SSCP Security Architecture & Engineering 2 — Questions and Answers
Question 1: Which cryptographic mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?
- CBC (Cipher Block Chaining)
- CTR (Counter Mode) (Correct answer)
- ECB (Electronic Codebook)
- OFB (Output Feedback)
Correct answer: CTR (Counter Mode)
CTR mode generates a keystream by encrypting successive counter values and XORing the result with plaintext, effectively making a block cipher behave as a stream cipher.
Question 2: A security engineer is designing a system where every access request is verified regardless of network location. Which security model best describes this approach?
- Defense in Depth
- Zero Trust Architecture (Correct answer)
- Perimeter Security Model
- Bell-LaPadula Model
Correct answer: Zero Trust Architecture
Zero Trust Architecture operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every request regardless of network origin.
Question 3: In the context of hardware security, what is the primary function of a Trusted Platform Module (TPM)?
- Encrypting network traffic between hosts
- Storing cryptographic keys and performing attestation functions (Correct answer)
- Providing physical tamper detection for server racks
- Managing user authentication credentials in Active Directory
Correct answer: Storing cryptographic keys and performing attestation functions
A TPM is a dedicated microcontroller that securely stores cryptographic keys, performs platform integrity measurements, and enables remote attestation.
Question 4: Which security principle ensures that a system continues to operate in a secure state even when components fail?
- Least Privilege
- Fail-Secure (Correct answer)
- Separation of Duties
- Defense in Depth
Correct answer: Fail-Secure
Fail-secure (also called fail-safe) means that when a system fails, it defaults to a secure state — for example, a firewall that blocks all traffic upon failure.
Question 5: An attacker exploits a vulnerability in a virtualization platform to escape from a guest VM and access the hypervisor. What type of attack is this?
- Privilege Escalation
- VM Escape (Correct answer)
- Side-Channel Attack
- Container Breakout
Correct answer: VM Escape
VM escape is an attack where malicious code running inside a virtual machine breaks out of the VM isolation boundary and gains access to the underlying hypervisor or host.
Question 6: What is the key difference between a security kernel and a reference monitor?
- A security kernel is software-only; a reference monitor includes hardware
- A reference monitor is a concept; the security kernel is its hardware/software implementation (Correct answer)
- A security kernel handles network security; a reference monitor handles file access
- A reference monitor enforces MAC; a security kernel enforces DAC
Correct answer: A reference monitor is a concept; the security kernel is its hardware/software implementation
The reference monitor is an abstract concept — a policy-enforcing component that mediates all access — while the security kernel is the actual hardware/software/firmware implementation of that concept.
Question 7: Which of the following best describes a covert channel in a secure system?
- An encrypted tunnel used for administrative access
- A communication path not intended for information transfer that can leak data (Correct answer)
- A hidden backdoor installed by a malicious insider
- A VPN channel used to bypass firewall rules
Correct answer: A communication path not intended for information transfer that can leak data
A covert channel is an unintended communication path that violates a system's security policy by allowing information to be leaked through means not designed for data transfer, such as timing or storage variations.
SSCP Security Architecture & Engineering 2
Which cryptographic mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?