SSCP Security Architecture & Engineering 4

Question 1

An organization implements FIPS 140-2 Level 3 validated HSMs for its cryptographic operations. What additional assurance does Level 3 provide over Level 2?

Accepted Answer

Level 3 requires physical tamper-resistance with response mechanisms that zeroize keys

Answer

FIPS 140-2 Level 3 adds physical tamper-resistance and response — the device must detect and respond to physical intrusion attempts by zeroizing sensitive parameters, beyond the tamper-evident coating required at Level 2.

Question 2

Which architecture pattern separates the data plane from the control plane to improve network security and manageability?

Accepted Answer

Software-Defined Networking (SDN)

Answer

Software-Defined Networking separates the control plane (routing decisions) from the data plane (packet forwarding), centralizing network control and enabling more granular security policy enforcement.

Question 3

What is the purpose of a security-focused 'orange book' (TCSEC) evaluation class of B3?

Accepted Answer

Systems must use mandatory access controls and a structured protection design

Answer

TCSEC Class B3 (Security Domains) requires that the system's TCB be structured to exclude code not essential to security policy enforcement, with support for security administrators and system recovery.

Question 4

A security architect is concerned about electromagnetic emanations from workstations leaking sensitive data. Which standard addresses this threat?

Accepted Answer

TEMPEST (EMSEC)

Answer

TEMPEST (part of EMSEC — Emissions Security) addresses the risk of sensitive information being reconstructed from unintentional electromagnetic emissions from electronic equipment.

Question 5

In a cloud environment, which shared responsibility model component is ALWAYS the customer's responsibility regardless of service model (IaaS, PaaS, SaaS)?

Accepted Answer

Data classification and protection

Answer

Regardless of cloud service model, the customer is always responsible for classifying and protecting their own data — the cloud provider never assumes ownership of the customer's data security decisions.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Security Architecture & Engineering 4