1.2 - Understand Security Concepts SSCP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization transmits patient lab results to a partner lab. The organization needs to ensure the results are not altered during transmission and that the partner can verify the data came from the organization. Which control should be implemented?

   • AEncrypt the data with the partner's public key before transmission.
   • BDigitally sign the data with the organization's private key before transmission.
   • CTransmit the data over a VPN tunnel.
   • DUse a checksum calculated by the organization and sent in a separate email.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A software vendor distributes firmware updates to its customers. A customer reports that a downloaded update was rejected by the device. The vendor wants to prove that the update was genuinely created by the vendor and that it was not modified during download. Which mechanism should the vendor use?

   • ARequire customers to log in with multi-factor authentication before downloading.
   • BEncrypt the firmware with a symmetric key shared with all customers.
   • CDigitally sign the firmware with the vendor's private key and have the device verify it with the vendor's public key.
   • DPublish a hash of the firmware on the vendor's website.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A bank's loan department has three employees: one who approves loans, one who disburses funds, and one who reconciles the accounts. The bank wants to prevent an employee from approving a loan and then disbursing funds to themselves. Which control is most effective?

   • AGrant all three employees full access to the loan system.
   • BRequire the loan approver to also perform the account reconciliation.
   • CImplement a policy that prohibits employees from approving their own loans.
   • DEnsure that the loan-approval and fund-disbursement functions are performed by different employees.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization is investigating a security incident where a user allegedly deleted critical files. The system has audit logging, but the logs are stored on the same server as the files. The security team wants to ensure the logs are admissible as evidence. Which action is most important to preserve the integrity and accountability of the logs?

   • AEmail the logs to the security team for safekeeping.
   • BPrint the logs and store them in a locked filing cabinet.
   • CCopy the logs to a write-once, read-many (WORM) storage device and timestamp them with a trusted time source.
   • DCompress the logs to save space and store them on the same server.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A research organization stores sensitive data on a shared network drive. The organization wants to ensure that only the research team can access the data, but the team members frequently work remotely and need access from various devices. The organization also wants to protect the data if a laptop is stolen. Which combination of controls best addresses confidentiality and availability?

   • AAllow access only from company-issued laptops that are not encrypted.
   • BRequire multi-factor authentication (MFA) for network access and encrypt the data on the shared drive with a key managed by the organization.
   • CDisable remote access to the shared drive to prevent unauthorized access.
   • DUse a shared password for the research team to simplify access.
   Reveal Solution Discussion Select an answer first