WGU C845 SSCP Questions with Verified Answers (Correct Update)
Question 1: During what phase of the change management process does the organization
conduct peer review of the change for accuracy and completeness?
Answer: Analysis/Impact Assessment
Question 2: Steve is responsible for work stations that handle proprietary information. What is
the best option for these workstations at the end of their lifecycle?
Answer: Sanitization
Question 3: What is the earliest stage of a fire to use detection technology to identify it?
Answer: Incipient
Question 4: What security control would provide the best defense against a threat actor trying
to execute a buffer overflow attack against a custom application?
Answer: Parameter Checking/Input Validation
Question 5: Which of the following is NOT true of the ISC2 Code of Ethics?
A. Adherence to the Code of Ethics is a condition of Certification
B. The code of ethics applies to all security professionals
C. Failure to comply with the Code of Ethics could result in revocation of certification
D. Members who observe a breach of the Code of Ethics are required to report the possible
violation
Answer: B.
Question 6: Under what type of software license does the recipient of software have an unlimited
right to copy, modify, distribute, or resell a software package?
Answer: Public Domain
Question 7: What should Steve do if a FAR/FRR diagram does not provide an acceptable
performance level for his organization's needs?
Answer: Assess other biometric systems to compare them since the CER is used to assess biometric
devices.
Page 1
,Question 8: What is the CER in biometric device measurment?
Answer: Crossover Error Rate is the number that results when a biometric device is adjusted to
provide equal false acceptance and false rejection rates.
Question 9: What type of access control would be the best choice for a person that would like to
support a declaration like "Only allow access to customer service on managed devices on the
wireless network between 8 am and 7 pm"?
Answer: Attribute Based Access Control ABAC
Question 10: What is the benefit of an ABAC over a RBAC?
Answer: An ABAC can be more specific thus more flexible
Question 11: What is the primary advantage of decentralized access control?
Answer: It provides control of access to people closer to the resources
Question 12: How are rules set in ABAC systems?
Answer: Uses boolean logic statements which allow it to be more flexible than RBAC for temporary
rules such as to allow time limited access.
Question 13: Which of the following is best described as an access control model that focuses on
subjects and identifies the objects that each subject can access?
A. Access control list
B. Capability Table
C. Implicit denial list
D. Rights Management Matrix
Answer: B
Question 14: Adam is accessing a standalone file server using a username and password
provided by the server administrator. Which one of the following entities is guaranteed to have
information necessary to complete the authorization process?
A. File Server
B. Adam
C. Server Administrator
D. Adam's Supervisor
Answer: A. The file server has the correct information on what activities Adam is AUTHORIZED to
perform
Page 2
, Question 15: A new member at a 24 hour gym that uses fingerprints to gain access after hours is
surprised to find out that he is registering as a different member. What type of biometric factor
error occurred?
Answer: Since he was accepted as a different member this was a Type 2 (false positive) error. If he
was not accepted and the door remained locked it would have been a Type 1 (false negative) error.
Question 16: You are tasked with adjusting your organizations password requirements to make
them align with best practices from NIST. What should you set password expiration to?
Answer: NIST Special Publication 800-63b suggests that organizations should not impose password
expiration requirements on end users
Question 17: What access control scheme labels subjects and objects and allows subjects to
access objects when labels match?
Answer: Mandatory Access Control (MAC)
Question 18: Mandatory Access Control is based on what type of model?
Answer: Lattice Based
Question 19: You need to create a trust relationship between your company and a vendor. You
need to implement the system so that it will allow users from the vendor's organization to access
your accounts payable system using the accounts created for them by the vendor. What type of
authentication do you need to implement?
Answer: This type of authentication, where one domain trusts users from another domain, is called
federation.
Question 20: Users change job positions quite often at your new company. Which type of access
control would make it easier to allow administrators to adjust permissions when these changes
occur?
A. Role-Based Access Control
B. Mandatory Access Control
C. Discretionary Access Control
D. Rule-Based Access Control
Answer: A Role-Based Access Control would assign permission to roles and then the administrator
would simply adjust the role of the user when he or she changes jobs
Page 3
Question 1: During what phase of the change management process does the organization
conduct peer review of the change for accuracy and completeness?
Answer: Analysis/Impact Assessment
Question 2: Steve is responsible for work stations that handle proprietary information. What is
the best option for these workstations at the end of their lifecycle?
Answer: Sanitization
Question 3: What is the earliest stage of a fire to use detection technology to identify it?
Answer: Incipient
Question 4: What security control would provide the best defense against a threat actor trying
to execute a buffer overflow attack against a custom application?
Answer: Parameter Checking/Input Validation
Question 5: Which of the following is NOT true of the ISC2 Code of Ethics?
A. Adherence to the Code of Ethics is a condition of Certification
B. The code of ethics applies to all security professionals
C. Failure to comply with the Code of Ethics could result in revocation of certification
D. Members who observe a breach of the Code of Ethics are required to report the possible
violation
Answer: B.
Question 6: Under what type of software license does the recipient of software have an unlimited
right to copy, modify, distribute, or resell a software package?
Answer: Public Domain
Question 7: What should Steve do if a FAR/FRR diagram does not provide an acceptable
performance level for his organization's needs?
Answer: Assess other biometric systems to compare them since the CER is used to assess biometric
devices.
Page 1
,Question 8: What is the CER in biometric device measurment?
Answer: Crossover Error Rate is the number that results when a biometric device is adjusted to
provide equal false acceptance and false rejection rates.
Question 9: What type of access control would be the best choice for a person that would like to
support a declaration like "Only allow access to customer service on managed devices on the
wireless network between 8 am and 7 pm"?
Answer: Attribute Based Access Control ABAC
Question 10: What is the benefit of an ABAC over a RBAC?
Answer: An ABAC can be more specific thus more flexible
Question 11: What is the primary advantage of decentralized access control?
Answer: It provides control of access to people closer to the resources
Question 12: How are rules set in ABAC systems?
Answer: Uses boolean logic statements which allow it to be more flexible than RBAC for temporary
rules such as to allow time limited access.
Question 13: Which of the following is best described as an access control model that focuses on
subjects and identifies the objects that each subject can access?
A. Access control list
B. Capability Table
C. Implicit denial list
D. Rights Management Matrix
Answer: B
Question 14: Adam is accessing a standalone file server using a username and password
provided by the server administrator. Which one of the following entities is guaranteed to have
information necessary to complete the authorization process?
A. File Server
B. Adam
C. Server Administrator
D. Adam's Supervisor
Answer: A. The file server has the correct information on what activities Adam is AUTHORIZED to
perform
Page 2
, Question 15: A new member at a 24 hour gym that uses fingerprints to gain access after hours is
surprised to find out that he is registering as a different member. What type of biometric factor
error occurred?
Answer: Since he was accepted as a different member this was a Type 2 (false positive) error. If he
was not accepted and the door remained locked it would have been a Type 1 (false negative) error.
Question 16: You are tasked with adjusting your organizations password requirements to make
them align with best practices from NIST. What should you set password expiration to?
Answer: NIST Special Publication 800-63b suggests that organizations should not impose password
expiration requirements on end users
Question 17: What access control scheme labels subjects and objects and allows subjects to
access objects when labels match?
Answer: Mandatory Access Control (MAC)
Question 18: Mandatory Access Control is based on what type of model?
Answer: Lattice Based
Question 19: You need to create a trust relationship between your company and a vendor. You
need to implement the system so that it will allow users from the vendor's organization to access
your accounts payable system using the accounts created for them by the vendor. What type of
authentication do you need to implement?
Answer: This type of authentication, where one domain trusts users from another domain, is called
federation.
Question 20: Users change job positions quite often at your new company. Which type of access
control would make it easier to allow administrators to adjust permissions when these changes
occur?
A. Role-Based Access Control
B. Mandatory Access Control
C. Discretionary Access Control
D. Rule-Based Access Control
Answer: A Role-Based Access Control would assign permission to roles and then the administrator
would simply adjust the role of the user when he or she changes jobs
Page 3
