ISC2 SSCP Practice Questions with Explanations

Correct answer: D

The physical installation concern for iris scanners is that direct sunlight entering the optical aperture can interfere with the scanner's ability to read the iris pattern accurately and damage the sensitive optical components. This is a documented physical installation best practice for iris recognition systems, making it a legitimate operational concern distinct from technological limitations or inherent system characteristics.

Why the other options are wrong:

• A. Modern iris scanners use safe infrared light, not harmful lasers that damage eyes.
• B. While iris patterns do change slightly with age, this is a physiological factor affecting the biometric modality itself, not a physical installation problem.
• C. Iris recognition systems actually have one of the lowest false accept rates among biometric modalities.

Correct answer: B

In Mandatory Access Control systems, sensitivity labels on objects contain both the classification level (e.g., Top Secret, Secret, Confidential) and a category set (e.g., compartments or handling restrictions). This two-part labeling scheme allows MAC systems to enforce access controls based on both the sensitivity level and the specific categories for which the subject has clearance.

Why the other options are wrong:

• A. Classification alone is insufficient; categories are also required.
• C. Category alone cannot enforce access control; classification level is also needed.
• D. Need-to-know is a basis for Discretionary Access Control, not part of MAC sensitivity labels.

Correct answer: D

An object's sensitivity label consists of a single classification level combined with a compartment set (multiple compartments). The single classification represents the overall sensitivity level, while the compartment set represents multiple independent categories or handling restrictions that apply to that object. This structure allows for flexible and precise access control decisions.

Why the other options are wrong:

• A. Classifications are singular, not a set, and it's compartments that are multiple (a set).
• B. While there is a single classification, there must be a compartment set, not a single compartment.
• C. User credentials are not part of an object's sensitivity label; labels describe the object, not the subject.

Correct answer: D

Two sensitivity labels are incomparable when neither label dominates the other- specifically, when neither label contains all the compartments (categories) of the other. This occurs when subjects have different combinations of compartment clearances that cannot be ordered hierarchically, making access decisions ambiguous without additional policy rules.

Why the other options are wrong:

• A. The number of classifications doesn't determine comparability; classification levels are hierarchical.
• B. This describes different classifications, not different compartments; compartments are what make labels incomparable.
• C. The total count of categories is less relevant than which specific categories are present in each label.

Correct answer: C

Kerberos is a symmetric-key cryptography-based authentication protocol developed by MIT. It uses symmetric ciphers (like DES or AES) for encryption throughout the authentication process, including ticket encryption and session key establishment. This is fundamental to Kerberos's design and operation.

Why the other options are wrong:

• A. Kerberos relies on symmetric key cryptography, not public key cryptography.
• B. Kerberos encrypts passwords as well; it uses symmetric encryption for the entire authentication exchange.
• D. Kerberos is a third-party authentication system (involving the KDC as a trusted intermediary), not second-party.

Correct answer: A

System accountability requires audit mechanisms to record and track user actions, system events, and access attempts. These audit logs provide the evidence trail necessary to establish who did what, when they did it, and what the consequences were-the fundamental requirement for accountability. Without auditing, accountability cannot be achieved.

Why the other options are wrong:

• B. Documented design relates to transparency and evaluation, not directly to accountability mechanisms.
• C. Authorization controls access but does not create the accountability record needed to track actions.
• D. Formal verification validates design correctness but does not provide runtime accountability of user actions.

Correct answer: B

Kerberos is a trusted third-party authentication protocol that provides secure authentication services in network environments. It was developed at MIT and is named after the mythological three-headed dog, but the protocol itself is specifically a third-party authentication mechanism that uses a Key Distribution Center (KDC) as a trusted intermediary.

Why the other options are wrong:

• A. While Kerberos is named after the mythological creature, the question asks what Kerberos is in IT security context.
• C. Kerberos is a protocol, not a security model.
• D. RADIUS (Remote Authentication Dial-In User Service) is a different authentication protocol from Kerberos.

Correct answer: C

The three classic authentication factors are something you know (passwords, PINs), something you have (smart cards, tokens), and something you are (biometrics like fingerprints, iris patterns). Multi-factor authentication combines two or more of these factors to increase security. This framework is fundamental to authentication system design.

Why the other options are wrong:

• A. "Need" is not an authentication factor.
• B. "Non-trivial" is a property of passwords but not one of the three authentication factors.
• D. "You can get" is not one of the established authentication factors.

Correct answer: D

Detection is the security function that identifies when security incidents or policy violations have occurred. A timely review of audit records is a reactive measure that discovers unauthorized access or suspicious activities after they happen, which is the core purpose of detection controls. Avoidance and prevention are proactive measures that stop incidents before they occur, while deterrence discourages potential attackers through the threat of consequences.

Why the other options are wrong:

• A. Avoidance means not engaging in risky activities; reviewing audit logs does not avoid risk.
• B. Deterrence discourages attacks through threat of consequences, not through reviewing historical records.
• C. Prevention stops attacks before they occur; audit review happens after access has already been granted.

Correct answer: A

A PIN (Personal Identification Number) is a confidential numeric code used as an authentication factor to verify identity. It is specifically defined as a secret number used in authentication systems. User IDs are public identifiers, passwords are alphanumeric secrets, and challenges are prompts in authentication exchanges-none of these specifically match the definition of a confidential number used for authentication.

Why the other options are wrong:

• B. A User ID is a public identifier, not confidential.
• C. A password is typically alphanumeric, not exclusively a number.
• D. A challenge is a prompt in an authentication dialog, not a number used to verify identity.

Correct answer: A

Separation of duties requires that critical functions be divided among different people to prevent any single individual from having too much control. Option A demonstrates proper separation by preventing operators (who run systems) from modifying system time, which is an administrative control function. This prevents operators from altering audit trails or system records. Options B and D allow incompatible roles to overlap, while option C permits console operators to handle physical media, which are separate but compatible duties.

Why the other options are wrong:

• B. Programmers using the system console violates separation of duties by combining development and operations roles.
• C. Console operators mounting tapes and disks is a compatible separation of logical and physical duties, but does not exemplify proper separation as clearly as A.
• D. Tape operators using the system console combines physical media handling with system administration, violating separation of duties.

Correct answer: C

Logical controls are implemented in software and systems to restrict access to data and resources. Employee badges are a physical control-a tangible security mechanism used at facility entry points. Access profiles, userids, and passwords are all logical controls implemented through software systems to manage who can access what resources and when. Logical access security operates at the system and application level, not the physical facility level.

Why the other options are wrong:

• A. Access profiles are logical controls that define what resources a user can access.
• B. Userids are logical controls that identify and authenticate users in systems.
• D. Passwords are logical controls that verify identity and grant access to systems.

Correct answer: A

IP address-based authentication is problematic for mobile users because their IP addresses change frequently as they move between networks (home, office, coffee shops, cellular networks). This creates authentication failures or allows legitimate users to be blocked. Reusable passwords work across locations, one-time passwords and challenge- response mechanisms are designed to be location-independent and work well for mobile users.

Why the other options are wrong:

• B. Reusable passwords function regardless of location and present no special problem for mobile users.
• C. One-time password mechanisms work well for mobile users and are specifically designed for remote access.
• D. Challenge-response mechanisms are location-independent and function effectively for mobile authentication.

Correct answer: D

Before allowing external access to internal networks via the Internet, organizations must first establish a security foundation by planning proper authentication options. This includes determining which authentication mechanisms will be used to verify the identity of remote users. Authentication is the prerequisite security measure that must be decided before implementing other controls like workstation locking, modem pool protection, or account monitoring-all of which depend on knowing who the user is.

Why the other options are wrong:

• A. Workstation locking mechanisms are important but are secondary to establishing who the user is through authentication.
• B. Modem pool protection is a lower priority than determining how to authenticate external users.
• C. Account usage information is a monitoring feature that comes after establishing authentication mechanisms.

Correct answer: A

Audit trails are comprehensive logs of system activities, user actions, and security events that record what happened on a host system. Host-based intrusion detection systems analyze these audit trails to identify suspicious patterns, unauthorized access attempts, and malicious activities. Audit trails provide the detailed event data necessary for detection and analysis. Access control lists prevent unauthorized access, security clearances determine authorization levels, and host-based authentication verifies identity-none of these directly assist in detecting intrusions the way audit trails do.

Why the other options are wrong:

• B. Access control lists are preventive controls that restrict access but do not detect intrusions.
• C. Security clearances determine authorization levels but do not provide detection capabilities.
• D. Host-based authentication verifies user identity but does not detect intrusion attempts or suspicious activities.

Correct answer: C

Password sniffing attacks capture unencrypted passwords transmitted over networks. To defend against this, encryption protects passwords in transit, making captured data unreadable. One-time passwords (OTPs) are single-use credentials that become invalid after use, so even if an attacker sniffs them, they cannot be replayed. Together, encryption and one-time passwords provide defense against sniffing: encryption protects static credentials in transit, and OTPs ensure that even intercepted passwords cannot be reused. Static passwords are vulnerable, and recurring passwords offer no protection against sniffing.

Why the other options are wrong:

• A. Static and recurring passwords are both vulnerable to sniffing attacks; neither provides protection.
• B. Encryption helps, but recurring passwords can still be sniffed and reused by attackers.
• D. Static passwords are vulnerable to sniffing; one-time passwords alone cannot protect against sniffing of other credential types.

Correct answer: B

Kerberos prevents replay attacks through the use of timestamps and nonces in its authentication protocol. When a client requests authentication, Kerberos includes a timestamp in the ticket. The server validates that the timestamp is within an acceptable time window (typically 5 minutes), preventing an attacker from capturing and replaying old authentication credentials. This is a fundamental design feature of the Kerberos protocol.

Why the other options are wrong:

• A. Tunneling attacks are network-level attacks that Kerberos does not specifically address or prevent.
• C. Destructive attacks involve data destruction or system damage, which Kerberos authentication mechanisms cannot prevent.
• D. Process attacks target running processes and are not prevented by Kerberos authentication.

Correct answer: D

In discretionary access control (DAC) environments, the data owner has the authority to grant or revoke access to their resources. The data owner is the entity responsible for determining who has access to information they control. This is the defining characteristic of discretionary access control-it places access decisions in the hands of the resource owner rather than a central administrator.

Why the other options are wrong:

• A. Managers may oversee employees but do not have inherent authority to grant system access rights.
• B. Group leaders manage group membership but are not the entities authorized to grant access permissions.
• C. Security managers enforce security policies but in DAC environments, access decisions rest with the data owner, not the security manager.

Correct answer: A

The primary security concern with single sign-on (SSO) is that if a user's single password or credential is compromised, an attacker gains access to all systems and resources that user is authorized to access. This creates a single point of failure where one compromised credential results in maximum unauthorized access across multiple systems and applications, rather than compromising access to just one system.

Why the other options are wrong:

• B. SSO actually reduces the security administrator's workload by centralizing authentication rather than increasing it.
• C. SSO typically makes password management easier for users since they need to remember only one password, not multiple ones.
• D. SSO does not increase user access rights; it only changes the authentication mechanism, not authorization levels.

Correct answer: C

Bell and LaPadula developed one of the first formal mathematical models for multilevel security computer systems in 1973. Their model is foundational to information security and defined security properties including the simple security property (no read-up) and the star property (no write-down), which are fundamental concepts in mandatory access control and multi-level security systems.

Why the other options are wrong:

• A. Diffie and Hellman developed public-key cryptography algorithms, not multilevel security models.
• B. Clark and Wilson developed a model for integrity in information systems, not the original multilevel security model.
• D. Gasser and Lipner contributed to security models but were not the developers of one of the first mathematical models of multilevel-security systems.

Correct answer: A

Content-dependent access control restricts access based on the actual content or data values involved. In this scenario, the manager's access to salary data depends on the content of the department field-they can access salaries only for their own department. The access decision is made based on what department the salary record belongs to, which is the defining characteristic of content-dependent access control.

Why the other options are wrong:

• B. Context-dependent access control restricts access based on conditions like time, location, or system state, not on the data content itself.
• C. Least privilege access control refers to granting users the minimum permissions necessary; this example demonstrates content-based filtering rather than least privilege principles.
• D. Ownership-based access control restricts access based on who owns the data; this scenario is based on data content, not ownership.

Correct answer: B

Sniffing is a passive network attack where an attacker captures unencrypted network traffic, including credentials and passwords transmitted over the network. A network sniffer intercepts data packets traveling across the network and can extract sensitive information like usernames and passwords if they are sent in cleartext or using weak encryption.

Why the other options are wrong:

• A. Data diddling involves unauthorized modification of data, not capturing passwords.
• C. IP Spoofing involves forging IP addresses to impersonate a legitimate host but does not directly capture passwords.
• D. Smurfing is a denial-of-service attack that uses ICMP echo requests and does not capture passwords.

Correct answer: D

GyN19Za! is the best password because it incorporates multiple character types including uppercase letters, lowercase letters, numbers, and special characters. This combination significantly increases password complexity and resistance to brute-force and dictionary attacks. Strong passwords for privileged accounts like network administrators should be lengthy, use mixed case, include numbers and symbols, and avoid dictionary words or predictable patterns.

Why the other options are wrong:

• A. Holiday is a simple dictionary word with no numbers or special characters, making it vulnerable to dictionary attacks.
• B. Christmas12 is a common word with a predictable numeric suffix, making it susceptible to pattern-based attacks.
• C. Jenny is a common name and simple dictionary word with no numbers or special characters, providing minimal security.

Correct answer: A

A clipping level is the threshold number of violations that will be accepted or tolerated before a violation record is produced and reported. This is a security auditing concept where minor violations below the clipping level are not logged individually to reduce noise in security logs, but when the threshold is reached, violations are recorded and reported to security personnel. It helps balance security monitoring with log management.

Why the other options are wrong:

• B. Acceptance level is not standard security terminology for violation thresholds in audit logging.
• C. Forgiveness level is not a recognized term in security auditing or violation tracking.
• D. Logging level refers to the detail or verbosity of log entries, not the threshold for violation reporting.

Correct answer: D

Physical access controls are tangible, physical mechanisms that restrict or monitor entry to locations or assets. Badges, locks, and guards are all physical controls that operate in the real world. Passwords are logical/technical controls that exist in software and systems, not physical controls. They authenticate users to computer systems rather than controlling physical access to buildings or areas.

Why the other options are wrong:

• A. Badges are physical credentials used to grant or deny entry to secured areas.
• B. Locks are fundamental physical barriers that prevent unauthorized access.
• C. Guards are human personnel who monitor and control physical access to locations.

Correct answer: A

The clipping level (also called threshold) is a security auditing concept that defines the number of violations that will be tolerated or recorded before generating a formal violation report. It allows administrators to filter out minor or isolated incidents and focus on patterns or repeated violations. This prevents log flooding from trivial events while ensuring that significant security concerns are documented.

Why the other options are wrong:

• B. Acceptance level is not standard security terminology for audit violation thresholds.
• C. Forgiveness level is not a recognized term in security audit configuration.
• D. Logging level refers to the verbosity or detail of log messages, not violation tolerance.

Correct answer: D

This question is identical to Question 25. Passwords are logical/technical controls, not physical controls. Badges, locks, and guards are all examples of physical access controls that operate in the tangible world to restrict or monitor entry to secured areas. Passwords exist only in computer systems and authenticate users to logical resources, making them logical controls rather than physical controls.

Why the other options are wrong:

• A. Badges are physical credentials used to grant or deny entry to secured areas.
• B. Locks are fundamental physical barriers that prevent unauthorized access.
• C. Guards are human personnel who monitor and control physical access to locations.

Correct answer: A

Guards are most appropriately deployed when security functions require discriminating judgment-that is, decision-making that depends on context, interpretation, and professional assessment. Guards must evaluate situations, recognize threats, make split- second decisions, and adapt to changing circumstances in ways that automated systems cannot. This requires the human capacity for judgment, reasoning, and discretion in complex, variable scenarios.

Why the other options are wrong:

• B. While guards may use force, that is not the primary criterion for their deployment; many guard duties involve minimal physical contact.
• C. Access control devices can operate with automated systems and do not necessarily require guards.
• D. Detection of unauthorized access can be handled by sensors, cameras, and automated monitoring systems without guards.

Correct answer: D

A retinal scan measures the unique pattern of blood vessels at the back of the eye (the retina). Each person has a distinctive vascular pattern in the retina that remains relatively stable throughout life, making it an excellent biometric identifier. The scan uses infrared light to capture the pattern of these blood vessels, which is then compared against stored templates for authentication purposes.

Why the other options are wrong:

• A. Retinal scanners do not measure the amount of light reaching the retina.
• B. While light is used in the scanning process, the device measures the blood vessel pattern, not reflected light amounts.
• C. Light receptors (photoreceptors) are measured in iris scanning, not retinal scanning.

Correct answer: A

In the concentric layers of physical security (perimeter barriers, exterior barriers, interior barriers, and people), people represent the final line of defense. While automated systems and physical barriers provide layers of protection, ultimately human personnel-whether guards, staff, or authorized occupants-serve as the last defense against threats that penetrate all other security measures. People can make judgments, respond adaptively, and take decisive action that mechanical systems cannot.

Why the other options are wrong:

• B. Interior barriers are an earlier line of defense, protecting specific areas within a facility.
• C. Exterior barriers are an earlier layer, typically surrounding buildings or facilities.
• D. Perimeter barriers are the outermost layer and the first line of defense, not the last.

Correct answer: A

The Bell-LaPadula model is the security policy framework upon which the U.S. Department of Defense's Orange Book (Trusted Computer System Evaluation Criteria) is based. The Bell-LaPadula model defines security properties including the simple security property (no read up) and the star property (no write down), establishing mandatory access control principles. These concepts are foundational to the Orange Book's evaluation criteria for computer security.

Why the other options are wrong:

• B. The Data Encryption Standard (DES) is a cryptographic algorithm, not a security policy model.
• C. Kerberos is an authentication protocol, not the policy model underlying the Orange Book.
• D. Tempest refers to shielding against electromagnetic emissions, not a security policy model.

Correct answer: A

The principle of least privilege means granting users only the minimum access rights and permissions necessary to perform their job functions. This results in users having access to only the information and resources for which they have a documented need to know. This principle minimizes risk by reducing the scope of potential damage from compromised accounts, misuse of privileges, or unauthorized access.

Why the other options are wrong:

• B. Least privilege is the opposite of allowing users to access all systems.
• C. Least privilege requires regular review and removal of unnecessary privileges during position changes, not automatic addition of new privileges.
• D. Authorization creep (accumulation of unnecessary privileges over time) is what the principle of least privilege is designed to prevent, not its end result.

Correct answer: B

A synchronous token (also called a time-based token or hardware token) is the most reliable authentication method for remote access because it generates one-time passwords that are synchronized with a server and cannot be reused or intercepted for future attacks. The token changes at regular intervals, making it resistant to replay attacks and man-in-the-middle threats.

Why the other options are wrong:

• A. Variable callback systems are less reliable because the attacker can potentially intercept and redirect calls to a number they control.
• C. Fixed callback systems are vulnerable because an attacker knowing the callback number can intercept the connection before the legitimate user.
• D. Callback combined with caller ID can be spoofed; caller ID is not cryptographically secure and can be defeated.

Correct answer: A

Degaussing is the most reliable and secure method for removing data from magnetic storage media. It uses a powerful magnetic field to erase all magnetic patterns on the media, destroying both the data structure and content completely. This method is specifically designed for magnetic media like tapes and is widely recognized as the standard secure deletion technique for such storage.

Why the other options are wrong:

• B. Parity Bit Manipulation does not actually erase data; it only modifies checksum information and leaves original data intact.
• C. Zeroization (overwriting with zeros) can leave traces on magnetic media and is less reliable than degaussing for complete erasure.
• D. Buffer overflow is a software attack technique, not a data destruction method, and is completely inappropriate for securely removing media data.

Correct answer: B

The Orange Book (Department of Defense Trusted Computer System Evaluation Criteria) is founded upon the Bell-LaPadula confidentiality model. This model defines mandatory access control policies with security levels and compartments, forming the theoretical foundation for the Orange Book's criteria for evaluating trusted computer systems.

Why the other options are wrong:

• A. The Biba Model is an integrity-focused model, while the Orange Book is primarily based on the confidentiality-focused Bell-LaPadula model.
• C. The Clark-Wilson Model is an integrity model developed later and is not the foundation for the Orange Book.
• D. TEMPEST is a government program concerning emissions security, not a security policy model underlying the Orange Book.

Correct answer: D

Two-factor authentication requires two independent proofs of identity, typically from different authentication categories (something you know, something you have, or something you are). This combination significantly increases security by requiring an attacker to compromise multiple authentication mechanisms.

Why the other options are wrong:

• A. RSA public-key signatures are a single factor (something you know/have) and do not define two-factor authentication.
• B. Two-factor authentication does not require hand geometry measurements; it uses various combinations like password plus token or biometric plus PIN.
• C. Two-factor authentication does not inherently preclude single sign-on; they are independent concepts and can coexist.

Correct answer: C

Kerberos is primarily an authentication service within a network environment. It provides mutual authentication between clients and servers using tickets and a trusted third party (the Key Distribution Center), ensuring that both parties can verify each other's identity within a networked system.

Why the other options are wrong:

• A. Non-repudiation ensures a user cannot deny their actions; while Kerberos provides authentication, it is not its primary service.
• B. Confidentiality is supported through encryption in Kerberos, but authentication is the primary service it provides.
• D. Authorization (access control) is handled by separate systems; Kerberos focuses on authentication, not authorization decisions.

Correct answer: C

Kerberos tickets correspond most closely to public-key certificates in PKI. Both are issued by a trusted authority (Kerberos server or Certificate Authority), contain identifying information about the subject, are digitally signed by the issuing authority, and are presented to third parties to prove the holder's identity and authorization.

Why the other options are wrong:

• A. Public keys are not issued by a central authority in the same way and are not comparable to tickets in function.
• B. Private keys are secret and kept by the user; they are not presented to third parties like tickets are.
• D. Private-key certificates are not a standard PKI concept; the equivalent in PKI is public-key certificates, not private-key certificates.

Correct answer: A

A magnetically striped card is NOT a system-sensing wireless proximity card. Magnetically striped cards require physical contact or very close proximity for a magnetic reader to extract data, and they do not actively communicate with a sensing system like wireless proximity cards do. Wireless proximity cards use radio frequency or other wireless technologies for sensing.

Why the other options are wrong:

• B. Passive devices are a type of wireless proximity card that reflects or responds to signals without active power.
• C. Field-powered devices are wireless proximity cards that derive power from the electromagnetic field of the reader.
• D. Transponders are wireless proximity cards that actively transmit identifying information when energized by a reader's signal.

Correct answer: A

A photoelectric sensor is NOT a type of motion detector. Photoelectric sensors detect the presence or absence of an object by emitting light and measuring reflections; they detect object presence, not motion. The other options are all active motion detection technologies that sense movement through infrared radiation, microwave signals, or ultrasonic waves.

Why the other options are wrong:

• B. Passive infrared sensors detect motion by sensing changes in heat radiation emitted by moving objects.
• C. Microwave sensors detect motion by emitting microwave signals and analyzing reflections for movement patterns.
• D. Ultrasonic sensors detect motion by emitting ultrasonic waves and analyzing Doppler shifts caused by moving objects.

Correct answer: A

Traffic padding is a defensive technique used to add dummy data to communications to obscure actual traffic patterns and protect against traffic analysis attacks. It is NOT a penetration testing technique. Scanning and probing, war dialing, and sniffing are all active penetration testing methodologies used to discover vulnerabilities and gather information about target systems.

Why the other options are wrong:

• B. Scanning and probing are fundamental penetration testing techniques used to identify open ports and services.
• C. War dialing is a penetration testing technique used to discover modems and remote access points on a network.
• D. Sniffing is a penetration testing technique used to capture and analyze network traffic for sensitive information.

Correct answer: A

The Access Control Matrix model explicitly identifies subjects (users, processes) and objects (files, resources) and creates a matrix showing what permissions each subject has for each object. This allows for a quick summary of all permissions in a system and is the standard model for representing discretionary access control relationships.

Why the other options are wrong:

• B. The Take-Grant model focuses on how rights can be transferred between subjects and objects, not on specifying permissions in a matrix format.
• C. The Bell-LaPadula model is a confidentiality-focused model concerned with security levels and classification, not permission matrices.
• D. The Biba model is an integrity-focused model concerned with preventing unauthorized modifications, not permission matrices.

Correct answer: A

The Bell-LaPadula model is specifically designed for confidentiality protection by comparing a subject's clearance level to an object's classification level and enforcing rules (like the simple security property and the star property) to control how interactions occur between different classification levels.

Why the other options are wrong:

• B. The Biba model focuses on integrity by preventing unauthorized modification, not on comparing clearance to classification.
• C. The Access Matrix model represents permissions directly without the concept of clearance levels and classification comparisons.
• D. The Take-Grant model focuses on the transfer of rights between subjects and objects, not clearance-to-classification comparisons.

Correct answer: A

In the TCSEC (Orange Book) rating system, Class B is the lowest class that defines mandatory protection requirements. The hierarchy goes from Division D (minimal) at the bottom, then Class C (discretionary), then Class B (mandatory), with Class A at the top representing verified design.

Why the other options are wrong:

• B. Class A is the highest assurance class in TCSEC, not the first level of mandatory protection.
• C. Class C is the discretionary protection level, which comes before mandatory protection in the TCSEC hierarchy.
• D. Division D is the minimal protection level and does not include mandatory protection requirements.

Correct answer: A

Class C in the TCSEC (Orange Book) is defined as the discretionary protection level. It requires discretionary access control (DAC) mechanisms and is the first formal class in the rating system, sitting above Division D (minimal protection).

Why the other options are wrong:

• B. Class B defines mandatory protection requirements, not discretionary protection.
• C. Class A is the highest assurance class with verified design, not a discretionary protection class.
• D. Division D is minimal protection and does not provide discretionary access control requirements.

Correct answer: A

Division D in the TCSEC (Orange Book) is explicitly defined as the minimal protection level. It is the lowest division and represents systems that do not meet the security requirements of the higher divisions.

Why the other options are wrong:

• B. Division C defines discretionary protection, which is higher than minimal protection.
• C. Division B defines mandatory protection, which is higher than minimal protection.
• D. Division A is the highest division with verified design and trusted facility management, well above minimal protection.

Correct answer: A

The TCSEC (Trusted Computer System Evaluation Criteria), also known as the Orange Book, was developed by the National Computer Security Center (NCSC) for the US Department of Defense to evaluate the security of computer systems.

Why the other options are wrong:

• B. ITSEC (Information Technology Security Evaluation Criteria) was developed by European countries, not the US Department of Defense.
• C. DIACAP (DoD Information Assurance Certification and Accreditation Process) is a DoD process but was developed later and is not the original NCSC standard.
• D. NIACAP (National Information Assurance Certification and Accreditation Process) is a federal process but was not developed by the NCSC for the original DoD computer security evaluation.

Correct answer: A

SESAME (Secure European System for Applications in a Multi-vendor Environment) was developed to address weaknesses in Kerberos by incorporating public key cryptography for the distribution of secret keys and providing enhanced access control support through privilege attribute certificates (PACs).

Why the other options are wrong:

• B. RADIUS (Remote Authentication Dial-In User Service) is an authentication protocol for remote access but does not use public key cryptography for secret key distribution.
• C. KryptoKnight is an authentication protocol but was not specifically developed to address Kerberos weaknesses with public key cryptography.
• D. TACACS+ is a centralized authentication protocol that improved upon TACACS but does not incorporate public key cryptography for secret key distribution as a primary design feature.

Correct answer: B

Single Sign-On provides two primary advantages: convenience for users (one login for multiple systems) and centralized administration (managing credentials and access policies from one location). While data and network administration may benefit secondarily, the core advantages are user convenience and centralized administrative control of authentication.

Why the other options are wrong:

• A. Incomplete; SSO offers benefits beyond just user convenience.
• C. Centralized data administration is not a primary characteristic of SSO.
• D. Centralized network administration is not a primary characteristic of SSO.

Correct answer: D

Vulnerability assessment of a facility examines actual weaknesses and risks through inspection, historical loss data, and evaluation of existing security controls. Security budget does not assess vulnerability itself-it is a resource constraint that may limit remediation, but does not measure or evaluate actual vulnerability to damage or attack.

Why the other options are wrong:

• A. Inspection directly identifies vulnerabilities in facility design and controls.
• B. History of losses reveals patterns of past successful attacks or breaches.
• C. Security controls assessment identifies gaps and weaknesses in protections.