SSCP Security Architecture & Engineering 5

Question 1

Which of the following correctly describes the Clark-Wilson security model's primary focus?

Accepted Answer

Ensuring data integrity through well-formed transactions and separation of duties

Answer

The Clark-Wilson model focuses on data integrity by requiring that all data transformations occur through constrained (well-formed) transactions and enforces separation of duties to prevent fraud.

Question 2

A security team is evaluating whether to use symmetric or asymmetric encryption for bulk data encryption at rest. What is the PRIMARY reason to choose symmetric encryption for this use case?

Accepted Answer

Symmetric encryption is significantly faster and more efficient for encrypting large data volumes

Answer

Symmetric encryption algorithms (AES, ChaCha20) are orders of magnitude faster than asymmetric algorithms (RSA, ECC), making them the practical choice for encrypting large volumes of data at rest.

Question 3

What is the main security purpose of certificate pinning in mobile applications?

Accepted Answer

Preventing MITM attacks by validating the server's certificate against a known-good copy

Answer

Certificate pinning hardcodes the expected server certificate or public key in the application, preventing man-in-the-middle attacks that use rogue but CA-trusted certificates.

Question 4

In the context of secure system design, what is a 'trusted computing base' (TCB)?

Accepted Answer

The set of hardware, software, and firmware components critical to enforcing the security policy

Answer

The Trusted Computing Base is the totality of protection mechanisms within a computer system — including hardware, firmware, and software — that are relied upon to enforce the security policy.

Question 5

Which security architecture principle advocates that a security mechanism's design should be open to public scrutiny rather than kept secret?

Accepted Answer

Open Design

Answer

The Open Design principle (from Saltzer and Schroeder) states that security should not depend on the secrecy of the mechanism itself, but rather on the secrecy of keys or other parameters.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Security Architecture & Engineering 5