SSCP Practice Test

SSCP Practice Test practice questions, page 39 of 43, with answer review and explanations.

Question 191

Logical or technical controls involve the restriction of access to systems and the protection of information. Which of the following statements pertaining to these types of controls is correct?

  1. Examples of these types of controls include policies and procedures, security awareness training, background checks, work habit checks but do not include a review of vacation history, and also do not include increased supervision.
  2. Examples of these types of controls do not include encryption, smart cards, access lists, and transmission protocols.
  3. Examples of these types of controls are encryption, smart cards, access lists, and transmission protocols.
  4. Examples of these types of controls include policies and procedures, security awareness training, background checks, work habit checks, a review of vacation history, and increased supervision.

Question 192

Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplished:

  1. through access control mechanisms that require identification and authentication and through the audit function.
  2. through logical or technical controls involving the restriction of access to systems and the protection of information.
  3. through logical or technical controls but not involving the restriction of access to systems and the protection of information.
  4. through access control mechanisms that do not require identification and authentication and do not operate through the audit function.

Question 193

In Discretionary Access Control the subject has authority, within certain limitations,

  1. but he is not permitted to specify what objects can be accessible and so we need to get an independent third party to specify what objects can be accessible.
  2. to specify what objects can be accessible.
  3. to specify on a aggregate basis without understanding what objects can be accessible.
  4. to specify in full detail what objects can be accessible.

Question 194

In non-discretionary access control using Role Based Access Control (RBAC), a central authority determines what subjects can have access to certain objects based on the organizational security policy. The access controls may be based on:

  1. The societies role in the organization
  2. The individual's role in the organization
  3. The group-dynamics as they relate to the individual's role in the organization
  4. The group-dynamics as they relate to the master-slave role in the organization

Question 195

In an organization where there are frequent personnel changes, non-discretionary access control using Role Based Access Control (RBAC) is useful because:

  1. people need not use discretion
  2. the access controls are based on the individual's role or title within the organization.
  3. the access controls are not based on the individual's role or title within the organization
  4. the access controls are often based on the individual's role or title within the organization