ISC2 SSCPFree Systems Security Certified Practitioner practice test

Correct answer: D. Insights derived from wisdom

Breakthrough realizations produce insights that emerge from wisdom, placing them at the apex of the DIKW pyramid. The hierarchy moves upward from Data to Information to Knowledge to Wisdom, with Insights often treated as an extension of or companion to the Wisdom level. Movement between levels is driven by specific activities: processing and modeling move data to information, hypothesis generation moves information to knowledge, and the consolidation of established ideas moves knowledge to wisdom.

Correct answer: D. Separation of duties

Requiring two individuals to jointly complete a task is an implementation of dual control, which falls under separation of duties. No single employee can independently authorize or execute the high-risk transaction, reducing the opportunity for fraud or error. Least privilege limits permissions to the scope of a user's role. Need to know restricts access to information based on job requirements. Defense in depth is a layered security strategy that uses multiple independent safeguards.

Correct answer: C. Act honorably, honestly, justly, responsibly, and legally

Acting honorably and responsibly requires a practitioner to acknowledge the boundaries of their own competence and to be transparent rather than misrepresenting their qualifications. Proceeding with work that demands skills the practitioner does not possess would be dishonest and irresponsible. Providing diligent and competent service relates to quality of work delivered but is secondary when the core issue is honesty about one's qualifications. Advancing and protecting the profession concerns the field's broader reputation. Protecting society applies when public safety or critical infrastructure is directly at risk, which is not the primary concern here.

Correct answer: D. Report the behavior to uphold public trust and professional standards

The (ISC)2 Code of Ethics places protecting society, public trust, and the integrity of the profession above personal or organizational comfort. Ethical practitioners are expected to take proactive steps to prevent harm, even when doing so is socially costly. Staying silent places team convenience ahead of professional responsibility. Informal handling without documentation may be suitable for minor issues but does not ensure accountability. Waiting for a confirmed policy violation allows unethical conduct to continue and does not represent proactive ethical judgment.

Correct answer: A. Job rotation

Job rotation creates natural opportunities for incoming employees to discover irregularities left by their predecessors, and it limits the window any single employee has to exploit their role. This dual benefit of detection and prevention makes it especially effective against fraud. Need to know restricts access to sensitive information but does not create detection opportunities. Separation of duties divides responsibilities to prevent any one person from completing a fraudulent act alone, but it is less effective at detecting fraud already in progress. Least privilege limits the permissions granted to users and reduces the scope of potential damage but does not provide detection capability.

Correct answer: D. Non-repudiation

Read receipts are intended to provide non-repudiation by generating evidence that a message was received and opened, making it difficult for the recipient to deny awareness of its contents. Confidentiality concerns protecting message content from unauthorized disclosure, which read receipts do not address. Integrity concerns whether message content has been altered in transit, which read receipts do not verify. Authenticity concerns confirming the identity of the sender or recipient, not whether the email was opened.

Correct answer: B. Confidentiality

Corporate espionage is fundamentally an attack on confidentiality. The attacker's objective is to obtain sensitive information that is not authorized for disclosure, exposing it to unauthorized parties. Availability concerns whether systems and data remain accessible to authorized users and is not the target of this attack. Authenticity concerns whether information comes from a trusted source, which is not the primary goal of the intrusion. Integrity concerns whether data remains accurate and unaltered; while espionage could potentially involve data manipulation, the primary motive here is unauthorized disclosure.

Correct answer: D. Development and acquisition

Integrating security testing directly into the development pipeline is a development and acquisition activity. This phase encompasses building systems securely and incorporating practices such as DevSecOps, which includes automated security checks during the build process. Planning and design establish requirements before development begins. Implementation and assessment take place after development is finished. Operation and maintenance apply to systems already running in production.

Correct answer: A. Confidentiality

Confidentiality is the principle of limiting access to information based on authorization. An administrative decision to restrict a user's access to a folder is a direct application of confidentiality controls. The CIANA framework covers Confidentiality (limiting who can access data), Integrity (ensuring data accuracy and completeness), Availability (ensuring timely and usable access to data), Non-repudiation (preventing denial of actions), and Authentication (verifying the identity of those who create or modify data).

Correct answer: C. GDPR

The General Data Protection Regulation (GDPR) is the European Union's comprehensive privacy law governing the collection, processing, and storage of personal data belonging to EU residents. A firm with offices in Paris that handles EU customer data is subject to GDPR in ways that a purely domestic US firm might not be. Sarbanes-Oxley (SOX) is a US law focused on corporate financial accountability and reporting. PCI DSS is an industry standard for protecting payment card data rather than a government privacy regulation. The Privacy Act of 1974 applies to US federal agencies, not private sector companies.