systems.
- C. Firewalls are technical network security controls that filter traffic electronically.
Question 178
Which of the following pairings uses technology to enforce access control policies?
Show answer and explanation
Correct answer: B. Preventive/Technical
Access control policies are enforced through technical controls, technological mechanisms such as firewalls, encryption, access control lists, and authentication systems. Preventive controls stop violations before they occur, while technical controls use technology to implement those preventive measures. Administrative and physical controls involve procedures and physical barriers respectively, not technology enforcement.
Why the other options are wrong
- A. Administrative controls are policy-based procedures, not technology-based enforcement mechanisms.
- C. Physical controls use barriers and locks, not technology, to restrict access.
- D. Detective controls identify violations after they occur, rather than preventing them; they also may or may not involve technology.
Question 179
Within the realm of IT security, which of the following combinations best defines risk?
Show answer and explanation
Correct answer: B. Threat coupled with a vulnerability
Risk is best defined as the combination of threat and vulnerability. A threat is a potential source of harm, and a vulnerability is a weakness that can be exploited. Risk exists when a threat can exploit a vulnerability; without both elements, risk is not present.
Why the other options are wrong
- A. A breach is an actual incident, not a component of risk definition; risk is about potential, not realized events.
- C. An attack is a realized action, not a definition component; risk involves potential threats and vulnerabilities.
- D. A breach of security is an incident outcome, not part of the foundational definition of risk itself.
Question 180
What is the act of obtaining information of a higher sensitivity by combining information from lower levels of sensitivity?
Show answer and explanation
Correct answer: C. Aggregation
Aggregation is the security threat where information of higher sensitivity is derived by combining lower-sensitivity data elements. For example, individually innocuous pieces of information combined together reveal sensitive patterns. This is distinct from inference (deriving facts from other facts), polyinstantiation (storing multiple versions), and data mining (analyzing large datasets for patterns).
Why the other options are wrong
- A. Polyinstantiation is a database security technique for storing multiple versions of data at different classification levels.
- B. Inference is the ability to deduce sensitive information from non-sensitive data through logical deduction, not through combination.
- D. Data mining is a technique for extracting patterns from large datasets, not specifically about combining lower sensitivity data.
Question 181
Which of the following classes is the first level (lower) defined in the TCSEC (Orange Book) as mandatory protection?
Show answer and explanation
Correct answer: A. B
In the TCSEC (Orange Book) rating system, Class B is the lowest class that defines mandatory protection requirements. The hierarchy goes from Division D (minimal) at the bottom, then Class C (discretionary), then Class B (mandatory), with Class A at the top representing verified design.
Why the other options are wrong
- B. Class A is the highest assurance class in TCSEC, not the first level of mandatory protection.
- C. Class C is the discretionary protection level, which comes before mandatory protection in the TCSEC hierarchy.
- D. Division D is the minimal protection level and does not include mandatory protection requirements.
Question 182
Which of the following choices describe a condition when RAM and Secondary storage are used together?
Show answer and explanation
Correct answer: C. Virtual storage
Virtual storage (also called virtual memory) is the technique of using both RAM (primary/main storage) and secondary storage (disk) together transparently. The operating system pages data between fast RAM and slower disk storage, creating the illusion of a larger address space than physical RAM alone provides. This extends available memory beyond physical constraints.
Why the other options are wrong
- A. Primary storage refers specifically to RAM only.
- B. Secondary storage refers specifically to disk storage only.
- D. Real storage is another term for physical RAM, not a combination of RAM and disk.
Question 183
What is the essential difference between a self-audit and an independent audit?
Show answer and explanation
Correct answer: C. Objectivity
The essential difference between a self-audit and an independent audit is objectivity. A self-audit is conducted by internal personnel assessing their own work, creating inherent bias and conflicts of interest. An independent audit is performed by external parties without vested interests, allowing for objective, unbiased evaluation. This objectivity is the critical distinction that determines the credibility and reliability of audit findings.
Why the other options are wrong
- A. Both self-audits and independent audits may use similar tools; tools are not the essential difference.
- B. Both audit types aim to produce reliable results; the difference is in independence, not inherent result quality.
- D. Both can be conducted by competent professionals; competence exists independently of audit independence.
Question 184
Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?
Show answer and explanation
Correct answer: C. Regression testing
Regression testing is specifically defined as rerunning test scenarios or test plans after modifications or corrections to ensure that changes have not introduced new errors. This is a critical quality assurance practice that validates the stability of a system after updates. Unit testing focuses on individual modules, pilot testing introduces systems to limited users, and parallel testing runs old and new systems simultaneously, none of these definitions match regression testing.
Why the other options are wrong
- A. Unit testing focuses on testing individual modules or components in isolation.
- B. Pilot testing involves introducing a system to a limited user group before full rollout.
- D. Parallel testing runs the old and new systems concurrently to compare results.
Question 185
Which of the following should NOT be performed by an operator?
Show answer and explanation
Correct answer: C. Data entry
Under separation of duties, computer operators should not perform data entry, which is the job of data entry or user personnel. Operators are responsible for running the system: performing the initial program load, monitoring execution and controlling job flow.
Why the other options are wrong
- A. Performing the initial program load is a standard operator responsibility.
- B. Monitoring execution of the system is a core operator task.
- D. Controlling job flow and scheduling is a normal operator function.
Question 186
Which of the following is used by RADIUS for communication between clients and servers?
Show answer and explanation
Correct answer: C. UDP
RADIUS (Remote Authentication Dial-In User Service) uses UDP (User Datagram Protocol) for communication between clients and servers, specifically UDP ports 1812 and 1813. UDP was chosen for RADIUS because it offers lower overhead than TCP and is suitable for the lightweight authentication protocol, though this creates some security considerations that led to later protocols like DIAMETER.
Why the other options are wrong
- A. TCP is connection-oriented and not used by RADIUS for its client-server communication
- B. SSL is an encryption protocol, not a transport protocol used by RADIUS
- D. SSH is a secure shell protocol unrelated to RADIUS authentication mechanisms
Question 187
Which access control model would a lattice-based access control model be an example of?
Show answer and explanation
Correct answer: A. Mandatory access control.
A lattice-based access control model is an example of Mandatory Access Control (MAC). Lattice-based models use a mathematical lattice structure to define security levels and their relationships, enforcing non-discretionary access rules based on comparing subject clearances and object classifications. This is a specific implementation technique for MAC systems.
Why the other options are wrong
- B. Discretionary access control allows owners to set permissions; lattice models enforce system-wide mandatory rules.
- C. Non-discretionary access control is not a standard taxonomy term; the correct term is Mandatory Access Control.
- D. Rule-based access control is not the primary category; lattice models are specifically a form of MAC.
Question 188
In addition to the Legal Department, with what company function must the collection of physical evidence be coordinated if an employee is suspected?
Show answer and explanation
Correct answer: A. Human Resources
When collecting physical evidence related to an employee, coordination with Human Resources is essential because HR handles employee relations, potential disciplinary actions, and personnel matters that may arise from the investigation. This ensures proper notification, documentation, and handling of employment-related implications.
Why the other options are wrong
- B. Industrial Security may be involved in some cases but is not the primary function that must coordinate evidence collection in employee matters.
- C. Public Relations would typically be involved only after investigation conclusions, not during evidence collection itself.
- D. External Audit Group is not a standard function that coordinates physical evidence collection in employee investigations.
Question 189
Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system. It does not permit management to:
Show answer and explanation
Correct answer: C. specify how to restrain hackers
Access control mechanisms permit managers to specify what users can do, which resources they can access, and what operations they can perform, these are within the domain of access control policy definition. However, access control itself does not specify how to restrain hackers in a broader sense; that falls under intrusion prevention and incident response. Access control is about authorization and permissions, not about active defense against attacks.
Why the other options are wrong
- A. Specifying what users can do is a core function of access control.
- B. Specifying which resources users can access is a primary purpose of access control.
- D. Specifying what operations users can perform is a fundamental aspect of access control.
Question 190
Detective/Technical measures:
Show answer and explanation
Correct answer: A. include intrusion detection systems and automatically-generated violation reports from audit trail information.
Detective/technical measures include both intrusion detection systems (IDS), which identify unauthorized access attempts in real-time, and automatically-generated violation reports derived from audit trail information, which identify security incidents after they occur. Both are detective controls that work to identify breaches and policy violations.
Why the other options are wrong
- B. Both intrusion detection systems and audit-generated reports are core detective technical measures.
- C. Automatically-generated violation reports from audit trails are specifically included in detective measures.
- D. Reports are automatically generated from audit trails, not customized; the focus is on systematic violation detection.
Question 191
In regards to information classification what is the main responsibility of information (data) owner?
Show answer and explanation
Correct answer: A. determining the data sensitivity or classification level
The primary responsibility of a data owner is determining the sensitivity or classification level of the data they own. This foundational classification decision drives all subsequent security controls and handling procedures. While data owners may be involved in other activities, establishing classification levels is their main governance responsibility in information classification frameworks.
Why the other options are wrong
- B. Running regular backups is the responsibility of system administrators or IT operations, not data owners.
- C. Auditing data users is a detective control typically performed by security or compliance teams, not data owners.
- D. Periodically checking data validity and accuracy is an operational responsibility that may fall to data custodians or administrators, not the primary owner responsibility.
Question 192
Which of the following are additional access control objectives?
Show answer and explanation
Correct answer: B. Reliability and utility
Reliability and utility are the additional access control objectives beyond the primary goals of confidentiality, integrity, and availability. Reliability ensures that access controls function consistently and dependably, while utility ensures that the controls do not excessively hinder legitimate users from performing their required tasks. These objectives ensure that security measures are both effective and practical.
Why the other options are wrong
- A. Consistency is related to reliability but utility paired with consistency is not the correct framework for access control objectives.
- C. Usefulness and utility are similar concepts but 'usefulness' is not the standard security terminology for access control objectives.
- D. Convenience and utility prioritizes ease of access over security and is not the correct access control objective framework.
Question 193
Which security model ensures that actions that take place at a higher security level do not affect actions that take place at a lower level?
Show answer and explanation
Correct answer: C. The noninterference model
The noninterference model ensures that high-level actions do not interfere with or affect low-level actions, preventing information flow from high to low security levels. This model guarantees that the execution of operations at higher security levels remains invisible and has no observable effect on the behavior of lower-level operations.
Why the other options are wrong
- A. Bell-LaPadula protects confidentiality through classification levels but doesn't specifically address noninterference.
- B. The information flow model addresses data flow between levels but is not specifically named for preventing higher-level interference.
- D. Clark-Wilson focuses on integrity through controlled program access, not on noninterference between levels.
Question 194
Which of the following security modes of operation involves the highest risk?
Show answer and explanation
Correct answer: B. Multilevel Security Mode
Multilevel security mode carries the highest risk because the system processes data at several classification levels while not all users are cleared for all of it. Separation depends entirely on the system's access controls, so any flaw can expose data to uncleared users. Dedicated mode is the lowest risk because every user is cleared for everything.
Why the other options are wrong
- A. In compartmented mode all users hold clearance for the highest level, so the risk is lower than multilevel.
- C. In system-high mode all users are cleared for all data, even if they lack need to know for some of it, so risk is lower.
- D. Dedicated mode is the lowest-risk mode because every user has clearance, approval and need to know for all data.
Question 195
The preliminary steps to security planning include all of the following EXCEPT which of the following?
Show answer and explanation
Correct answer: C. Establish a security audit function.
Establishing a security audit function is not a preliminary step to security planning; it is an operational and ongoing function that typically comes after planning and policy establishment. The preliminary steps to security planning include establishing objectives, listing planning assumptions, and determining alternate courses of action. The audit function is implemented to monitor and validate the security program's effectiveness, making it a subsequent step rather than a preliminary one.
Why the other options are wrong
- A. Establishing objectives is a fundamental preliminary step that defines what security goals the organization aims to achieve.
- B. Listing planning assumptions is a critical preliminary step that identifies constraints, resources, and expectations underlying the security plan.
- D. Determining alternate courses of action is a preliminary step that ensures multiple security strategies are evaluated before implementation.
Question 196
Which of the following monitors network traffic in real time?
Show answer and explanation
Correct answer: A. network-based IDS
A network-based IDS monitors network traffic in real time at the network level, examining packets flowing across network segments and external connections. Host-based IDS monitors individual systems, application-based IDS monitors specific applications, and firewall-based systems filter traffic but do not perform intrusion detection.
Why the other options are wrong
- B. Host-based IDS monitors individual hosts' audit logs, not network traffic.
- C. Application-based IDS monitors application-level activity, not network traffic.
- D. Firewalls filter traffic but do not perform intrusion detection monitoring.
Question 197
Which of the following is commonly used for retrofitting multilevel security to a database management system?
Show answer and explanation
Correct answer: A. trusted front-end.
A trusted front-end is the standard retrofit approach for adding multilevel security to existing database management systems. It acts as an intermediary between users and the DBMS, enforcing security policies and filtering data based on clearance levels without requiring modifications to the underlying database engine itself.
Why the other options are wrong
- B. Trusted back-end would modify the database engine itself, which is more invasive and less commonly used for retrofitting.
- C. A controller is a generic term and not the specific architectural pattern for retrofitting multilevel security to DBMSs.
- D. A kernel is the core OS component; it's not a retrofit mechanism for database-level security controls.
Question 198
What is called the type of access control where there are pairs of elements that have the least upper bound of values and greatest lower bound of values?
Show answer and explanation
Correct answer: C. Lattice model
A lattice model is a mathematical structure in access control where elements have defined relationships with least upper bounds (join) and greatest lower bounds (meet). This creates a partial ordering that ensures secure information flow by establishing the highest and lowest classification levels between any two security elements, preventing unauthorized access through information flow violations.
Why the other options are wrong
- A. Mandatory access control uses fixed security labels and classifications, not the mathematical lattice structure of bounds.
- B. Discretionary access control allows owners to decide permissions, lacking the mathematical lattice hierarchy concept.
- D. Rule model is not a recognized access control paradigm with the lattice property definition.
Question 199
Crime Prevention Through Environmental Design (CPTED) is a discipline that:
Show answer and explanation
Correct answer: A. Outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior.
Crime Prevention Through Environmental Design is a discipline focused on reducing criminal activity through proper design of the physical environment. CPTED uses environmental design features, sightlines, access control, territorial definition, lighting, and layout, to influence human behavior and deter criminal activity. It is fundamentally about physical space design, not logical, detective, or administrative environments.
Why the other options are wrong
- B. CPTED addresses physical environments, not logical/IT environments.
- C. CPTED is about prevention through design, not detective controls.
- D. CPTED concerns physical design, not administrative control environments.
Question 200
Which of the following was developed by the National Computer Security Center (NCSC) for the US Department of Defense ?
Show answer and explanation
Correct answer: A. TCSEC
The TCSEC (Trusted Computer System Evaluation Criteria), also known as the Orange Book, was developed by the National Computer Security Center (NCSC) for the US Department of Defense to evaluate the security of computer systems.
Why the other options are wrong
- B. ITSEC (Information Technology Security Evaluation Criteria) was developed by European countries, not the US Department of Defense.
- C. DIACAP (DoD Information Assurance Certification and Accreditation Process) is a DoD process but was developed later and is not the original NCSC standard.
- D. NIACAP (National Information Assurance Certification and Accreditation Process) is a federal process but was not developed by the NCSC for the original DoD computer security evaluation.
Question 201
What is called an event or activity that has the potential to cause harm to the information systems or networks?
Show answer and explanation
Correct answer: D. Threat
A threat is defined as any event, activity, or agent that has the potential to cause harm to information systems or networks. It represents a possible source of danger that could exploit vulnerabilities and cause damage, loss, or compromise to assets. Threats are external forces or circumstances that could negatively impact security.
Why the other options are wrong
- A. A vulnerability is a weakness in a system that can be exploited, not an event or activity with potential to cause harm.
- B. A threat agent is a specific entity that carries out a threat, more specific than the general definition of threat itself.
- C. A weakness is a condition or characteristic that makes exploitation possible, not an event with potential to cause harm.
Question 202
How can an individual/person best be identified or authenticated to prevent local masquarading attacks?
Show answer and explanation
Correct answer: D. Biometrics
Biometrics authenticate the person by a physical characteristic that cannot be lent, shared or easily stolen. Passwords, PINs and smart cards identify something a person knows or holds, which another person can obtain and use to masquerade locally. Biometrics therefore best tie the login to the actual individual.
Why the other options are wrong
- A. A user ID and password can be observed, guessed or shared, so another person can easily masquerade.
- B. A smart card and PIN can be stolen or handed over together, so they do not prove who is physically present.
- C. Two-factor authentication using a token and a PIN still relies on things that can be transferred, rather than the person's own characteristics.
Question 203
Which of the following control pairing places emphasis on "soft" mechanisms that support the access control objectives?
Show answer and explanation
Correct answer: B. Preventive/Administrative Pairing
Administrative controls are 'soft' mechanisms involving people, policies, and procedures rather than technology. When paired with preventive objectives, they work to stop security violations before they occur through organizational measures like hiring practices, training, and procedural enforcement.
Why the other options are wrong
- A. Technical controls are hardware/software mechanisms, not 'soft' mechanisms.
- C. Physical controls involve concrete barriers and locks, not soft mechanisms.
- D. Detective controls identify violations after they occur, not prevent them in advance.
Question 204
Which of the following is the MOST important aspect relating to employee termination?
Show answer and explanation
Correct answer: C. User ID and passwords of the employee have been deleted.
The most critical security aspect of employee termination is deleting the user ID and passwords of the terminated employee. This immediately revokes access to all systems and data, preventing unauthorized access or misuse. While other aspects (property return, payroll removal, notification) are important operational concerns, revoking system access is the paramount security measure to protect company information.
Why the other options are wrong
- A. Payroll removal is an administrative matter, important but not the most critical security aspect.
- B. While property recovery is important, it is less critical than preventing system access.
- D. Notification is necessary but does not directly prevent unauthorized access as effectively as credential removal.
Question 205
Which of the following phases of a system development life-cycle is most concerned with establishing a good security policy as the foundation for design?
Show answer and explanation
Correct answer: C. Initiation
The Initiation phase is where foundational planning occurs, including establishing security policies, requirements, and organizational context that will guide all subsequent design and implementation decisions. This phase sets the security baseline before any acquisition or development work begins.
Why the other options are wrong
- A. Development/acquisition focuses on building or procuring systems according to established requirements, not establishing foundational policy.
- B. Implementation is about deploying the system, not establishing initial security policy foundations.
- D. Maintenance occurs after system deployment and focuses on ongoing operations, not establishing initial policies.
Question 206
What would be the name of a Logical or Virtual Table dynamically generated to restrict the information a user can access in a database?
Show answer and explanation
Correct answer: B. Database views
Database views are logical or virtual tables that are dynamically generated from base tables to present only the specific data a user is authorized to access. Views implement row-level and column-level security by restricting which records and fields each user can see in a database.
Why the other options are wrong
- A. Database Management System is software that manages databases overall, not a specific restriction mechanism.
- C. Database security is a broad category encompassing many controls, not the specific name for virtual tables.
- D. Database shadowing refers to maintaining duplicate databases for backup or failover, not access restriction.
Question 207
What can be defined as a list of subjects along with their access rights that are authorized to access a specific object?
Show answer and explanation
Correct answer: B. An access control list
An Access Control List (ACL) is a list attached to an object that specifies which subjects (users or groups) have what access rights to that specific object. ACLs answer the question: 'Who can access this resource and what can they do with it?'
Why the other options are wrong
- A. A capability table lists what objects a subject can access, the inverse of an ACL.
- C. An access control matrix is a two-dimensional representation of subjects and objects, broader than an ACL.
- D. A role-based matrix maps roles to permissions, not subjects to object access rights.
Question 208
A channel within a computer system or network that is designed for the authorized transfer of information is identified as a(n)?
Show answer and explanation
Correct answer: B. Overt channel
An overt channel is a legitimate communications channel within a computer system or network that is designed for and authorized for the transfer of information between subjects. Overt channels follow the security policy and are intended for normal, authorized communication.
Why the other options are wrong
- A. A covert channel is an unauthorized channel that can be exploited to violate security policy.
- C. Opened channel is not standard security terminology for authorized information transfer channels.
- D. Closed channel does not accurately describe an authorized channel designed for information transfer.
Question 209
Which of the following is a not a preventative control?
Show answer and explanation
Correct answer: C. Run a source comparison program between control and current source periodically.
Running a source comparison program between control and current source periodically is a detective control because it identifies differences after they have occurred. Preventative controls stop problems before they happen. This control detects unauthorized or incorrect changes after the fact rather than preventing them. The other options are preventative because they stop problems before they occur.
Why the other options are wrong
- A. Denying programmer access to production data is a preventative control that stops unauthorized access before it happens.
- B. Requiring change requests with detailed information is a preventative control that prevents uncontrolled changes through approval procedures.
- D. Establishing procedures for emergency changes is a preventative control that provides controlled processes to manage necessary changes safely.
Question 210
This baseline sets certain thresholds for specific errors or mistakes allowed and the amount of these occurrences that can take place before it is considered suspicious?
Show answer and explanation
Correct answer: C. Clipping level
Clipping level is the baseline threshold that defines the acceptable number or frequency of errors or security events before they are flagged as suspicious. Once violations exceed this clipping level, they are recorded and investigated, allowing organizations to distinguish normal activity from anomalous behavior.
Why the other options are wrong
- A. Checkpoint level is not standard terminology for audit thresholds in security frameworks.
- B. Ceiling level is not the standard term used for defining suspicious activity baselines.
- D. Threshold level is generic terminology, while clipping level is the specific security audit term for this concept.
Question 211
In addition to the accuracy of the biometric systems, there are other factors that must also be considered:
Show answer and explanation
Correct answer: C. These factors include the enrollment time, the throughput rate, and acceptability.
Beyond accuracy metrics (FAR, FRR, CER), biometric systems must be evaluated on multiple additional factors: enrollment time (how long it takes new users to register), throughput rate (how many users can be processed per unit time), and acceptability (user comfort, privacy concerns, and willingness to use the system). All three factors are essential for comprehensive biometric system evaluation.
Why the other options are wrong
- A. Acceptability is a critical evaluation factor and must be included.
- B. All three factors (enrollment time, throughput rate, and acceptability) are important considerations.
- D. Throughput rate and acceptability are both important factors that must be considered.
Question 212
Organizations should consider which of the following first before allowing external access to their LANs via the Internet?
Show answer and explanation
Correct answer: D. plan for considering proper authentication options.
Before allowing external access to internal networks via the Internet, organizations must first establish a security foundation by planning proper authentication options. This includes determining which authentication mechanisms will be used to verify the identity of remote users. Authentication is the prerequisite security measure that must be decided before implementing other controls like workstation locking, modem pool protection, or account monitoring, all of which depend on knowing who the user is.
Why the other options are wrong
- A. Workstation locking mechanisms are important but are secondary to establishing who the user is through authentication.
- B. Modem pool protection is a lower priority than determining how to authenticate external users.
- C. Account usage information is a monitoring feature that comes after establishing authentication mechanisms.
Question 213
Which of the following Kerberos components holds all users' and services' cryptographic keys?
Show answer and explanation
Correct answer: C. The Key Distribution Center
The Key Distribution Center (KDC) is the Kerberos component responsible for storing and managing all users' and services' cryptographic keys. The KDC contains two logical services: the Authentication Service (AS) which validates user identities, and the Ticket Granting Service (TGS) which issues service tickets. However, the overall KDC component is what holds the key repository.
Why the other options are wrong
- A. Key Distribution Service is not a standard Kerberos component name; the proper term is Key Distribution Center.
- B. The Authentication Service is part of the KDC but does not itself hold all keys; it uses the KDC's key store.
- D. Key Granting Service is not a standard Kerberos component; the correct term is Ticket Granting Service.
Question 214
What mechanism automatically causes an alarm originating in a data center to be transmitted over the local municipal fire or police alarm circuits for relaying to both the local police/fire station and the appropriate headquarters?
Show answer and explanation
Correct answer: D. An auxiliary station alarm
An auxiliary station alarm automatically transmits alarms to municipal fire or police alarm circuits, which then relay to local emergency stations and headquarters. This public utility integration distinguishes auxiliary alarms from other types. Central station alarms use private monitoring services, proprietary alarms remain on-site or within company systems, and remote station alarms report to a dedicated private facility rather than public emergency circuits.
Why the other options are wrong
- A. Central station alarms transmit to private monitoring companies, not public municipal circuits.
- B. Proprietary alarms are contained within the organization's own system without external transmission.
- C. Remote station alarms report to private facilities, not integrated into public emergency services.
Question 215
Which of the following best ensures accountability of users for the actions taken within a system or domain?
Show answer and explanation
Correct answer: B. Authentication
Authentication ensures accountability by verifying the identity of users, which creates an audit trail linking specific actions to identified individuals. Identification merely names the user but doesn't verify identity; authorization controls what users can access after authentication; credentials are the mechanisms used in authentication but don't themselves ensure accountability. Authentication is the critical control that establishes who performed actions in a system.
Why the other options are wrong
- A. Identification only names a user but does not verify their identity or establish accountability.
- C. Authorization determines what authenticated users can do, not who they are or that they are accountable.
- D. Credentials are tools used in authentication but do not themselves establish accountability for actions.
Question 216
Which of the following statements pertaining to Kerberos is false?
Show answer and explanation
Correct answer: C. Kerberos uses a database to keep a copy of all users' public keys.
The false statement is that Kerberos uses a database to keep a copy of all users' public keys. Kerberos does not use public key cryptography at all; it uses symmetric key cryptography. It maintains a database of shared secrets (passwords), not public keys. This statement conflates Kerberos with public key infrastructure concepts.
Why the other options are wrong
- A. The KDC being a single point of failure is true; this is a known limitation of Kerberos architecture.
- B. Kerberos manages access permissions is true; it provides authentication that enables subsequent authorization decisions.
- D. Kerberos uses symmetric key cryptography is true; this is the foundational encryption method in Kerberos.
Question 217
Which of the following access control models requires security clearance for subjects?
Show answer and explanation
Correct answer: D. Mandatory access control
Mandatory Access Control (MAC) is the access control model that requires security clearance for subjects. In MAC, access decisions are based on comparing security clearance levels of subjects with classification levels of objects, enforced by the system rather than by user discretion. This is a fundamental characteristic that distinguishes MAC from other models.
Why the other options are wrong
- A. Identity-based access control identifies subjects but does not require security clearance levels.
- B. Role-based access control assigns permissions based on roles, not security clearances.
- C. Discretionary access control allows owners to determine permissions without requiring formal security clearances.
Question 218
If your property Insurance has Replacement Cost Valuation (RCV) clause your damaged property will be compensated:
Show answer and explanation
Correct answer: B. Based on new, comparable, or identical item for old regardless of condition of lost item
Replacement Cost Valuation (RCV) compensates the insured with the cost to replace the damaged property with a new, comparable, or identical item, regardless of the condition or depreciation of the original item. This is the key distinction between RCV and ACV.
Why the other options are wrong
- A. Date-of-loss valuation is characteristic of ACV, not RCV.
- C. Insurance claims are evaluated at the date of loss, not arbitrary prior dates.
- D. eBay auction prices are not a standard or reliable insurance valuation basis.
Question 219
Qualitative loss resulting from the business interruption does NOT usually include:
Show answer and explanation
Correct answer: A. Loss of revenue
Qualitative losses from business interruption are intangible, non-monetary impacts. Loss of revenue is a quantitative measure expressed in monetary terms and directly tracked financially. Loss of competitive advantage, market share, public confidence, and market leadership are all qualitative impacts that cannot be precisely calculated but harm long-term viability.
Why the other options are wrong
- B. Loss of competitive advantage or market share is a qualitative consequence.
- C. Loss of public confidence and credibility is a classic qualitative business impact.
- D. Loss of market leadership is an intangible, qualitative consequence of disruption.
Question 220
Which of the following is not appropriate in addressing object reuse?
Show answer and explanation
Correct answer: B. Deleting files on disk before reusing the space.
Deleting files on disk before reusing the space is not appropriate for addressing object reuse because file deletion does not actually clear the underlying magnetic storage medium, data can still be recovered. Proper object reuse requires degaussing magnetic media, clearing memory blocks, and clearing buffered storage to ensure residual data cannot be accessed. Deleting a file entry does not sanitize the physical storage location.
Why the other options are wrong
- A. Degaussing magnetic tapes is an appropriate method to sanitize media for reuse.
- C. Clearing memory blocks before allocation is proper object reuse control.
- D. Clearing buffered data from terminal or printer memory is appropriate for object reuse.
Question 221
Pin, Password, Passphrases, Tokens, smart cards, and biometric devices are all items that can be used for Authentication. When one of these item listed above in conjunction with a second factor to validate authentication, it provides robust authentication of the individual by practicing which of the following?
Show answer and explanation
Correct answer: B. Two-factor authentication
When two different types of authentication factors are used in conjunction with each other, such as a password (something you know) plus a token (something you have), or a PIN plus a biometric scan, this practice is called two-factor authentication. Two-factor authentication significantly increases security by requiring an attacker to compromise two independent authentication methods. This combination of distinct factor types provides robust authentication of individual identity.
Why the other options are wrong
- A. Multi-party authentication refers to multiple parties or entities being involved in authentication, not multiple factors.
- C. Mandatory authentication refers to enforced authentication requirements, not the use of multiple authentication factors.
- D. Discretionary authentication is not a standard authentication terminology; authentication is typically mandatory, not discretionary.
Question 222
Which of the following computer recovery sites is the least expensive and the most difficult to test?
Show answer and explanation
Correct answer: D. cold site
A cold site is the least expensive recovery option because it requires minimal infrastructure investment, typically just a physical space with basic utilities. However, it is the most difficult to test because it lacks pre-installed equipment, data, and configurations, making realistic testing exercises time-consuming and impractical. In contrast, hot and warm sites have equipment ready and are easier to test, while hot sites are expensive, and mobile sites offer moderate cost with reasonable testing capability.
Why the other options are wrong
- A. Non-mobile hot sites are expensive to maintain and relatively easy to test regularly.
- B. Mobile hot sites are moderately expensive and easier to test than cold sites due to pre-positioned equipment.
- C. Warm sites have intermediate cost and reasonable testing feasibility compared to cold sites.
Question 223
Which one of the following statements about the advantages and disadvantages of network-based Intrusion detection systems is true
Show answer and explanation
Correct answer: D. The deployment of network-based IDSs has little impact upon an existing network.
Network-based IDS deployment has minimal impact on existing network infrastructure because sensors can be deployed passively on network segments using tap or mirror ports without requiring active participation in network traffic. Options A, B, and C are false: NIDS can be vulnerable to attacks, modern switched networks with port mirroring work well with NIDS, and NIDS cannot definitively determine attack success, they detect suspicious activity but cannot always confirm whether exploitation occurred.
Why the other options are wrong
- A. Network-based IDS systems are vulnerable to evasion and direct attacks on the IDS itself.
- B. Modern switch-based networks actually present challenges for NIDS deployment due to switched traffic segmentation.
- C. NIDS cannot automatically determine success; they detect suspicious activity but not the actual outcome of attacks.
Question 224
Which of the following best describes the purpose of debugging programs?
Show answer and explanation
Correct answer: B. To ensure that program coding flaws are detected and corrected.
Debugging programs is specifically designed to detect and correct coding flaws and errors in program logic. This is the fundamental purpose of debugging, to identify defects introduced during programming and fix them before the software is released or tested in higher environments. Debugging ensures code quality and reduces downstream issues.
Why the other options are wrong
- A. Debugging does not generate test data; test data generation is a separate testing activity.
- C. Source code control/version management protects changes from being overwritten, not debugging.
- D. Comparing source code versions is a configuration management activity, not debugging.
Question 225
Which type of control is concerned with restoring controls?
Show answer and explanation
Correct answer: B. Corrective controls
Corrective controls are designed to restore systems and operations to normal after a security incident or control failure has been detected. They remediate the damage and return the environment to its proper state. This distinguishes them from compensating controls (which replace failed controls), detective controls (which identify problems), and preventive controls (which stop problems before occurrence).
Why the other options are wrong
- A. Compensating controls provide alternative security measures, not restoration of systems.
- C. Detective controls identify problems but do not restore or fix them.
- D. Preventive controls stop problems from happening, rather than restoring after they occur.
Question 226
What is defined as the hardware, firmware and software elements of a trusted computing base that implement the reference monitor concept?
Show answer and explanation
Correct answer: C. A security kernel
A security kernel is defined as the combination of hardware, firmware, and software elements that implement the reference monitor concept. The security kernel enforces the security policy by controlling all access to protected resources and is the core trusted computing base component.
Why the other options are wrong
- A. The reference monitor is the abstract concept; the security kernel is the actual implementation of that concept.
- B. Protection rings are a layered security architecture mechanism but do not themselves implement the reference monitor concept.
- D. A protection domain is an abstraction of resources and operations, not the implementation mechanism of the reference monitor.
Question 227
Why should batch files and scripts be stored in a protected area?
Show answer and explanation
Correct answer: C. Because they may contain credentials.
Batch files and scripts should be stored in protected areas primarily because they may contain embedded credentials such as passwords, API keys, database connection strings, or other sensitive authentication information. If these files are accessible to unauthorized users, attackers could extract these credentials and use them to compromise systems. This is a critical security concern that justifies strict access controls on script storage.
Why the other options are wrong
- A. While least privilege is relevant to access controls generally, it's not the primary reason for protecting scripts.
- B. Scripts must be accessible to authorized operators and administrators, so this rationale is incorrect.
- D. Need-to-know is a valid access control principle but is secondary to the credential exposure risk.
Question 228
Which of the following is not a security goal for remote access?
Show answer and explanation
Correct answer: D. Automated login for remote users
Automated login for remote users is not a security goal, it is contrary to security objectives. Security goals for remote access require reliable authentication (A), data protection (B), and controlled access management (C). Automated login bypasses authentication controls and increases security risk.
Why the other options are wrong
- A. Reliable authentication is essential for remote access security.
- B. Protection of confidential data is a core security goal for remote access.
- C. Easy and controlled access management is necessary for maintaining remote access security.
Question 229
Which of the following is biggest factor that makes Computer Crimes possible?
Show answer and explanation
Correct answer: B. Victim carelessness.
Victim carelessness represents the biggest factor enabling computer crimes. Poor security practices, weak passwords, unpatched systems, oversharing of credentials, insufficient access controls, and lack of employee awareness, create the primary vulnerability window. Attackers exploit human negligence far more easily than they develop advanced technical skills. While system design flaws and collusion are contributing factors, and specialized training helps attackers, the most fundamental enabler remains victims' failure to implement basic security hygiene and awareness.
Why the other options are wrong
- A. While some fraudsters are trained, most exploit basic carelessness rather than requiring advanced knowledge.
- C. Collusion, though serious, requires multiple conspirators and is less common than simple negligence.
- D. System design flaws exist but are secondary to human carelessness as the primary enabler of crime.
Question 230
When attempting to establish Liability, which of the following would be describe as performing the ongoing maintenance necessary to keep something in proper working order, updated, effective, or to abide by what is commonly expected in a situation?
Show answer and explanation
Correct answer: A. Due care
Due care is the standard of performing the ongoing maintenance, updates, and actions necessary to keep something in proper working order and to abide by what is commonly expected in a situation. It establishes the baseline responsibility for protecting information and systems.
Why the other options are wrong
- B. Due concern is not a standard liability term in information security frameworks.
- C. Due diligence refers to investigations and assessments, not the ongoing maintenance of proper operations.
- D. Due practice is not a recognized standard liability term in security contexts.
Question 231
Which one of the following authentication mechanisms creates a problem for mobile users?
Show answer and explanation
Correct answer: A. Mechanisms based on IP addresses
IP address-based authentication is problematic for mobile users because their IP addresses change frequently as they move between networks (home, office, coffee shops, cellular networks). This creates authentication failures or allows legitimate users to be blocked. Reusable passwords work across locations, one-time passwords and challenge-response mechanisms are designed to be location-independent and work well for mobile users.
Why the other options are wrong
- B. Reusable passwords function regardless of location and present no special problem for mobile users.
- C. One-time password mechanisms work well for mobile users and are specifically designed for remote access.
- D. Challenge-response mechanisms are location-independent and function effectively for mobile authentication.
Question 232
Which must bear the primary responsibility for determining the level of protection needed for information systems resources?
Show answer and explanation
Correct answer: B. Senior Management
Senior management must bear primary responsibility for determining protection levels for information systems because they understand business requirements, risk tolerance, and organizational strategy. While security specialists provide technical expertise and analysis, the decision about what level of protection is needed, balancing security costs against business risk, is a management responsibility involving business judgment and resource allocation.
Why the other options are wrong
- A. Security specialists advise on protection options but should not determine business risk tolerance alone.
- C. Senior security analysts provide technical recommendations but lack business authority to set organizational protection levels.
- D. Auditors assess compliance and controls but are not responsible for determining initial protection requirements.
Question 233
Which of the following statements pertaining to software testing is incorrect?
Show answer and explanation
Correct answer: C. Testing should be performed with live data to cover all possible situations.
Testing with live production data is incorrect and dangerous practice. Testing should use test data specifically designed to cover scenarios without risking production systems or exposing sensitive information. Options A, B, and D are all correct practices: unit testing should be designed into modules from the start, test data should be part of specifications, and test data generators can create systematic random test data. Live data testing introduces unnecessary risks and violates separation of testing and production environments.
Why the other options are wrong
- A. This is correct; unit testing must be planned and addressed during module design.
- B. This is correct; test data specifications should be documented as part of requirements.
- D. This is correct; test data generators systematically create random test data for comprehensive coverage.
Question 234
Within the context of the CBK, which of the following provides a MINIMUM level of security ACCEPTABLE for an environment ?
Show answer and explanation
Correct answer: A. A baseline
A baseline within the CBK context defines the minimum acceptable level of security that must be implemented in an environment. It provides a floor below which security posture should not fall. Standards (B) are mandatory requirements but not minimum levels. Procedures (C) are step-by-step instructions. Guidelines (D) are recommendations, not minimum requirements.
Why the other options are wrong
- B. Standards are mandatory specifications but don't specifically define a minimum acceptable level.
- C. Procedures are detailed instructions for executing tasks, not baseline security levels.
- D. Guidelines are recommendations and best practices, not minimum requirements or baselines.
Question 235
When considering an IT System Development Life-cycle, security should be:
Show answer and explanation
Correct answer: C. Treated as an integral part of the overall system design.
Security must be integrated throughout the entire system development lifecycle, not concentrated in any single phase. This holistic approach ensures that security considerations inform requirements, architecture, design, development, testing, implementation, and operations, rather than being bolted on at the end.
Why the other options are wrong
- A. While initiation establishes security policies, security considerations must extend far beyond this phase.
- B. Development is important for security but is only one component of an integrated approach.
- D. Adding security after design is completed is inefficient and creates significant rework and vulnerabilities.
Question 236
When you update records in multiple locations or you make a copy of the whole database at a remote location as a way to achieve the proper level of fault-tolerance and redundancy, it is knows as?
Show answer and explanation
Correct answer: A. Shadowing
Shadowing involves maintaining synchronized copies of data across multiple locations or systems in real-time. The definition, updating records in multiple locations simultaneously to achieve fault tolerance and redundancy, precisely describes shadowing, where changes propagate instantly to all copies.
Why the other options are wrong
- B. Data mirroring typically refers to real-time duplication within a local infrastructure, not across remote sites.
- C. Backup involves periodic copies taken at intervals, not continuous real-time updates.
- D. Archiving involves storing historical data for retention, not maintaining active redundant copies.
Question 237
Logical or technical controls involve the restriction of access to systems and the protection of information. Which of the following statements pertaining to these types of controls is correct?
Show answer and explanation
Correct answer: C. Examples of these types of controls are encryption, smart cards, access lists, and transmission protocols.
Logical or technical controls include encryption, smart cards, access lists, and transmission protocols. These are technology-based controls that restrict access to systems and protect information in transit and at rest. They operate at the system and network level to prevent unauthorized access and protect data, distinguishing them from administrative controls which involve policies and procedures.
Why the other options are wrong
- A. This describes administrative controls (policies, procedures, training, background checks) rather than logical/technical controls.
- B. This statement is incorrect because encryption, smart cards, access lists, and transmission protocols are primary examples of logical/technical controls.
- D. This describes administrative controls including supervision and vacation reviews, not logical/technical controls.
Question 238
Which of the following exemplifies proper separation of duties?
Show answer and explanation
Correct answer: A. Operators are not permitted modify the system time.
Separation of duties requires that critical functions be divided among different people to prevent any single individual from having too much control. Option A demonstrates proper separation by preventing operators (who run systems) from modifying system time, which is an administrative control function. This prevents operators from altering audit trails or system records. Options B and D allow incompatible roles to overlap, while option C permits console operators to handle physical media, which are separate but compatible duties.
Why the other options are wrong
- B. Programmers using the system console violates separation of duties by combining development and operations roles.
- C. Console operators mounting tapes and disks is a compatible separation of logical and physical duties, but does not exemplify proper separation as clearly as A.
- D. Tape operators using the system console combines physical media handling with system administration, violating separation of duties.
Question 239
Which of the following would provide the BEST stress testing environment taking under consideration and avoiding possible data exposure and leaks of sensitive data?
Show answer and explanation
Correct answer: B. Test environment using sanitized live workloads data.
A test environment using sanitized live workloads data provides the best stress testing environment because it offers realistic production-like data volumes and patterns without exposing sensitive data. Sanitization removes or masks confidential information while maintaining data structure and relationships needed for effective stress testing. This balances realism with security and privacy protection.
Why the other options are wrong
- A. Test data alone may not accurately represent production workload characteristics and stress patterns needed for realistic testing.
- C. Using production environment with any data creates risk of system impact and is not appropriate for stress testing.
- D. Using production environment for testing is unsafe and violates security practices regardless of data sanitization.
Question 240
Which of the following should be emphasized during the Business Impact Analysis (BIA) considering that the BIA focus is on business processes?
Show answer and explanation
Correct answer: C. Dependencies
Dependencies should be emphasized during BIA because understanding how business processes depend on each other, on specific resources, systems, and personnel is critical for accurate recovery prioritization. Identifying dependencies enables the organization to understand cascading effects of failures, determine proper recovery sequencing, and allocate resources effectively. This directly supports the BIA's goal of focusing on business processes and their criticality.
Why the other options are wrong
- A. Composition (structural makeup) is less critical than understanding how processes rely on one another.
- B. While priorities are important outcomes of BIA, dependencies are what drive accurate priority determination.
- D. Service levels are outputs of BIA analysis rather than the primary emphasis of the business process focus.
Question 241
Which of the following is the BEST way to detect software license violations?
Show answer and explanation
Correct answer: D. Regularly scanning PCs in use to ensure that unauthorized copies of software have not been loaded on the PC.
Regular scanning of PCs to detect unauthorized software installations (D) is the most effective method to detect actual license violations. This proactive approach directly identifies non-compliant software. Option A establishes policy but doesn't detect violations. Option B (diskless workstations) prevents installation but is impractical for most organizations. Option C (metering software) controls access to legitimate software but doesn't detect unauthorized copies already installed or violations from other sources. Option D combines detection with verification and is the most comprehensive approach.
Why the other options are wrong
- A. Policy alone does not actively detect software violations that may have already occurred.
- B. Diskless workstations are impractical for modern computing environments and don't detect existing violations.
- C. Metering software controls legitimate application access but doesn't detect unauthorized software copies.
Question 242
Making sure that only those who are supposed to access the data can access is which of the following?
Show answer and explanation
Correct answer: A. confidentiality.
Confidentiality ensures that only authorized individuals can access data. This is the definition of confidentiality in the CIA triad, it protects information from unauthorized disclosure or access. Restricting access to only those who are supposed to access data is the core principle of confidentiality in information security.
Why the other options are wrong
- B. Capability refers to permissions and access control mechanisms but is not the security principle itself.
- C. Integrity ensures data is accurate and unmodified, not that only authorized users can access it.
- D. Availability ensures data is accessible when needed, which is distinct from controlling who can access it.
Question 243
The session layer provides a logical persistent connection between peer hosts. Which of the following is one of the modes used in the session layer to establish this connection?
Show answer and explanation
Correct answer: A. Full duplex
Full duplex is a legitimate Session Layer connection mode that allows simultaneous bidirectional communication between peer hosts, establishing a logical persistent connection. The Session Layer (Layer 5) manages dialogue control using modes like full duplex, half duplex, and simplex. Synchronous and asynchronous are timing mechanisms, not connection modes. Half simplex is not a valid term in networking.
Why the other options are wrong
- B. Synchronous refers to timing/synchronization mechanisms, not Session Layer connection modes.
- C. Asynchronous refers to timing mechanisms, not a Session Layer connection establishment mode.
- D. Half simplex is not a valid networking term; simplex and half-duplex are separate concepts.
Question 244
Which of the following is NOT a system-sensing wireless proximity card?
Show answer and explanation
Correct answer: A. magnetically striped card
A magnetically striped card is NOT a system-sensing wireless proximity card. Magnetically striped cards require physical contact or very close proximity for a magnetic reader to extract data, and they do not actively communicate with a sensing system like wireless proximity cards do. Wireless proximity cards use radio frequency or other wireless technologies for sensing.
Why the other options are wrong
- B. Passive devices are a type of wireless proximity card that reflects or responds to signals without active power.
- C. Field-powered devices are wireless proximity cards that derive power from the electromagnetic field of the reader.
- D. Transponders are wireless proximity cards that actively transmit identifying information when energized by a reader's signal.
Question 245
Why would anomaly detection IDSs often generate a large number of false positives?
Show answer and explanation
Correct answer: D. Because normal patterns of user and system behavior can vary wildly.
Anomaly detection IDSs identify deviations from established baselines of normal behavior. They generate high false positive rates because legitimate user and system behavior varies significantly and unpredictably, behavior that appears anomalous may simply be normal variation. This is fundamentally different from signature-based detection, which only identifies known attack patterns. The variability of normal operations makes it difficult to establish accurate baselines.
Why the other options are wrong
- A. This describes signature-based detection, not anomaly detection, which relies on behavioral baselines rather than known patterns.
- B. Application-based deployment is not the primary reason for false positives in anomaly detection systems.
- C. Anomaly detection systems are specifically designed to identify abnormal behavior; the issue is defining what counts as abnormal.
Question 246
Which of the following is not a component of a Operations Security "triples"?
Show answer and explanation
Correct answer: D. Risk
The operations security (OPSEC) framework traditionally focuses on the relationship between assets, threats, and vulnerabilities, identifying what needs protection, what could harm it, and what weaknesses could be exploited. Risk, while important in security generally, is not a core component of the classic OPSEC triad.
Why the other options are wrong
- A. Asset is a fundamental OPSEC component representing what needs to be protected.
- B. Threat is a core OPSEC component representing potential harm sources.
- C. Vulnerability is a core OPSEC component representing weaknesses that threats could exploit.
Question 247
In the context of access control, locks, gates, guards are examples of which of the following?
Show answer and explanation
Correct answer: C. Physical controls
Locks, gates, and guards are examples of physical controls. Physical controls are tangible, real-world security measures that physically restrict or prevent access to assets, facilities, or areas. These three examples all involve concrete physical mechanisms or personnel that provide direct physical security.
Why the other options are wrong
- A. Administrative controls include policies, procedures, and training rather than physical barriers.
- B. Technical controls use technology such as firewalls and encryption, not physical barriers.
- D. Logical controls are technology-based access restrictions such as passwords and encryption, not physical barriers.
Question 248
Which of the following would be used to implement Mandatory Access Control (MAC)?
Show answer and explanation
Correct answer: C. Lattice-based access control
Lattice-based access control would be used to implement Mandatory Access Control (MAC). Lattice structures provide a mathematical framework for representing security levels and their relationships, allowing the system to enforce mandatory rules about which subjects can access which objects based on clearance and classification levels.
Why the other options are wrong
- A. Clark-Wilson Access Control is used for integrity models, not MAC confidentiality models.
- B. Role-based access control is a type of non-discretionary access control distinct from MAC.
- D. User dictated access control describes discretionary models where users control permissions, opposite to MAC.
Question 249
In the Bell-LaPadula model, the Star-property is also called:
Show answer and explanation
Correct answer: C. The confinement property
In the Bell-LaPadula mandatory access control model, the Star-property (*-property) is also called the confinement property. This property states that a subject at a higher security level cannot write information to an object at a lower security level, preventing unauthorized disclosure of classified information downward through the classification hierarchy.
Why the other options are wrong
- A. The simple security property is a different rule in Bell-LaPadula addressing read access, not the Star-property
- B. While confidentiality is related, the Star-property is specifically termed the confinement property
- D. The tranquility property addresses whether classification levels can change; it is distinct from the Star-property
Question 250
What is the most critical characteristic of a biometric identifying system?
Show answer and explanation
Correct answer: C. Accuracy
Accuracy is the most critical characteristic of a biometric identification system because the system's primary purpose is to correctly identify or authenticate individuals. Without high accuracy, the system fails its fundamental security objective, regardless of other operational characteristics.
Why the other options are wrong
- A. Perceived intrusiveness affects user acceptance but not the fundamental security function.
- B. Storage requirements are a technical consideration but secondary to system accuracy.
- D. Scalability is important for deployment but not as critical as the system's ability to accurately identify individuals.
Question 251
Which of the following is a CHARACTERISTIC of a decision support system (DSS) in regards to Threats and Risks Analysis?
Show answer and explanation
Correct answer: B. DSS emphasizes flexibility in the decision making approach of users.
A Decision Support System is characterized by its emphasis on flexibility in the decision-making approach of users. DSS are designed to support semi-structured and unstructured problems, allowing users to explore different scenarios and approaches interactively. The flexibility comes from combining models with data access and retrieval functions, but the key distinguishing characteristic is that DSS adapts to user needs rather than forcing a single predetermined approach.
Why the other options are wrong
- A. DSS is aimed at solving semi-structured and unstructured problems, not highly structured ones.
- C. DSS supports both structured and unstructured decision-making tasks, not only structured ones.
- D. While this describes some DSS capabilities, it is a mechanism rather than the primary characteristic of flexibility.
Question 252
Which of the following is the most reliable authentication method for remote access?
Show answer and explanation
Correct answer: B. Synchronous token
A synchronous token (also called a time-based token or hardware token) is the most reliable authentication method for remote access because it generates one-time passwords that are synchronized with a server and cannot be reused or intercepted for future attacks. The token changes at regular intervals, making it resistant to replay attacks and man-in-the-middle threats.
Why the other options are wrong
- A. Variable callback systems are less reliable because the attacker can potentially intercept and redirect calls to a number they control.
- C. Fixed callback systems are vulnerable because an attacker knowing the callback number can intercept the connection before the legitimate user.
- D. Callback combined with caller ID can be spoofed; caller ID is not cryptographically secure and can be defeated.
Question 253
Which of the following centralized access control mechanisms is the least appropriate for mobile workers accessing the corporate network over analog lines?
Show answer and explanation
Correct answer: B. Call-back
Call-back is the least appropriate for mobile workers on analog lines because it requires the server to disconnect and call back a pre-programmed phone number. Mobile workers constantly change locations and use different phone numbers, making call-back impractical and unreliable. TACACS, CHAP, and RADIUS all support dynamic authentication from any location without requiring predetermined callback numbers.
Why the other options are wrong
- A. TACACS is a centralized authentication protocol that works well for remote access from any location.
- C. CHAP is a challenge-response authentication protocol suitable for analog line connections.
- D. RADIUS is a flexible centralized authentication mechanism that supports mobile workers accessing from various locations.
Question 254
A host-based IDS is resident on which of the following?
Show answer and explanation
Correct answer: A. On each of the critical hosts
A host-based IDS is resident on each of the critical hosts that require protection. This allows the IDS to monitor that specific host's audit logs, system calls, and file access in detail. Deployment is distributed across critical systems rather than centralized, enabling local threat detection at the system level.
Why the other options are wrong
- B. While host-based IDS is decentralized in architecture, the answer 'each critical host' is more precise.
- C. Host-based IDS is not deployed centrally; it resides on individual systems.
- D. Bastion hosts are hardened systems, but host-based IDS is deployed on critical hosts generally, not specifically bastion hosts.
Question 255
In what way can violation clipping levels assist in violation tracking and analysis?
Show answer and explanation
Correct answer: A. Clipping levels set a baseline for acceptable normal user errors, and violations exceeding that threshold will be recorded for analysis of why the violations occurred.
Clipping levels establish a baseline threshold for normal, acceptable user errors or activities. Events below the clipping level are considered normal and not recorded, while violations exceeding the threshold are captured and analyzed to understand why they occurred. This approach reduces noise in audit logs while focusing attention on genuinely anomalous behavior. Option B describes audit trail customization but not the specific function of clipping levels. Option C focuses on privileged users specifically, which is too narrow. Option D mischaracterizes clipping levels as tracking security reductions rather than error thresholds.
Why the other options are wrong
- B. While related, this describes general audit trail customization rather than the specific function of clipping levels.
- C. Clipping levels apply to all users and are not specifically limited to those with privileged account access.
- D. Clipping levels track violations against normal baselines, not reductions in security levels applied to accounts.
Question 256
A department manager has read access to the salaries of the employees in his/her department but not to the salaries of employees in other departments. A database security mechanism that enforces this policy would typically be said to provide which of the following?
Show answer and explanation
Correct answer: A. Content-dependent access control
Content-dependent access control restricts access based on the actual content or data values involved. In this scenario, the manager's access to salary data depends on the content of the department field, they can access salaries only for their own department. The access decision is made based on what department the salary record belongs to, which is the defining characteristic of content-dependent access control.
Why the other options are wrong
- B. Context-dependent access control restricts access based on conditions like time, location, or system state, not on the data content itself.
- C. Least privilege access control refers to granting users the minimum permissions necessary; this example demonstrates content-based filtering rather than least privilege principles.
- D. Ownership-based access control restricts access based on who owns the data; this scenario is based on data content, not ownership.
Question 257
A weakness or lack of a safeguard, which may be exploited by a threat, causing harm to the information systems or networks is called a ?
Show answer and explanation
Correct answer: A. Vulnerability
A vulnerability is a weakness, flaw, or lack of a safeguard in a system that may be exploited by a threat to cause harm to information systems or networks. Vulnerabilities are the conditions that allow threats to succeed; they represent gaps in security defenses that threat actors can leverage.
Why the other options are wrong
- B. Risk is the combination of threat and vulnerability; it is not itself a weakness or lack of safeguard.
- C. A threat is a potential source of harm, not a weakness or lack of safeguard in systems.
- D. An overflow is a specific type of technical attack, not the general term for a weakness or lack of safeguard.
Question 258
The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:
Show answer and explanation
Correct answer: C. Detective/physical
Detective controls identify threats after they occur, and physical controls involve tangible security measures like cameras and sensors. Human evaluation of sensor/camera input to determine if a real threat exists is characteristic of detective/physical controls, the system detects potential issues (detective) using physical devices (cameras, sensors), requiring human judgment to confirm actual threats.
Why the other options are wrong
- A. Preventive controls act before threats materialize; human evaluation after detection is a detective function, not preventive.
- B. Detective/technical controls use automated technical systems to identify threats; human evaluation of physical sensors is physical, not purely technical.
- D. Detective/administrative controls involve policy and procedure reviews; controls requiring sensor/camera evaluation are physical in nature, not administrative.
Question 259
A momentary high voltage is a:
Show answer and explanation
Correct answer: A. spike
A spike is a momentary increase in voltage above normal levels. This term describes short-duration, high-voltage transients that can damage sensitive equipment.
Why the other options are wrong
- B. A blackout is a loss of power, not high voltage.
- C. A surge refers to prolonged high voltage, whereas a spike is momentary.
- D. A fault is a general term and does not specifically describe momentary high voltage.
Question 260
Which of the following refers to the data left on the media after the media has been erased?
Show answer and explanation
Correct answer: A. remanence
Remanence is the technical term for residual data that remains on storage media after the media has been erased or cleared. This is a critical security concern because remanent data can potentially be recovered through forensic techniques, making proper data sanitization essential.
Why the other options are wrong
- B. Recovery refers to the process of retrieving deleted or lost data, not the data left behind after erasure.
- C. Sticky bits are Unix file permission indicators used in access control, unrelated to data remaining after erasure.
- D. Semi-hidden is not a technical term used in data sanitization or media wiping contexts.
Question 261
Considerations of privacy, invasiveness, and psychological and physical comfort when using the system are important elements for which of the following?
Show answer and explanation
Correct answer: B. Acceptability of biometrics systems
Acceptability of biometric systems specifically addresses user concerns about privacy, invasiveness, psychological comfort, and physical comfort. These factors determine whether users will actually adopt and use the biometric system. Accountability refers to responsibility and liability, availability refers to system uptime, and adaptability refers to system flexibility, none of these directly address the human factors of privacy and comfort.
Why the other options are wrong
- A. Accountability focuses on responsibility and liability, not user comfort concerns.
- C. Availability concerns system uptime and accessibility, not privacy or comfort.
- D. Adaptability relates to system flexibility and adjustment capabilities, not user experience factors.
Question 262
Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplished:
Show answer and explanation
Correct answer: A. through access control mechanisms that require identification and authentication and through the audit function.
Accountability for individuals accessing sensitive information is accomplished through access control mechanisms that require identification and authentication, coupled with the audit function. Identification verifies who the user is, authentication confirms their identity, and audit logging creates a record of what actions they performed. Together, these elements establish a clear audit trail that holds individuals accountable for their access and actions.
Why the other options are wrong
- B. While logical/technical controls are involved, they alone do not establish accountability without identification, authentication, and audit functions.
- C. Logical/technical controls do restrict access and protect information, so this negation makes the statement incorrect.
- D. Accountability requires identification and authentication mechanisms, not their absence, and must operate through audit functions.
Question 263
Physical security is accomplished through proper facility construction, fire and water protection, anti-theft mechanisms, intrusion detection systems, and security procedures that are adhered to and enforced. Which of the following is not a component that achieves this type of security?
Show answer and explanation
Correct answer: B. Integrity control mechanisms
Integrity control mechanisms are not a component of physical security. Physical security is achieved through administrative controls (policies and procedures), technical/logical controls (intrusion detection systems, access controls), and physical controls (fencing, locks, surveillance). Integrity controls relate to data integrity and are part of information security rather than physical security of facilities.
Why the other options are wrong
- A. Administrative control mechanisms such as security policies and procedures are essential components of physical security.
- C. Technical control mechanisms including intrusion detection systems and electronic access controls are core physical security components.
- D. Physical control mechanisms such as fencing, barriers, locks, and surveillance cameras are fundamental to physical security.
Question 264
Which of the following groups represents the leading source of computer crime losses?
Show answer and explanation
Correct answer: D. Employees
Employees represent the leading source of computer crime losses across most documented studies and industry reports. Insiders have legitimate access, knowledge of systems, and understanding of vulnerabilities, making them both more capable and more likely to commit fraud, theft, or sabotage. External threats from hackers, industrial saboteurs, and foreign intelligence officers, while serious, cause fewer reported losses overall than insider threats, both in frequency and financial impact.
Why the other options are wrong
- A. While hackers cause significant damage, insider threats generate greater overall financial losses.
- B. Industrial saboteurs are a smaller threat vector compared to employee-based computer crimes.
- C. Foreign intelligence threats, while serious, represent a smaller portion of overall computer crime losses.
Question 265
A prolonged power supply that is below normal voltage is a:
Show answer and explanation
Correct answer: A. brownout
A brownout is a prolonged reduction in voltage below normal levels. It represents a sustained condition where electrical supply remains available but at insufficient voltage levels, often caused by high demand periods.
Why the other options are wrong
- B. A blackout is complete power loss, not reduced voltage.
- C. A surge is high voltage, not low voltage.
- D. A fault is a general electrical failure term, not a specific prolonged low-voltage condition.
Question 266
Attributes that characterize an attack are stored for reference using which of the following Intrusion Detection System (IDS) ?
Show answer and explanation
Correct answer: A. signature-based IDS
Signature-based IDS stores known attack characteristics (signatures) in a database and compares incoming traffic against these stored patterns. Signatures are the defining feature of this detection method, representing known malicious activities used for reference and comparison.
Why the other options are wrong
- B. Statistical anomaly-based IDS establishes normal profiles, not signature storage for known attacks.
- C. Event-based IDS is not a standard IDS category in certification materials.
- D. Inferential-based IDS is not a standard IDS classification in typical certification frameworks.
Question 267
In biometrics, the "one-to-one" search used to verify claim to an identity made by a person is considered:
Show answer and explanation
Correct answer: A. Authentication
Authentication in biometrics is a one-to-one verification process where the system compares a presented biometric sample against one specific stored template to verify that the person's claimed identity is valid. This is the verification of an identity claim rather than discovery of identity.
Why the other options are wrong
- B. Identification is one-to-many searching to determine identity, not one-to-one verification of a claimed identity.
- C. Auditing is logging and monitoring activities, not the biometric verification process.
- D. Authorization is determining what access rights an authenticated user has, not the verification of identity.
Question 268
Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of a software product?
Show answer and explanation
Correct answer: C. Determining the interface that is presented to the user
Change control in the maintenance phase focuses on managing requested modifications to existing software. Typical activities include estimating costs, analyzing problems, and prioritizing requests. Determining the user interface presentation is a design-level activity that occurs during initial development phases, not during the maintenance change control process. Change control is about managing changes to existing systems, not redesigning user interfaces.
Why the other options are wrong
- A. Estimating the cost of changes is a core change control activity.
- B. Recreating and analyzing the problem is essential for understanding what change is needed.
- D. Establishing priorities of requests is a key change control responsibility.
That was 268 of 1,074.
The full ISC2 SSCP pack has all 1,074 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 537 free as one PDF by email. Get the Half Pack →