SC-900 Security, Compliance & Identity Concepts 3 — Questions and Answers
Question 1: Which encryption type uses the same key for both encrypting and decrypting data?
- Asymmetric encryption
- Symmetric encryption (Correct answer)
- Hashing
- Public key infrastructure
Correct answer: Symmetric encryption
Symmetric encryption uses a single shared key for both encryption and decryption, making it faster but requiring secure key distribution.
Question 2: What is the purpose of 'data classification' in a compliance framework?
- To sort data alphabetically for easier retrieval
- To categorize data based on sensitivity to apply appropriate security controls (Correct answer)
- To compress data for more efficient storage
- To identify duplicate records in a database
Correct answer: To categorize data based on sensitivity to apply appropriate security controls
Data classification assigns sensitivity labels (such as public, internal, confidential, or highly confidential) to help organizations apply the correct security and compliance controls.
Question 3: Which of the following is an example of a 'detective' security control?
- Firewall blocking unauthorized traffic
- Security awareness training for employees
- Intrusion detection system alerting on suspicious activity (Correct answer)
- Access control list restricting file permissions
Correct answer: Intrusion detection system alerting on suspicious activity
Detective controls identify and alert on security incidents after they occur; an IDS monitors network traffic and raises alerts when suspicious patterns are detected.
Question 4: In identity management, what is a 'claim'?
- A formal request to reset a forgotten password
- A statement made by an identity provider about a user's attributes or permissions (Correct answer)
- A legal assertion of data ownership rights
- A certificate used to verify a server's identity
Correct answer: A statement made by an identity provider about a user's attributes or permissions
A claim is an assertion made by an identity provider about a subject, such as their name, role, or group membership, contained within a security token.
Question 5: What does 'non-repudiation' ensure in a security context?
- That data cannot be read by unauthorized users
- That a user cannot deny having performed an action (Correct answer)
- That systems remain available during an attack
- That access requests are verified before being granted
Correct answer: That a user cannot deny having performed an action
Non-repudiation provides proof that a specific entity performed an action, preventing them from later denying it, often achieved through digital signatures.
Question 6: Which type of malware disguises itself as legitimate software to trick users into installing it?
- Worm
- Ransomware
- Trojan horse (Correct answer)
- Rootkit
Correct answer: Trojan horse
A Trojan horse masquerades as legitimate or benign software while carrying a malicious payload that executes when the user installs or runs it.
Question 7: What is the role of a 'Certificate Authority (CA)' in a Public Key Infrastructure?
- To generate private keys for end users
- To issue, sign, and revoke digital certificates that bind public keys to identities (Correct answer)
- To encrypt all communications on the network
- To store users' passwords in a secure vault
Correct answer: To issue, sign, and revoke digital certificates that bind public keys to identities
A CA is a trusted entity that issues digital certificates, verifying that a public key belongs to the stated entity and enabling trust in encrypted communications.
SC-900 Security, Compliance & Identity Concepts 3
Which encryption type uses the same key for both encrypting and decrypting data?