ISC2 SSCP Practice Test

Answer choices

1. A. Mandatory access control (MAC) with centrally enforced labels and clearances.
2. B. Discretionary access control (DAC), because owners can grant access so long as the recipient already holds an appropriate clearance.
3. C. Role-based access control (RBAC), with roles named for each clearance level and owners permitted to share within the role.
4. D. Attribute-based access control (ABAC), evaluating clearance and classification as attributes while allowing resource owners to override the policy.

Wrong-answer review

• B. Discretionary access control (DAC), because owners can grant access so long as the recipient already holds an appropriate clearance.: Choosing “Discretionary access control (DAC), because owners can grant access so long as the recipient already holds an…” would apply the wrong distinction: dAC gives the resource owner discretion to grant access, which directly conflicts with the requirement that owners cannot override centrally enforced classification policy. MAC is appropriate when centrally defined security labels and clearances constrain access and owners cannot arbitrarily override policy.
• C. Role-based access control (RBAC), with roles named for each clearance level and owners permitted to share within the role.: “Role-based access control (RBAC), with roles named for each clearance level and owners permitted to share within the…” addresses a related concern, but rBAC maps permissions to job/organizational roles, but the repository requires centrally enforced classification labels and clearances that owners cannot bypass. MAC is appropriate when centrally defined security labels and clearances constrain access and owners cannot arbitrarily override policy.
• D. Attribute-based access control (ABAC), evaluating clearance and classification as attributes while allowing resource owners to override the policy.: Choosing “Attribute-based access control (ABAC), evaluating clearance and classification as attributes while allowing resource…” would apply the wrong distinction: aBAC can evaluate classification and clearance as attributes, but allowing owner override defeats the centrally enforced no-discretion requirement that defines the MAC scenario. MAC is appropriate when centrally defined security labels and clearances constrain access and owners cannot arbitrarily override policy.

Answer choices

1. A. Refuse all further work on the platform because accepting any task outside one's specialty violates the Code, with the conflict and disposition retained for review.
2. B. State the limits of the completed review, decline to attest beyond demonstrated competence, and request qualified review for the unassessed requirements.
3. C. Sign the statement because management owns the residual risk and can accept any deficiencies later.
4. D. Sign only after adding a private note to the SSCP's workpapers that the safety controls were not reviewed.

Answer choices

1. A. Ask reviewers to approve only direct group memberships and treat inherited rights as valid by default, retaining the associated access events for later review.
2. B. Flatten all groups into one enterprise-wide access group so inheritance is easier to understand.
3. C. Expose effective permissions and their inheritance path to reviewers, tie group membership to defined business roles/owners, and require review of the resulting entitlements.
4. D. Replace access reviews with MFA because strong authentication makes inherited entitlements less risky.

Answer choices

1. A. Identify applicable legal, regulatory, contractual, privacy, and jurisdictional requirements for the data locations and access model, with qualified legal/privacy stakeholders.
2. B. Approve the service because encryption makes data-location requirements irrelevant.
3. C. Reject non-U.S. data centers as a precautionary default until counsel confirms cross-border processing is permitted, and preserve related evidence under approved handling procedures.
4. D. Base approval only on whether the provider has a well-known security certification.

Answer choices

1. A. Place the cluster on the general server VLAN but enable more verbose flow logging so investigators can reconstruct any movement later, with the segmentation policy recorded in the network baseline.
2. B. Place the cluster in a dedicated security zone or micro-segment and explicitly permit only required management, storage, update, and telemetry flows with authenticated administration.
3. C. Allow unrestricted east-west traffic but require TLS for every connection because encryption prevents lateral movement.
4. D. Move the cluster behind the public web proxy so all internal server communications use a single egress path.

Answer choices

1. A. Normalize and rewrite the logs into a single analyst-friendly format before hashing them so later reviewers see consistent records, with collection activity recorded in the chain-of-custody documentation.
2. B. Allow each analyst to keep a personal copy because independent copies improve resilience even if transfers are undocumented.
3. C. Preserve the original evidence, record acquisition details and handlers, verify integrity with appropriate hashes, maintain chain of custody, and analyze working copies.
4. D. Retain only the model's final decision because the underlying inputs and policy records are unnecessary once the outcome is known.

Answer choices

1. A. Disable disk encryption because encrypted storage prevents MAM from classifying data.
2. B. Increase device screen-lock complexity because authentication controls clipboard destinations, and enforce the policy through the managed-device platform.
3. C. Revoke Wi-Fi access because the leak occurs between applications on the same device.
4. D. Use managed application/data-loss controls to restrict inter-app data transfer between managed and unmanaged contexts while preserving approved workflows.

Answer choices

1. A. The 256-bit output length is sufficient because repeating the seed expands the key to the nominal size expected by the cipher.
2. B. The main weakness is key storage; placing the generated key in an HSM would compensate for the predictable seed.
3. C. Frequent rotation would compensate for the predictable seed because each weak key would remain valid for only a short cryptoperiod.
4. D. The effective entropy is limited by the predictable 32-bit seed; nominal key length does not compensate for weak key generation.

Answer choices

1. A. Select and verify a sanitization method appropriate to the media and data sensitivity that renders target data infeasible to recover, then document the disposition.
2. B. Physically inventory the drives and transfer them to the recycler without sanitization because chain-of-custody records are sufficient.
3. C. Quick-format each volume and rely on the absence of directory entries as proof of destruction.
4. D. Delete the encryption keys as the sanitization method, assuming key deletion is adequate even though cryptographic-erase support has not been verified on the device.

Answer choices

1. A. Treat the previous attestation as sufficient because supplier risk is reassessed only on a fixed annual schedule, and include the result in the authorized assessment report.
2. B. Reassess the supplier risk and contractual/security dependencies affected by the architecture and subprocessors rather than waiting for the next annual review.
3. C. Terminate the supplier immediately because any architectural change increases risk.
4. D. Run an internal vulnerability scan against the supplier's internet services without authorization.