WGU C845 - SSCP Study Guide PT3
How is separation of duties typically implemented? - answer Segment administrative
tasks into compartments, and then assign one or more distinct administrators into each
compartment.
Which of the following is not a security category? - answer Remuneration
Nonrepudiation ensures which of the following? - answer That the sender cannot deny
their actions
What is the foundational premise of risk management? - answer There is always some
level of risk.
What is the definition of the principle of least privilege? - answer Granting users only the
minimum privileges needed to accomplish assigned work tasks
Which of the following is a security program used in many banks to verify the ethics and
job performance of a bank manager? - answerMandatory vacation
To prevent any one person from having too much control or power, or performing
fraudulent acts, which of the following solutions should not be implemented? -
answerJob rotation
What is a restriction placed on users that denies them access to resources on the
weekends? - answerTime of day restriction
Which of the following provides a catchall and prevents an action from being taken after
everything else has allowed through on a network? - answerImplicit deny
Which option is not a part of the prevention primary security category? - answerUsing
an alternate site after a disaster
Which of the following is a nontechnical means of enforcing security? - answerUser
training
During an access system audit, a number of active accounts were discovered from
employees who had left the company over the past two years. What are these accounts
called? - answerOrphan accounts
How is confidentiality different from privacy? - answerConfidentiality relates to the
control of information in order to prevent disclosure to unauthorized entities.
, How can integrity be enforced or assessed across an entire computer system? -
answerCompare a baseline of hardware settings and software configuration against a
live system.
What is the most important foundational security concept upon which most other
security ideas and solutions are based? - answerImplicit deny
Which term is used to indicate the function of access control or define which subjects
can perform various tasks on specific objects? - answerAuthorization
What are the three categories of controls? - answerPhysical, logical (technical), and
administrative
Why do employees have to read and sign an Authorized Use Policy (AUP) before they
are granted access to the IT network? - answerTo remind them of their responsibilities
and that they will be held accountable for their activities
Why are locks used on doors in secured areas? - answerTo keep people honest
Which of the following best describes the time that it takes to register with a biometric
system, by providing samples of a personal characteristic? - answerEnrollment time
Which of the following is true about biometric scan technology? - answerA number of
points extracted from the item scanned are stored.
Crossover error rate (CER) refers to which of the following graphical intersections? -
answerFalse rejection rate and false acceptance rate
Why is multifactor authentication considered more secure than single-factor
authentication? - answerMultifactor authentication requires multiple distinct attacks to
perform impersonation.
Which of the following is a goal of integrity? - answerData should not change between
sender and receiver
Which of the following best describes privileged users? - answerThey are super-users
or administrators
Which of the following best describes session level controls? - answerLog-off due to the
user inactivity
Authorization for multiple applications using one set of credentials is best described by
which of the following? - answerSingle Sign-on
Which of the following best describes a password that changes on each logon? -
answerDynamic password
How is separation of duties typically implemented? - answer Segment administrative
tasks into compartments, and then assign one or more distinct administrators into each
compartment.
Which of the following is not a security category? - answer Remuneration
Nonrepudiation ensures which of the following? - answer That the sender cannot deny
their actions
What is the foundational premise of risk management? - answer There is always some
level of risk.
What is the definition of the principle of least privilege? - answer Granting users only the
minimum privileges needed to accomplish assigned work tasks
Which of the following is a security program used in many banks to verify the ethics and
job performance of a bank manager? - answerMandatory vacation
To prevent any one person from having too much control or power, or performing
fraudulent acts, which of the following solutions should not be implemented? -
answerJob rotation
What is a restriction placed on users that denies them access to resources on the
weekends? - answerTime of day restriction
Which of the following provides a catchall and prevents an action from being taken after
everything else has allowed through on a network? - answerImplicit deny
Which option is not a part of the prevention primary security category? - answerUsing
an alternate site after a disaster
Which of the following is a nontechnical means of enforcing security? - answerUser
training
During an access system audit, a number of active accounts were discovered from
employees who had left the company over the past two years. What are these accounts
called? - answerOrphan accounts
How is confidentiality different from privacy? - answerConfidentiality relates to the
control of information in order to prevent disclosure to unauthorized entities.
, How can integrity be enforced or assessed across an entire computer system? -
answerCompare a baseline of hardware settings and software configuration against a
live system.
What is the most important foundational security concept upon which most other
security ideas and solutions are based? - answerImplicit deny
Which term is used to indicate the function of access control or define which subjects
can perform various tasks on specific objects? - answerAuthorization
What are the three categories of controls? - answerPhysical, logical (technical), and
administrative
Why do employees have to read and sign an Authorized Use Policy (AUP) before they
are granted access to the IT network? - answerTo remind them of their responsibilities
and that they will be held accountable for their activities
Why are locks used on doors in secured areas? - answerTo keep people honest
Which of the following best describes the time that it takes to register with a biometric
system, by providing samples of a personal characteristic? - answerEnrollment time
Which of the following is true about biometric scan technology? - answerA number of
points extracted from the item scanned are stored.
Crossover error rate (CER) refers to which of the following graphical intersections? -
answerFalse rejection rate and false acceptance rate
Why is multifactor authentication considered more secure than single-factor
authentication? - answerMultifactor authentication requires multiple distinct attacks to
perform impersonation.
Which of the following is a goal of integrity? - answerData should not change between
sender and receiver
Which of the following best describes privileged users? - answerThey are super-users
or administrators
Which of the following best describes session level controls? - answerLog-off due to the
user inactivity
Authorization for multiple applications using one set of credentials is best described by
which of the following? - answerSingle Sign-on
Which of the following best describes a password that changes on each logon? -
answerDynamic password
