WGU C845 SSCPQUESTIONS AND
ANSWERS
During9what9phase9of9the9change9management9process9does9the9organization9conduc
t9peer9review9of9the9change9for9accuracy9and9completeness?9-9ans✔Analysis/
Impact9Assessment
Steve9is9responsible9for9work9stations9that9handle9proprietary9information.9What9is9the
9best9option9for9these9workstations9at9the9end9of9their9lifecycle?9-9ans✔Sanitization
What9is9the9earliest9stage9of9a9fire9to9use9detection9technology9to9identify9it?9-
9ans✔Incipient
What9security9control9would9provide9the9best9defense9against9a9threat9actor9trying9to9
execute9a9buffer9overflow9attack9against9a9custom9application?9-
9ans✔Parameter9Checking/Input9Validation
Which9of9the9following9is9NOT9true9of9the9ISC29Code9of9Ethics?
A.9Adherence9to9the9Code9of9Ethics9is9a9condition9of9Certification
B.9The9code9of9ethics9applies9to9all9security9professionals
C.9Failure9to9comply9with9the9Code9of9Ethics9could9result9in9revocation9of9certification
D.9Members9who9observe9a9breach9of9the9Code9of9Ethics9are9required9to9report9the9p
ossible9violation9-9ans✔B.
Under9what9type9of9software9license9does9the9recipient9of9software9have9an9unlimited9
right9to9copy,9modify,9distribute,9or9resell9a9software9package?9-9ans✔Public9Domain
What9should9Steve9do9if9a9FAR/
FRR9diagram9does9not9provide9an9acceptable9performance9level9for9his9organization's
9needs?9-
9ans✔Assess9other9biometric9systems9to9compare9them9since9the9CER9is9used9to9ass
ess9biometric9devices.
What9is9the9CER9in9biometric9device9measurment?9-
9ans✔Crossover9Error9Rate9is9the9number9that9results9when9a9biometric9device9is9adj
usted9to9provide9equal9false9acceptance9and9false9rejection9rates.
,What9type9of9access9control9would9be9the9best9choice9for9a9person9that9would9like9to9
support9a9declaration9like9"Only9allow9access9to9customer9service9on9managed9device
s9on9the9wireless9network9between989am9and979pm"?9-
9ans✔Attribute9Based9Access9Control9ABAC
What9is9the9benefit9of9an9ABAC9over9a9RBAC?9-
9ans✔An9ABAC9can9be9more9specific9thus9more9flexible
What9is9the9primary9advantage9of9decentralized9access9control?9-
9ans✔It9provides9control9of9access9to9people9closer9to9the9resources
How9are9rules9set9in9ABAC9systems?9-
9ans✔Uses9boolean9logic9statements9which9allow9it9to9be9more9flexible9than9RBAC9for
9temporary9rules9such9as9to9allow9time9limited9access.
Which9of9the9following9is9best9described9as9an9access9control9model9that9focuses9on9
subjects9and9identifies9the9objects9that9each9subject9can9access?
A.9Access9control9list
B.9Capability9Table
C.9Implicit9denial9list
D.9Rights9Management9Matrix9-9ans✔B
Adam9is9accessing9a9standalone9file9server9using9a9username9and9password9provided
9by9the9server9administrator.9Which9one9of9the9following9entities9is9guaranteed9to9hav
e9information9necessary9to9complete9the9authorization9process?
A.9File9Server
B.9Adam
C.9Server9Administrator
D.9Adam's9Supervisor9-
9ans✔A.9The9file9server9has9the9correct9information9on9what9activities9Adam9is9AUTH
ORIZED9to9perform
A9new9member9at9a9249hour9gym9that9uses9fingerprints9to9gain9access9after9hours9is9
surprised9to9find9out9that9he9is9registering9as9a9different9member.9What9type9of9biomet
ric9factor9error9occurred?9-
9ans✔Since9he9was9accepted9as9a9different9member9this9was9a9Type929(false9positive
)9error.9If9he9was9not9accepted9and9the9door9remained9locked9it9would9have9been9a9T
ype919(false9negative)9error.
You9are9tasked9with9adjusting9your9organizations9password9requirements9to9make9the
m9align9with9best9practices9from9NIST.9What9should9you9set9password9expiration9to?9-
9ans✔NIST9Special9Publication9800-
63b9suggests9that9organizations9should9not9impose9password9expiration9requirements
9on9end9users
,What9access9control9scheme9labels9subjects9and9objects9and9allows9subjects9to9acce
ss9objects9when9labels9match?9-9ans✔Mandatory9Access9Control9(MAC)
Mandatory9Access9Control9is9based9on9what9type9of9model?9-9ans✔Lattice9Based
You9need9to9create9a9trust9relationship9between9your9company9and9a9vendor.9You9ne
ed9to9implement9the9system9so9that9it9will9allow9users9from9the9vendor's9organization9t
o9access9your9accounts9payable9system9using9the9accounts9created9for9them9by9the9v
endor.9What9type9of9authentication9do9you9need9to9implement?9-
9ans✔This9type9of9authentication,9where9one9domain9trusts9users9from9another9domai
n,9is9called9federation.
Users9change9job9positions9quite9often9at9your9new9company.9Which9type9of9access9c
ontrol9would9make9it9easier9to9allow9administrators9to9adjust9permissions9when9these9
changes9occur?
A.9Role-Based9Access9Control
B.9Mandatory9Access9Control
C.9Discretionary9Access9Control
D.9Rule-Based9Access9Control9-9ans✔A9Role-
Based9Access9Control9would9assign9permission9to9roles9and9then9the9administrator9w
ould9simply9adjust9the9role9of9the9user9when9he9or9she9changes9jobs
Which9of9the9following9authenticators9is9appropriate9to9use9by9itself9rather9than9in9com
bination9with9other9biometric9factors?
A.9Voice9pattern9recognition
B.9Hand9geometry
C.9Palm9scans
D.9Heart/pulse9patterns9-
9ans✔C.9Palm9scans9compare9the9vein9patterns9in9the9palm9to9a9database9to9authenti
cate9a9user.
As9part9of9hiring9a9new9employee,9Sven's9identity9management9team9creates9a9new9u
ser9object9and9ensures9that9the9user9object9is9available9in9the9directories9and9systems
9where9it9is9needed.9What9is9this9process9called?9-
9ans✔Provisioning9includes9the9creation,9maintenance,9and9removal9of9user9objects9fr
om9applications,9systems,9and9directories.
The9Linux9filesystem9allows9the9owners9of9objects9to9determine9the9access9rights9that
9subjects9have9to9them.9What9type9of9access9control9does9Linux9use?9-
9ans✔Discretionary9Access9Control
Mary's9organization9handles9very9sensitive9governmental9agency9information.9They9ne
ed9to9implement9an9access9control9system9that9allows9administrators9to9set9access9rig
hts9but9does9not9allow9the9delegation9of9those9rights9to9other9users.9What9is9the9best9
type9of9access9control9design9for9Mary's9organization?9-
, 9ans✔Mandatory9Access9Control9(MAC)9systems9allow9an9administrator9to9configure9a
ccess9permissions9but9do9not9allow9users9to9delegate9permission9to9others.
What9term9is9used9to9describe9the9default9set9of9privileges9assigned9to9a9user9when9a
9new9account9is9created?
A.9Aggregation
B.9Transitivity
C.9Baseline
D.9Entitlement9-
9ans✔D.9Entitlement9refers9to9the9privileges9granted9to9useres9when9an9account9is9firs
t9provisioned.
Steve9is9the9risk9manager9for9a9company9on9the9east9coast9of9the9United9States.9He9r
ecently9undertook9a9replacement9cost9analysis9and9determined9that9rebuilding9and9rec
onfiguring9the9data9center9would9cost9$209million.9Steve9consulted9with9hurricane9exp
erts,9data9center9specialists,9and9structural9engineers9and9they9determined9that9a9typi
cal9CAT939hurricane9that9successfully9hits9the9east9coast9would9cause9approximately9
$59million9in9damages.9The9meteorologists9determined9that9Steve's9facility9lies9in9an9a
rea9where9they9are9likely9to9experience9a9CAT939hurricane9once9every9109years.
Based9upon9the9information9in9this9scenario,9what9is9the9exposure9factor9for9the9effect
9of9a9CAT939hurricane9on9Steve's9data9center?9-
9ans✔The9exposure9factor9is9the9percentage9of9the9facility9that9risk9managers9expect9
will9be9damaged9if9a9risk9materializes.9It9is9calculated9by9dividing9the9amount9of9dama
ge9by9the9asset9value.9In9this9case,9that9is9$59million9in9damage9divided9by9the9$209m
illion9facility9value,9or9259percent.
Steve9is9the9risk9manager9for9a9company9on9the9east9coast9of9the9United9States.9He9r
ecently9undertook9a9replacement9cost9analysis9and9determined9that9rebuilding9and9rec
onfiguring9the9data9center9would9cost9$209million.9Steve9consulted9with9hurricane9exp
erts,9data9center9specialists,9and9structural9engineers9and9they9determined9that9a9typi
cal9CAT939hurricane9that9successfully9hits9the9east9coast9would9cause9approximately9
$59million9in9damages.9The9meteorologists9determined9that9Steve's9facility9lies9in9an9a
rea9where9they9are9likely9to9experience9a9CAT939hurricane9once9every9109years.
What9is9the9annualized9loss9expectancy9for9a9hurricane9at9Steve's9data9center?9-
9ans✔The9annualized9loss9expectancy9(ALE)9is9calculated9by9multiplying9the9single9lo
ss9expectancy9(SLE)9by9the9annualized9rate9of9occurrence9(ARO).9In9this9case9the9SL
E9is9$59million9and9the9ARO9is9.10.9Multiplying9those9numbers9together9gives9you9the9
ALE9of9$500,00.
Earlier9this9year,9the9information9security9team9at9Jeff's9company9identified9a9vulnerabi
lity9in9a9server9that9he9is9responsible9for.9He9immediately9applied9the9patch9and9is9sur
e9that9it9installed9properly,9but9after9running9the9vulnerability9scanner9has9continued9to
9incorrectly9flag9the9system9as9vulnerable9because9of9the9version9number9it9is9finding9
ANSWERS
During9what9phase9of9the9change9management9process9does9the9organization9conduc
t9peer9review9of9the9change9for9accuracy9and9completeness?9-9ans✔Analysis/
Impact9Assessment
Steve9is9responsible9for9work9stations9that9handle9proprietary9information.9What9is9the
9best9option9for9these9workstations9at9the9end9of9their9lifecycle?9-9ans✔Sanitization
What9is9the9earliest9stage9of9a9fire9to9use9detection9technology9to9identify9it?9-
9ans✔Incipient
What9security9control9would9provide9the9best9defense9against9a9threat9actor9trying9to9
execute9a9buffer9overflow9attack9against9a9custom9application?9-
9ans✔Parameter9Checking/Input9Validation
Which9of9the9following9is9NOT9true9of9the9ISC29Code9of9Ethics?
A.9Adherence9to9the9Code9of9Ethics9is9a9condition9of9Certification
B.9The9code9of9ethics9applies9to9all9security9professionals
C.9Failure9to9comply9with9the9Code9of9Ethics9could9result9in9revocation9of9certification
D.9Members9who9observe9a9breach9of9the9Code9of9Ethics9are9required9to9report9the9p
ossible9violation9-9ans✔B.
Under9what9type9of9software9license9does9the9recipient9of9software9have9an9unlimited9
right9to9copy,9modify,9distribute,9or9resell9a9software9package?9-9ans✔Public9Domain
What9should9Steve9do9if9a9FAR/
FRR9diagram9does9not9provide9an9acceptable9performance9level9for9his9organization's
9needs?9-
9ans✔Assess9other9biometric9systems9to9compare9them9since9the9CER9is9used9to9ass
ess9biometric9devices.
What9is9the9CER9in9biometric9device9measurment?9-
9ans✔Crossover9Error9Rate9is9the9number9that9results9when9a9biometric9device9is9adj
usted9to9provide9equal9false9acceptance9and9false9rejection9rates.
,What9type9of9access9control9would9be9the9best9choice9for9a9person9that9would9like9to9
support9a9declaration9like9"Only9allow9access9to9customer9service9on9managed9device
s9on9the9wireless9network9between989am9and979pm"?9-
9ans✔Attribute9Based9Access9Control9ABAC
What9is9the9benefit9of9an9ABAC9over9a9RBAC?9-
9ans✔An9ABAC9can9be9more9specific9thus9more9flexible
What9is9the9primary9advantage9of9decentralized9access9control?9-
9ans✔It9provides9control9of9access9to9people9closer9to9the9resources
How9are9rules9set9in9ABAC9systems?9-
9ans✔Uses9boolean9logic9statements9which9allow9it9to9be9more9flexible9than9RBAC9for
9temporary9rules9such9as9to9allow9time9limited9access.
Which9of9the9following9is9best9described9as9an9access9control9model9that9focuses9on9
subjects9and9identifies9the9objects9that9each9subject9can9access?
A.9Access9control9list
B.9Capability9Table
C.9Implicit9denial9list
D.9Rights9Management9Matrix9-9ans✔B
Adam9is9accessing9a9standalone9file9server9using9a9username9and9password9provided
9by9the9server9administrator.9Which9one9of9the9following9entities9is9guaranteed9to9hav
e9information9necessary9to9complete9the9authorization9process?
A.9File9Server
B.9Adam
C.9Server9Administrator
D.9Adam's9Supervisor9-
9ans✔A.9The9file9server9has9the9correct9information9on9what9activities9Adam9is9AUTH
ORIZED9to9perform
A9new9member9at9a9249hour9gym9that9uses9fingerprints9to9gain9access9after9hours9is9
surprised9to9find9out9that9he9is9registering9as9a9different9member.9What9type9of9biomet
ric9factor9error9occurred?9-
9ans✔Since9he9was9accepted9as9a9different9member9this9was9a9Type929(false9positive
)9error.9If9he9was9not9accepted9and9the9door9remained9locked9it9would9have9been9a9T
ype919(false9negative)9error.
You9are9tasked9with9adjusting9your9organizations9password9requirements9to9make9the
m9align9with9best9practices9from9NIST.9What9should9you9set9password9expiration9to?9-
9ans✔NIST9Special9Publication9800-
63b9suggests9that9organizations9should9not9impose9password9expiration9requirements
9on9end9users
,What9access9control9scheme9labels9subjects9and9objects9and9allows9subjects9to9acce
ss9objects9when9labels9match?9-9ans✔Mandatory9Access9Control9(MAC)
Mandatory9Access9Control9is9based9on9what9type9of9model?9-9ans✔Lattice9Based
You9need9to9create9a9trust9relationship9between9your9company9and9a9vendor.9You9ne
ed9to9implement9the9system9so9that9it9will9allow9users9from9the9vendor's9organization9t
o9access9your9accounts9payable9system9using9the9accounts9created9for9them9by9the9v
endor.9What9type9of9authentication9do9you9need9to9implement?9-
9ans✔This9type9of9authentication,9where9one9domain9trusts9users9from9another9domai
n,9is9called9federation.
Users9change9job9positions9quite9often9at9your9new9company.9Which9type9of9access9c
ontrol9would9make9it9easier9to9allow9administrators9to9adjust9permissions9when9these9
changes9occur?
A.9Role-Based9Access9Control
B.9Mandatory9Access9Control
C.9Discretionary9Access9Control
D.9Rule-Based9Access9Control9-9ans✔A9Role-
Based9Access9Control9would9assign9permission9to9roles9and9then9the9administrator9w
ould9simply9adjust9the9role9of9the9user9when9he9or9she9changes9jobs
Which9of9the9following9authenticators9is9appropriate9to9use9by9itself9rather9than9in9com
bination9with9other9biometric9factors?
A.9Voice9pattern9recognition
B.9Hand9geometry
C.9Palm9scans
D.9Heart/pulse9patterns9-
9ans✔C.9Palm9scans9compare9the9vein9patterns9in9the9palm9to9a9database9to9authenti
cate9a9user.
As9part9of9hiring9a9new9employee,9Sven's9identity9management9team9creates9a9new9u
ser9object9and9ensures9that9the9user9object9is9available9in9the9directories9and9systems
9where9it9is9needed.9What9is9this9process9called?9-
9ans✔Provisioning9includes9the9creation,9maintenance,9and9removal9of9user9objects9fr
om9applications,9systems,9and9directories.
The9Linux9filesystem9allows9the9owners9of9objects9to9determine9the9access9rights9that
9subjects9have9to9them.9What9type9of9access9control9does9Linux9use?9-
9ans✔Discretionary9Access9Control
Mary's9organization9handles9very9sensitive9governmental9agency9information.9They9ne
ed9to9implement9an9access9control9system9that9allows9administrators9to9set9access9rig
hts9but9does9not9allow9the9delegation9of9those9rights9to9other9users.9What9is9the9best9
type9of9access9control9design9for9Mary's9organization?9-
, 9ans✔Mandatory9Access9Control9(MAC)9systems9allow9an9administrator9to9configure9a
ccess9permissions9but9do9not9allow9users9to9delegate9permission9to9others.
What9term9is9used9to9describe9the9default9set9of9privileges9assigned9to9a9user9when9a
9new9account9is9created?
A.9Aggregation
B.9Transitivity
C.9Baseline
D.9Entitlement9-
9ans✔D.9Entitlement9refers9to9the9privileges9granted9to9useres9when9an9account9is9firs
t9provisioned.
Steve9is9the9risk9manager9for9a9company9on9the9east9coast9of9the9United9States.9He9r
ecently9undertook9a9replacement9cost9analysis9and9determined9that9rebuilding9and9rec
onfiguring9the9data9center9would9cost9$209million.9Steve9consulted9with9hurricane9exp
erts,9data9center9specialists,9and9structural9engineers9and9they9determined9that9a9typi
cal9CAT939hurricane9that9successfully9hits9the9east9coast9would9cause9approximately9
$59million9in9damages.9The9meteorologists9determined9that9Steve's9facility9lies9in9an9a
rea9where9they9are9likely9to9experience9a9CAT939hurricane9once9every9109years.
Based9upon9the9information9in9this9scenario,9what9is9the9exposure9factor9for9the9effect
9of9a9CAT939hurricane9on9Steve's9data9center?9-
9ans✔The9exposure9factor9is9the9percentage9of9the9facility9that9risk9managers9expect9
will9be9damaged9if9a9risk9materializes.9It9is9calculated9by9dividing9the9amount9of9dama
ge9by9the9asset9value.9In9this9case,9that9is9$59million9in9damage9divided9by9the9$209m
illion9facility9value,9or9259percent.
Steve9is9the9risk9manager9for9a9company9on9the9east9coast9of9the9United9States.9He9r
ecently9undertook9a9replacement9cost9analysis9and9determined9that9rebuilding9and9rec
onfiguring9the9data9center9would9cost9$209million.9Steve9consulted9with9hurricane9exp
erts,9data9center9specialists,9and9structural9engineers9and9they9determined9that9a9typi
cal9CAT939hurricane9that9successfully9hits9the9east9coast9would9cause9approximately9
$59million9in9damages.9The9meteorologists9determined9that9Steve's9facility9lies9in9an9a
rea9where9they9are9likely9to9experience9a9CAT939hurricane9once9every9109years.
What9is9the9annualized9loss9expectancy9for9a9hurricane9at9Steve's9data9center?9-
9ans✔The9annualized9loss9expectancy9(ALE)9is9calculated9by9multiplying9the9single9lo
ss9expectancy9(SLE)9by9the9annualized9rate9of9occurrence9(ARO).9In9this9case9the9SL
E9is9$59million9and9the9ARO9is9.10.9Multiplying9those9numbers9together9gives9you9the9
ALE9of9$500,00.
Earlier9this9year,9the9information9security9team9at9Jeff's9company9identified9a9vulnerabi
lity9in9a9server9that9he9is9responsible9for.9He9immediately9applied9the9patch9and9is9sur
e9that9it9installed9properly,9but9after9running9the9vulnerability9scanner9has9continued9to
9incorrectly9flag9the9system9as9vulnerable9because9of9the9version9number9it9is9finding9
