Official (ISC)² SSCP Test with all Correct & 100% Verified
Answers |Actual Complete Update |Already Graded A+
(Just Released)
Access Control Object ✔Correct Answer-A passive entity that typically receives or contains
some form of data.
Access Control Subject ✔Correct Answer-An active entity and can be any user, program, or
process that requests permission to cause data to flow from an access control object to the
access control subject or between access control objects.
Asynchronous Password Token ✔Correct Answer-A one-time password is generated without
the use of a clock, either from a one-time pad or cryptographic algorithm.
Authorization ✔Correct Answer-Determines whether a user is permitted to access a particular
resource.
Connected Tokens ✔Correct Answer-Must be physically connected to the computer to which
the user is authenticating.
Contactless Tokens ✔Correct Answer-Form a logical connection to the client computer but do
not require a physical connection.
Disconnected Tokens ✔Correct Answer-Have neither a physical nor logical connection to the
client computer.
Entitlement ✔Correct Answer-A set of rules, defined by the resource owner, for managing
access to a resource (asset, service, or entity) and for what purpose.
Identity Management ✔Correct Answer-The task of controlling information about users on
computers.
Proof of Identity ✔Correct Answer-Verify people's identities before the enterprise issues them
accounts and credentials.
Kerberos ✔Correct Answer-A popular network authentication protocol for indirect (third-
party) authentication services.
Lightweight Directory Access Protocol (LDAP) ✔Correct Answer-A client/server-based
directory query protocol loosely based on X.500, commonly used to manage user information.
LDAP is a front end and not used to manage or synchronize data per se as opposed to DNS.
,Single Sign-On (SSO) ✔Correct Answer-Designed to provide strong authentication using
secret-key cryptography, allowing a single identity to be shared across multiple applications.
Static Password Token ✔Correct Answer-The device contains a password that is physically
hidden (not visible to the possessor) but that is transmitted for each authentication.
Synchronous Dynamic Password Token ✔Correct Answer-A timer is used to rotate through
various combinations produced by a cryptographic algorithm.
Trust Path ✔Correct Answer-A series of trust relationships that authentication requests must
follow between domains
6to4 ✔Correct Answer-Transition mechanism for migrating from IPv4 to IPv6. It allows
systems to use IPv6 to communicate if their traffic has to transverse an IPv4 network.
Absolute addresses ✔Correct Answer-Hardware addresses used by the CPU.
Abstraction ✔Correct Answer-The capability to suppress unnecessary details so the
important, inherent properties can be examined and reviewed.
Accepted ways for handling risk ✔Correct Answer-Accept, transfer, mitigate, avoid.
Access ✔Correct Answer-The flow of information between a subject and an object.
Access control matrix ✔Correct Answer-A table of subjects and objects indicating what
actions individual subjects can take upon individual objects.
Access control model ✔Correct Answer-An access control model is a framework that dictates
how subjects access objects.
Access controls ✔Correct Answer-Are security features that control how users and systems
communicate and interact with other systems and resources.
Accreditation ✔Correct Answer-Formal acceptance of the adequacy of a system's overall
security by management.
Active attack ✔Correct Answer-Attack where the attacker does interact with processing or
communication activities.
ActiveX ✔Correct Answer-A Microsoft technology composed of a set of OOP technologies and
tools based on COM and DCOM. It is a framework for defining reusable software components in
a programming language-independent manner
,Address bus ✔Correct Answer-Physical connections between processing components and
memory segments used to communicate the physical memory addresses being used during
processing procedures.
Address resolution protocol (ARP) ✔Correct Answer-A networking protocol used for
resolution of network layer IP addresses into link layer MAC addresses.
Address space layout randomization (ASLR) ✔Correct Answer-Memory protection mechanism
used by some operating systems. The addresses used by components of a process are
randomized so that it is harder for an attacker to exploit specific memory vulnerabilities.
Algebraic attack ✔Correct Answer-Cryptanalysis attack that exploits vulnerabilities within the
intrinsic algebraic structure of mathematical functions.
Algorithm ✔Correct Answer-Set of mathematical and logic rules used in cryptographic
functions.
Analog signals ✔Correct Answer-Continuously varying electromagnetic wave that represents
and transmits data.
Analytic attack ✔Correct Answer-Cryptanalysis attack that exploits vulnerabilities within the
algorithm structure.
Annualized loss expectancy (ALE) ✔Correct Answer-Annual expected loss if a specific
vulnerability is exploited and how it affects a single asset. SLE × ARO = ALE.
Application programming interface (API) ✔Correct Answer-Software interface that enables
process-to-
process interaction. Common way to provide access to standard routines to a set of software
programs.
Arithmetic logic unit (ALU) ✔Correct Answer-A component of the computer's processing unit,
in which arithmetic and matching operations are performed.
AS/NZS 4360 ✔Correct Answer-Australia and New Zealand business risk management
assessment approach.
Assemblers ✔Correct Answer-Tools that convert assembly code into the necessary machine-
compatible binary language for processing activities to take place.
Assembly language ✔Correct Answer-A low-level programming language that is the
mnemonic representation of machine-level instructions.
, Assurance evaluation criteria ✔Correct Answer-Check-list and process of examining the
security-relevant parts of a system (TCB, reference monitor, security kernel) and assigning the
system an assurance rating.
Asymmetric algorithm ✔Correct Answer-Encryption method that uses two different key types,
public and private. Also called public key cryptography.
Asymmetric mode multiprocessing ✔Correct Answer-When a computer has two or more
CPUs and one CPU is dedicated to a specific program while the other CPUs carry out general
processing procedures
Asynchronous communication ✔Correct Answer-Transmission sequencing technology that
uses start and stop bits or similar encoding mechanism. Used in environments that transmit a
variable amount of data in a periodic fashion.
Asynchronous token generating method ✔Correct Answer-Employs a challenge/response
scheme to authenticate the user.
Attack surface ✔Correct Answer-Components available to be used by an attacker against the
product itself.
Attenuation ✔Correct Answer-Gradual loss in intensity of any kind of flux through a medium.
As an electrical signal travels down a cable, the signal can degrade and distort or corrupt the
data it is carrying.
Attribute ✔Correct Answer-A column in a two-dimensional database.
Authentication Header (AH) Protocol ✔Correct Answer-Protocol within the IPSec suite used
for integrity and authentication.
Authenticode ✔Correct Answer-A type of code signing, which is the process of digitally
signing software components and scripts to confirm the software author and guarantee that the
code has not been altered or corrupted since it was digitally signed. Authenticode is Microsoft's
implementation of code signing.
Availability ✔Correct Answer-Reliable and timely access to data and resources is provided to
authorized individuals.
Avalanche effect ✔Correct Answer-Algorithm design requirement so that slight changes to the
input result in drastic changes to the output.
Base registers ✔Correct Answer-Beginning of address space assigned to a process. Used to
ensure a process does not make a request outside its assigned memory boundaries.
Answers |Actual Complete Update |Already Graded A+
(Just Released)
Access Control Object ✔Correct Answer-A passive entity that typically receives or contains
some form of data.
Access Control Subject ✔Correct Answer-An active entity and can be any user, program, or
process that requests permission to cause data to flow from an access control object to the
access control subject or between access control objects.
Asynchronous Password Token ✔Correct Answer-A one-time password is generated without
the use of a clock, either from a one-time pad or cryptographic algorithm.
Authorization ✔Correct Answer-Determines whether a user is permitted to access a particular
resource.
Connected Tokens ✔Correct Answer-Must be physically connected to the computer to which
the user is authenticating.
Contactless Tokens ✔Correct Answer-Form a logical connection to the client computer but do
not require a physical connection.
Disconnected Tokens ✔Correct Answer-Have neither a physical nor logical connection to the
client computer.
Entitlement ✔Correct Answer-A set of rules, defined by the resource owner, for managing
access to a resource (asset, service, or entity) and for what purpose.
Identity Management ✔Correct Answer-The task of controlling information about users on
computers.
Proof of Identity ✔Correct Answer-Verify people's identities before the enterprise issues them
accounts and credentials.
Kerberos ✔Correct Answer-A popular network authentication protocol for indirect (third-
party) authentication services.
Lightweight Directory Access Protocol (LDAP) ✔Correct Answer-A client/server-based
directory query protocol loosely based on X.500, commonly used to manage user information.
LDAP is a front end and not used to manage or synchronize data per se as opposed to DNS.
,Single Sign-On (SSO) ✔Correct Answer-Designed to provide strong authentication using
secret-key cryptography, allowing a single identity to be shared across multiple applications.
Static Password Token ✔Correct Answer-The device contains a password that is physically
hidden (not visible to the possessor) but that is transmitted for each authentication.
Synchronous Dynamic Password Token ✔Correct Answer-A timer is used to rotate through
various combinations produced by a cryptographic algorithm.
Trust Path ✔Correct Answer-A series of trust relationships that authentication requests must
follow between domains
6to4 ✔Correct Answer-Transition mechanism for migrating from IPv4 to IPv6. It allows
systems to use IPv6 to communicate if their traffic has to transverse an IPv4 network.
Absolute addresses ✔Correct Answer-Hardware addresses used by the CPU.
Abstraction ✔Correct Answer-The capability to suppress unnecessary details so the
important, inherent properties can be examined and reviewed.
Accepted ways for handling risk ✔Correct Answer-Accept, transfer, mitigate, avoid.
Access ✔Correct Answer-The flow of information between a subject and an object.
Access control matrix ✔Correct Answer-A table of subjects and objects indicating what
actions individual subjects can take upon individual objects.
Access control model ✔Correct Answer-An access control model is a framework that dictates
how subjects access objects.
Access controls ✔Correct Answer-Are security features that control how users and systems
communicate and interact with other systems and resources.
Accreditation ✔Correct Answer-Formal acceptance of the adequacy of a system's overall
security by management.
Active attack ✔Correct Answer-Attack where the attacker does interact with processing or
communication activities.
ActiveX ✔Correct Answer-A Microsoft technology composed of a set of OOP technologies and
tools based on COM and DCOM. It is a framework for defining reusable software components in
a programming language-independent manner
,Address bus ✔Correct Answer-Physical connections between processing components and
memory segments used to communicate the physical memory addresses being used during
processing procedures.
Address resolution protocol (ARP) ✔Correct Answer-A networking protocol used for
resolution of network layer IP addresses into link layer MAC addresses.
Address space layout randomization (ASLR) ✔Correct Answer-Memory protection mechanism
used by some operating systems. The addresses used by components of a process are
randomized so that it is harder for an attacker to exploit specific memory vulnerabilities.
Algebraic attack ✔Correct Answer-Cryptanalysis attack that exploits vulnerabilities within the
intrinsic algebraic structure of mathematical functions.
Algorithm ✔Correct Answer-Set of mathematical and logic rules used in cryptographic
functions.
Analog signals ✔Correct Answer-Continuously varying electromagnetic wave that represents
and transmits data.
Analytic attack ✔Correct Answer-Cryptanalysis attack that exploits vulnerabilities within the
algorithm structure.
Annualized loss expectancy (ALE) ✔Correct Answer-Annual expected loss if a specific
vulnerability is exploited and how it affects a single asset. SLE × ARO = ALE.
Application programming interface (API) ✔Correct Answer-Software interface that enables
process-to-
process interaction. Common way to provide access to standard routines to a set of software
programs.
Arithmetic logic unit (ALU) ✔Correct Answer-A component of the computer's processing unit,
in which arithmetic and matching operations are performed.
AS/NZS 4360 ✔Correct Answer-Australia and New Zealand business risk management
assessment approach.
Assemblers ✔Correct Answer-Tools that convert assembly code into the necessary machine-
compatible binary language for processing activities to take place.
Assembly language ✔Correct Answer-A low-level programming language that is the
mnemonic representation of machine-level instructions.
, Assurance evaluation criteria ✔Correct Answer-Check-list and process of examining the
security-relevant parts of a system (TCB, reference monitor, security kernel) and assigning the
system an assurance rating.
Asymmetric algorithm ✔Correct Answer-Encryption method that uses two different key types,
public and private. Also called public key cryptography.
Asymmetric mode multiprocessing ✔Correct Answer-When a computer has two or more
CPUs and one CPU is dedicated to a specific program while the other CPUs carry out general
processing procedures
Asynchronous communication ✔Correct Answer-Transmission sequencing technology that
uses start and stop bits or similar encoding mechanism. Used in environments that transmit a
variable amount of data in a periodic fashion.
Asynchronous token generating method ✔Correct Answer-Employs a challenge/response
scheme to authenticate the user.
Attack surface ✔Correct Answer-Components available to be used by an attacker against the
product itself.
Attenuation ✔Correct Answer-Gradual loss in intensity of any kind of flux through a medium.
As an electrical signal travels down a cable, the signal can degrade and distort or corrupt the
data it is carrying.
Attribute ✔Correct Answer-A column in a two-dimensional database.
Authentication Header (AH) Protocol ✔Correct Answer-Protocol within the IPSec suite used
for integrity and authentication.
Authenticode ✔Correct Answer-A type of code signing, which is the process of digitally
signing software components and scripts to confirm the software author and guarantee that the
code has not been altered or corrupted since it was digitally signed. Authenticode is Microsoft's
implementation of code signing.
Availability ✔Correct Answer-Reliable and timely access to data and resources is provided to
authorized individuals.
Avalanche effect ✔Correct Answer-Algorithm design requirement so that slight changes to the
input result in drastic changes to the output.
Base registers ✔Correct Answer-Beginning of address space assigned to a process. Used to
ensure a process does not make a request outside its assigned memory boundaries.
