SSCP Security Operations and Administration Quiz

1. What is the purpose of a password policy in an organization?

To make passwords easier to remember

To establish standards for strong, secure passwords

To eliminate the need for authentication

To reduce login time for users

2. Which security principle ensures that users can only perform actions they are explicitly authorized to perform?

Accountability

Authorization

Authentication

Availability

3. In user access management, what is 'offboarding'?

Training new employees on security policies

Granting elevated privileges to users

Removing system access from departing employees

Implementing multi-factor authentication

4. What does the concept of 'defense in depth' mean in security operations?

Using only one strong security measure

Implementing multiple layers of security controls

Focusing security efforts on external threats only

Eliminating all security exceptions

5. Which type of security control operates after a security event has occurred?

Preventive

Detective

Corrective

Deterrent

6. What is the primary purpose of conducting periodic access reviews?

To increase user productivity

To verify that access rights remain appropriate and remove unnecessary permissions

To eliminate all security policies

To reduce IT staffing requirements

7. Which of the following is a key element of an incident response plan?

Employee vacation schedules

Defined roles and responsibilities

Customer complaint procedures

Marketing strategies

8. What is the primary advantage of implementing role-based access control over discretionary access control?

Users have more freedom

It is easier to manage permissions at scale

It requires less administrative effort

It eliminates the need for audits

9. Which security control type is designed to reduce the likelihood of a threat occurring?

Detective control

Preventive control

Corrective control

Compensating control

10. In security operations, what does the term 'baseline' refer to?

The minimum acceptable security standard

The highest level of security achievable

A vulnerability assessment report

An emergency response plan

11. Which access control model grants permissions based on a user's role within the organization?

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

Attribute-Based Access Control (ABAC)

Mandatory Access Control (MAC)

12. Which of the following best describes the concept of separation of duties?

One person performing all security tasks

Distributing tasks so no single person can compromise security

Assigning all tasks to the most experienced employee

Eliminating redundancy in security operations

13. What is a security audit trail primarily used for?

Preventing unauthorized access

Recording and tracking user actions for accountability

Encrypting sensitive data

Managing network bandwidth

14. Which process ensures that terminated employees no longer have access to organizational systems?

Account provisioning

Access review

Account deprovisioning

Permission escalation

15. What is the primary benefit of implementing mandatory access controls (MAC)?

Increased user flexibility

Enforcement of security policies at the system level

Reduced administrative costs

Simplified user training

16. Which authentication factor is something you know?

Fingerprint

Password

Smart card

Facial recognition

17. In incident response, what is the primary goal of the containment phase?

To eliminate the threat and restore systems

To stop the attack from spreading further

To collect evidence for legal prosecution

To notify all affected customers

18. What does a security information and event management (SIEM) system primarily do?

Encrypts all network traffic

Aggregates and analyzes security logs from multiple sources

Prevents all malware infections

Manages user passwords

19. Which of the following is NOT a typical component of user access provisioning?

Account creation and configuration

Permission assignment

Hardware disposal

System access setup

20. What is the primary purpose of the principle of least privilege in access management?

To maximize user productivity

To grant users only the minimum permissions needed for their job

To eliminate all security restrictions

To reduce administrative overhead