A company uses a third-party API to process payments. The API requires an API key, but the company is concerned about the security of the key. Which of the following is the most effective way to protect the API key?

Embed the API key in the application code.

Share the API key with all developers for convenience.

Use the API key only over HTTP to avoid encryption overhead.

Store the API key in a secure vault and retrieve it at runtime.

A company uses a third-party API to synchronize data between its CRM and marketing automation tool. The API uses OAuth 2.0 with scopes. The company wants to ensure that the API only has access to the necessary data. Which of the following is the most important control?

Use API keys instead of OAuth for simplicity.

Use the least privilege principle when defining OAuth scopes.

Use a long-lived access token to avoid frequent re-authentication.

Use the same scope for all API operations.

A company wants to allow its employees to access a partner's extranet portal. The partner requires that the company's employees authenticate using their corporate credentials. Which of the following is the most appropriate trust architecture?

Provide the partner with a list of employee usernames and passwords.

Create a two-way trust between the company's and partner's domains.

Create a one-way trust from the partner's domain to the company's domain.

Establish a federation trust using SAML or OIDC between the company's identity provider and the partner's identity provider.

A company has a network with an intranet, an extranet, and a DMZ. The intranet is for internal employees, the extranet is for business partners, and the DMZ contains public-facing servers. Which of the following is the most appropriate trust boundary?

The extranet has the highest trust, followed by the intranet, then the DMZ.

All three networks have the same trust level.

The intranet has the highest trust, followed by the extranet, then the DMZ.

The DMZ has the highest trust, followed by the extranet, then the intranet.

A company is designing a network for a new office. They want to allow visitors to access the internet but prevent them from accessing internal resources. Which network architecture should they implement?

Place visitors on the DMZ network.

Place visitors on the same VLAN as employees and rely on host-based firewalls.

Place visitors on the internal network but restrict their IP addresses.

Place visitors on a separate VLAN with a firewall rule that only allows internet access.

Systems Security Certified Practitioner

Domain 2Objective 2

2.2 - Understand and Support Internetwork Trust Architectures SSCP Practice Questions (Page 2)

Part of the Access Controls domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

3concepts

15%of the exam

Questions 6–10

6expert · hard
A company uses a third-party API to process payments. The API requires an API key, but the company is concerned about the security of the key. Which of the following is the most effective way to protect the API key?
Select an answer first
7expert · hard
A company uses a third-party API to synchronize data between its CRM and marketing automation tool. The API uses OAuth 2.0 with scopes. The company wants to ensure that the API only has access to the necessary data. Which of the following is the most important control?
Select an answer first
8application · medium
A company wants to allow its employees to access a partner's extranet portal. The partner requires that the company's employees authenticate using their corporate credentials. Which of the following is the most appropriate trust architecture?
Select an answer first
9expert · hard
A company has a network with an intranet, an extranet, and a DMZ. The intranet is for internal employees, the extranet is for business partners, and the DMZ contains public-facing servers. Which of the following is the most appropriate trust boundary?
Select an answer first
10application · medium
A company is designing a network for a new office. They want to allow visitors to access the internet but prevent them from accessing internal resources. Which network architecture should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.