Free SSCP Certification II Questions and Answers — Questions and Answers
Question 1: Which of the following is an example of a view-based access control system?
- Side Channel
- Audit Control
- Constrained User Interface (Correct answer)
- Temporal Constraint
Correct answer: Constrained User Interface
View-Based Access Control (VBAC) is a security model that restricts a user's interface to only display information relevant to their authorization level. It provides a constrained user interface, where users are granted access to specific views or subsets of data based on their privileges. By limiting the information visible to a user, VBAC helps enforce access controls and prevent unauthorized access to sensitive data.
Question 2: Which of the following allows for HTTP traffic to be sent securely?
- Transport Layer Security (TLS) (Correct answer)
- Kerberos
- Layer 2 Tunneling Protocol (L2TP)
- Secure Remote Password (SRP)
Correct answer: Transport Layer Security (TLS)
Transport Layer Security (TLS) is a cryptographic protocol that ensures secure communication over a network. It is commonly used to secure HTTP traffic, providing encryption, data integrity, and authentication. When TLS is implemented, it encrypts the HTTP data transmitted between a client and a server, preventing unauthorized access and protecting the confidentiality of the information exchanged.
Question 3: Which of the following is one of the Biba model's three main rules?
- A subject cannot read or modify an object of either a lower or higher integrity level.
- A subject cannot request services from an object that has a higher integrity level
- A subject cannot modify an object that has a lower integrity level. (Correct answer)
- A subject can read an object that has a lower integrity level.
Correct answer: A subject cannot modify an object that has a lower integrity level.
The Biba model is a security model that focuses on data integrity. It defines three primary rules, also known as the Biba integrity rules. These rules are designed to prevent data corruption and maintain the integrity of information within a system.
Question 4: What one of the following is a network device that makes use of context-based access control?
- Stateful inspection firewall (Correct answer)
- Network IDS
- Static packet filter
- VLAN
Correct answer: Stateful inspection firewall
Context-Based Access Control (CBAC) is a network security mechanism that evaluates various contextual factors, such as source/destination IP addresses, ports, protocols, and connection state, to make access control decisions. CBAC is typically implemented in firewalls to enhance network security by allowing or blocking network traffic based on the context of the communication.
Question 5: What behavioral characteristics are present in a biometric device?
- Fingerprint and facial recognition
- Voice pattern and Keystroke dynamics (Correct answer)
- Signature dynamics and Iris scan
- Retina scan and Hand geometry
Correct answer: Voice pattern and Keystroke dynamics
Behavioral biometrics refer to the analysis and recognition of unique patterns in human behavior. These patterns can be used as traits for biometric authentication. Among the options provided, voice pattern and keystroke dynamics are examples of behavioral traits in a biometric device.
Question 6: What distinguishes a synchronous password token from an asynchronous password token?
- Asynchronous tokens are generated with the use of a timer while synchronous tokens do not use a clock for generation.
- Asynchronous tokens contain a password which is physically hidden and then transmitted for each authentication while synchronous tokens do not.
- Synchronous tokens are generated with the use of a timer while asynchronous tokens do not use a clock for generation. (Correct answer)
- Synchronous tokens contain a password which is physically hidden and then transmitted for each authentication while asynchronous tokens do not
Correct answer: Synchronous tokens are generated with the use of a timer while asynchronous tokens do not use a clock for generation.
Synchronous and asynchronous password tokens are two different types of authentication devices used for generating one-time passwords (OTPs) in two-factor authentication systems. The main difference between them lies in how the OTPs are generated. <br> <br> Synchronous tokens, also known as time-based tokens, rely on a clock or timer mechanism. These tokens are synchronized with a server or a central time source. They generate OTPs based on a shared secret key and the current time, usually in sync with the server's clock. The server and the token must be synchronized for the OTP to be validated successfully.
Question 7: Which one of the following should each side employ in symmetric key cryptography?
- Public key exchanged with the message
- Key encrypting key
- Randomly generated value unknown to anyone
- Previously exchanged secret key (Correct answer)
Correct answer: Previously exchanged secret key
In symmetric key cryptography, the same key is used by both the sender and the receiver to encrypt and decrypt the data. This shared secret key must be securely exchanged between the parties before communication begins. The key should remain confidential and known only to the communicating parties.
Free SSCP Certification II Questions and Answers
Which of the following is an example of a view-based access control system?