ISC2-SSCP Practice Questions

Reviewing system access audit records is a classic example of a detective security control. The primary purpose of this activity is to identify security events, policy violations, or unusual activities after they have occurred. The logs provide a record of past events, and their analysis allows security personnel to detect potential or actual security incidents that were not stopped by preventative controls. This function is about discovery and investigation, not prevention or deterrence.

A. avoidance: Avoidance is a risk management strategy that involves eliminating the activity or asset that creates the risk, not monitoring it.

B. deterrence: Deterrence aims to discourage an attacker from attempting an action. While the knowledge of log reviews can be a deterrent, the act of reviewing itself is detective.

C. prevention: Prevention aims to stop an incident from occurring in the first place (e.g., a firewall). Log review is a post-event analysis.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. The control family AU (Audit and Accountability)

specifically control AU-6 "Audit Record Review

Analysis

and Reporting

" describes the process of reviewing logs to detect "inappropriate or unusual activity." This function is inherently detective in nature. (See Section 2

Control Family AU-6).

2. Purdue University

"Information Security and Privacy

" Types of Controls. The documentation defines detective controls as those "used to detect and report the occurrence of an error

omission or malicious act." It lists "reviewing audit trails and logs" as a specific example of a detective control. (See Section: "Types of Controls

" Subsection: "Detective").

3. University of California

Berkeley

Security Policy

Glossary of Terms. Defines Detective Controls as: "Controls designed to detect

report

and recover from a security breach. Examples include audit trails

intrusion detection systems

and virus detection software." The review of audit trails (records) fits this definition directly. (See "Detective Controls" definition in the glossary).

The implementation of a contingency plan begins after a Business Impact Analysis (BIA) has identified the organization's most critical assets. In virtually all modern organizations, data is the most critical and irreplaceable asset. While operating systems, applications, and firmware are essential for functionality, they can typically be restored from vendor media or standard images. Organizational data, however, is unique and its loss can be catastrophic. Therefore, the foundational and primary step in implementing the technical controls of a contingency plan is to ensure that this critical data is securely and regularly backed up. This action directly addresses the highest-priority risk identified by the BIA.

A. A firmware backup: Firmware is important but changes infrequently and is specific to hardware. It is not considered the primary or initial asset to protect in a general contingency plan.

C. An operating systems software backup: While necessary for recovery, the OS can often be rebuilt from standardized images or installation media, making its backup a secondary priority to unique organizational data.

D. An application software backup: Similar to the OS, applications can typically be reinstalled from original sources. The data generated and used by these applications is far more critical to protect first.

1. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Page 26

Section 4.2.1

Data Backup: "Data backup is a primary component of any contingency strategy. The BIA should be used to determine the appropriate backup requirements for the system data." This establishes data backup as a primary and foundational element driven by the BIA

which is the precursor to implementation.

2. Swanson

M.

Bowen

P.

Phillips

A. W.

Gallup

D.

& Lynes

D. (2010). Contingency Planning Guide for Federal Information Systems (NIST SP 800-34 Rev. 1). National Institute of Standards and Technology.

Page 17

Section 3.2

Business Impact Analysis (BIA): The guide explains that the BIA's purpose is to "identify and prioritize critical IT systems and components." The output of the BIA directly informs the implementation of protective measures

with the highest-priority components (typically data) being addressed first.

3. University of California

Berkeley

Information Security Office. Business Continuity Planning & Disaster Recovery.

In their guidance on Business Continuity

the focus is consistently placed on identifying critical functions and the data required to support them. The section on "Recovery Strategies" implicitly prioritizes data by discussing Recovery Point Objectives (RPO)

which is a measure of data loss tolerance

making data backup and recovery the central implementation concern.

4. Snedaker

S. (2013). Business Continuity and Disaster Recovery Planning for IT Professionals. Syngress. (Academic/Professional Textbook).

Chapter 5

"Business Impact Analysis": This chapter details how the BIA identifies critical business processes and the assets that support them. The text consistently emphasizes that data is the asset upon which processes depend

making its protection the logical first step in implementing recovery solutions. The entire strategy is built around protecting and recovering data.

Single Sign-on (SSO) offers two primary advantages. The most visible benefit is convenience for the end-user, who only needs to authenticate once with a single set of credentials to access multiple applications and services. The second, equally important advantage is centralized administration. SSO systems rely on a central Identity Provider (IdP) to manage user identities, credentials, and authentication policies. This centralization simplifies administrative tasks such as user provisioning, password resets, and revoking access, thereby improving security posture and reducing administrative overhead.

A. Convenience: This option is correct but incomplete. It only captures the user-facing benefit and omits the critical advantage of centralized management for administrators.

C. Convenience and centralized data administration: This is incorrect because SSO centralizes the administration of identities and access, not the application-specific data, which remains under the control of individual service providers.

D. Convenience and centralized network administration: This is incorrect. SSO is an Identity and Access Management (IAM) function, which is distinct from network administration that deals with infrastructure like routers, switches, and firewalls.

1. NIST Special Publication 800-63-3

Digital Identity Guidelines. Section 4.3

"Federated Identity and Single Sign-On

" describes how federation (the underlying technology for many SSO systems) improves the user experience (convenience) and allows for the centralized management of authentication and user attributes by an Identity Provider.

2. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). In Chapter 4

"Access Control

" the text discusses SSO systems like Kerberos and federated identity management. It explains that these systems are designed to provide a single login for users while centralizing the authentication service

which is a form of centralized administration.

3. University of California

Berkeley

Information Security Office. (n.d.). Single Sign-On (SSO). The documentation explains that SSO "improves user experience by reducing password fatigue" (convenience) and "strengthens security by providing administrators a central point of control over user authentication." This directly supports both aspects of the correct answer.

Iris scanners operate by capturing a detailed image of the iris using a near-infrared (NIR) camera. The performance of these optical sensors is highly susceptible to ambient lighting conditions. Direct sunlight contains a strong infrared component that can saturate the camera's sensor, causing glare, specular reflections off the cornea, and a washed-out image. This prevents the system from acquiring a high-quality image of the iris pattern, leading to failures in enrollment or verification. Therefore, a critical aspect of the physical installation is to position the device away from direct sunlight or other intense light sources to ensure its operational reliability and accuracy.

A. Modern iris scanners use low-intensity near-infrared (NIR) light-emitting diodes (LEDs), not lasers. These systems are designed to comply with international eye safety standards, making eye damage a common misconception, not a practical installation problem.

B. The iris pattern is phenotypically unique and remains remarkably stable after the first few years of life. This stability is a fundamental strength of iris recognition, not a problem.

C. Iris recognition is renowned for having one of the lowest false acceptance rates (FAR) among all biometric modalities. Its high accuracy and resistance to false matches are key advantages.

1. Jain

A. K.

Ross

A. A.

& Nandakumar

K. (2011). Introduction to Biometrics. Springer. In Chapter 4

"Iris Recognition

" Section 4.5

"Challenges

" it is noted that a significant challenge is the "Poor quality of the iris image due to... improper illumination" (p. 129). This directly supports that external light sources like the sun are a problem.

2. Daugman

J. (2004). How iris recognition works. IEEE Transactions on Circuits and Systems for Video Technology

14(1)

21-30. https://doi.org/10.1109/TCSVT.2003.818350. The paper explains that the system uses NIR illumination (700-900 nm) and that "specular reflections from the cornea" (p. 23) can obscure the iris. Direct sunlight would create extreme specular reflections

corrupting the image.

3. Bowyer

K. W.

Hollingsworth

K. P.

& Flynn

P. J. (2008). Image understanding for iris biometrics: A survey. Computer Vision and Image Understanding

110(2)

281-307. https://doi.org/10.1016/j.cviu.2007.08.005. Section 5

"Factors that Complicate Iris Recognition

" discusses how "lighting can cause specular reflections on the cornea or on glasses/contacts that occlude part of the iris" (p. 297). This highlights the sensitivity of the optical system to external light

a key factor in physical installation.

Encryption and access-control mechanisms are classified by their function (preventive—they stop unauthorized disclosure or use before it occurs) and by their nature (technical—implemented in hardware, firmware, or software and therefore called logical controls). When a security control is both technical and designed to prevent an unwanted event, it is termed a Preventive/Technical control.

A. Administrative controls are policy, procedure, or people driven, not encryption or OS-level access checks.

C. Physical controls are tangible barriers (locks, guards); encryption and logical ACLs are non-physical.

D. Detective controls signal that an event has happened (e.g., audit logs); encryption and access control act before the violation, not after.

1. (ISC)²

SSCP Systems Security Certified Practitioner Official CBK

3rd ed.

2019

Chapter 3 “Security Controls”

pp. 94-96 – defines technical (logical) controls and lists encryption & access control as preventive.

2. NIST Special Publication 800-12 Rev.1

“An Introduction to Information Security

” Sect. 3.3.2 & Table 3-1

pp. 3-8–3-9 – classifies security controls by type (technical) and function (preventive).

3. NIST SP 800-53 Rev.5

“Security and Privacy Controls

” Appendix C

Control Families AC and SC – describes Access Control (AC) and System & Communications Protection (encryption) as technical preventive measures.

The controls described, such as sensors and cameras, are tangible objects that exist in the physical world, classifying them as physical controls. Their primary function in this scenario is to monitor an environment and alert personnel to a potential threat, which is a detective function. The requirement for a human to evaluate the data from these devices to confirm a threat solidifies this classification. The system is designed to detect and report an event, not to prevent it from happening initially.

A. Preventive/physical: This is incorrect because the function described is detecting a potential threat, not preventing it. A preventive physical control would be a fence or a locked door.

B. Detective/technical: This is incorrect because while the function is detective, cameras and sensors are categorized as physical controls, not technical (or logical) controls like an Intrusion Detection System (IDS) or firewall logs.

D. Detective/administrative: This is incorrect because the controls themselves (sensors, cameras) are physical devices. Administrative controls are policies, procedures, and guidelines, such as the procedure for a guard to follow when an alarm is triggered.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. The "Physical and Environmental Protection" (PE) control family details controls like surveillance equipment. Specifically

control PE-6 (Monitor Physical Access) describes the use of surveillance systems to "monitor and record physical access to the facility where the system resides." This is a physical control with a detective function. (See Appendix F

Control Family: PE).

2. Hernandez

S. (2021). Official (ISC)² Guide to the SSCP CBK

5th Edition. Sybex. Chapter 1

"Security Operations and Administration

" defines the categories of security controls. It classifies controls by type (physical

technical

administrative) and by function (preventive

detective

corrective). CCTV cameras and motion sensors are provided as examples of physical controls

and their use for monitoring is described as a detective function. (See Chapter 1

"Understand and Apply Security Concepts

" Section: "Control Types").

3. Harris

S.

& Maymi

F. (2022). CISSP All-in-One Exam Guide

9th Edition. McGraw-Hill. While a CISSP resource

the fundamental security concepts are identical to SSCP. Chapter 1

"Security and Risk Management

" clearly defines control types. It states

"CCTV is a detective physical control... It doesn't prevent access

but it can detect unauthorized access and record it for later review." (See Chapter 1

"Security Controls

" Section: "Control Types").

Evaluation is the systematic and detailed technical process of examining and testing an IT system or product's security features against a formal set of criteria. The goal is to verify that the security controls are implemented correctly, operate as intended, and are effective in meeting security requirements without introducing vulnerabilities. This process provides the technical evidence needed for further assurance activities. The question's description of a "detailed examination and testing...to ensure they work correctly and effectively" precisely defines the act of security evaluation.

A. Acceptance testing: This testing focuses on verifying that a system meets the user's or customer's business requirements and is ready for operational use, which is different from a detailed security feature examination.

C. Certification: This is the formal attestation or declaration that a system has successfully undergone an evaluation and meets a specified set of security requirements. It is the result of the evaluation, not the process itself.

D. Accreditation: This is the official management decision to authorize the operation of an IT system. This decision is based on the risk acceptance after reviewing the results of the certification and evaluation process.

1. National Institute of Standards and Technology (NIST) Special Publication 800-37

Revision 2

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. December 2018.

Section 2.3

"RMF Step 4: Assess

" describes the assessment (evaluation) process: "The purpose of the assessment step is to determine if the controls selected for implementation are implemented correctly

operating as intended

and producing the desired outcome with respect to meeting the security and privacy requirements for the system and the organization." (Page 21). This aligns directly with the question's definition.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53A

Revision 4

Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans. December 2014.

Appendix D

"Glossary

" defines Assessment as "The testing or evaluation of the management

operational

and technical security controls in an information system to determine the extent to which the controls are implemented correctly

operating as intended

and producing the desired outcome with respect to meeting the security requirements for the system." (Page D-1).

3. Solomon

M. G.

& Chapple

M. (2021). (ISC)2 SSCP Systems Security Certified Practitioner Official Study Guide & Practice Tests Bundle (3rd ed.). Sybex.

Chapter 1

"Security Operations and Administration

" distinguishes the terms. It explains that certification is the technical evaluation of a system (the process)

while accreditation is the management approval to operate the system (the decision). The term "evaluation" is used to describe the technical testing portion of the certification process. The question specifically asks about the "detailed examination and testing

" which is the core of the evaluation.

A one-way hash is a cryptographic function that meets all the criteria described. It takes an input of arbitrary length (a string of characters) and produces a fixed-length string, known as a hash value or message digest. The core properties of a cryptographic hash function are that it is deterministic (the same input always produces the same output), fast to compute, and, crucially, "one-way." This one-way property, also known as preimage resistance, makes it computationally infeasible to determine the original input string from its hash value, meaning the transformation cannot be reversed.

B. DES: This is a symmetric-key encryption algorithm. It is a two-way, reversible process used for confidentiality, not a one-way transformation.

C. Transposition: A classical encryption cipher that rearranges the order of characters. It is reversible and does not produce a fixed-length output.

D. Substitution: A classical encryption cipher that replaces characters with other characters. It is also reversible and does not produce a fixed-length output.

1. National Institute of Standards and Technology (NIST). (2015). FIPS PUB 180-4

Secure Hash Standard (SHS). Section 1

"Introduction

" states

"A hash algorithm is used to compute a condensed representation of a message or a data file... For a given algorithm

the message digests are of a fixed length..."

2. Katz

J.

& Lindell

Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. In Chapter 5

Section 5.1

a hash function is defined as a function that maps arbitrary-length strings to a fixed-length output. The property of being "one-way" is formally defined as preimage resistance.

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 11

Section 11.1

"Secure Hash Algorithms

" describes the fundamental requirements for a cryptographic hash function

including the one-way property (preimage resistance) and the production of a fixed-length hash value.

The most critical step to ensure a new software application's security and compatibility is to conduct a thorough security assessment. This process directly verifies that the software adheres to the organization's security policies, is free from known vulnerabilities, and integrates securely with existing systems. An assessment may include static and dynamic application security testing (SAST/DAST), penetration testing, and a review of the software's architecture. This proactive measure identifies and mitigates risks before the software is deployed, which is the primary goal stated in the scenario.

A. Performing a Cost-Benefit Analysis: This evaluates the financial justification for the purchase and is a business function, not a technical security verification step.

C. Reviewing the Software's User Interface Design: This focuses on usability and user experience, which are separate from the core security and vulnerability posture of the application's code and architecture.

D. Negotiating the Software Licensing Agreement: This is a legal process to define terms, conditions, and liability. While it can mandate security standards, it does not technically verify them.

1. NIST Special Publication 800-161 Revision 1

Supply Chain Risk Management Practices for Federal Information Systems and Organizations. Section 3.3.3

"Acquisition Processes

" states that organizations should integrate supply chain risk management activities

including "performing security assessments of candidate products

" directly into their acquisition processes.

2. NIST Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control SA-4

"Acquisition Process

" explicitly requires organizations to include security requirements

specifications

and criteria in acquisition contracts and to assess services and products to ensure these requirements are met.

3. Mead

N. R. (2010). A Guide to Security Metrics in the Software Development Lifecycle. Carnegie Mellon University

Software Engineering Institute. CMU/SEI-2010-TN-029. This guide emphasizes that security testing and verification activities are essential checkpoints

particularly when acquiring external software

to ensure it meets security acceptance criteria before integration (pp. 15-17).

Simple Mail Transfer Protocol (SMTP) is the fundamental Internet standard protocol used for transmitting electronic mail (e-mail) across IP networks. It functions as the Message Transfer Agent (MTA) by pushing or relaying messages from a sending mail server to a receiving mail server. When a user sends a message, their mail client submits it to their server via SMTP, and that server then uses SMTP to transfer the message to the recipient's server. This server-to-server communication is the defining role of an MTA.

B. SNMP: Simple Network Management Protocol is used for managing and monitoring network devices; it does not handle email transfer.

C. S-RPC: Secure Remote Procedure Call is a protocol for executing code on a remote machine, not for transferring email messages.

D. S/MIME: This standard provides end-to-end security for email content through encryption and digital signatures, but it is not the transport protocol.

1. Klensin

J. (2008). RFC 5321: Simple Mail Transfer Protocol. IETF. Section 1

"Introduction

" states

"The objective of the Simple Mail Transfer Protocol (SMTP) is to transfer mail reliably and efficiently." Section 2.1

"Overall Structure

" describes the MTA's role in transferring mail.

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 2

Section 2.4

"Electronic Mail in the Internet

" the text explicitly identifies SMTP as the principal application-layer protocol for Internet electronic mail and the protocol used between mail servers (MTAs) to transfer email messages.

3. Ramsdell

B. (2004). RFC 3851: Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1 Message Specification. IETF. The abstract defines S/MIME as a method for "providing cryptographic security services for electronic messaging applications

" distinguishing it from transport protocols.