CCSP-P1-F

What is the major difference between authentication and authorization?

• A. Code verification/code implementation

• B. Identity validation/access permission

• C. Inverse incantation/obverse instantiation

• D. User access/privileged access

Access should be based on .

• A. Regulatory mandates

• B. Business needs and acceptable risk

• C. User requirements and management requests

• D. Optimum performance and security provision

All of the following are identity federation standards commonly found in use today except _______.

• WS-Federation

• OpenID

• OAuth (Open Authorization)

• Pretty Good Privacy (PGP)

Which of the following is a federation standard/protocol that does not rely on Simple t Object Access Protocol (SOAP), Security Assertion Markup Language (SAML), or Extensible Markup Language (XML)?

• A. WS-Federation

• B. OpenID Connect

• C. Service Organization Control (SOC) 2

• D. Open Web Application Security Project (OWASP)

Authentication mechanisms typically include any or all of the following except .

• A. Something you know

• B. Someone you know

• C. Something you have

• D. Something you are

Which of the following constitutes a multifactor authentication process or procedure?

• A. Using an automated teller machine (ATM) to get cash with your credit or debit card

• B. Using a password and personal identification number (PIN) to log into a website

• C. Presenting a voice sample and fingerprint to access a secure facility

• D. Displaying a birth certificate and a credit card

A web application firewall (WAF) can understand and act on traffic.

• A. Malicious

• B. Simple Mail Transfer Protocol (SMTP)

• C. Internet Control Message Protocol (ICMP)

• D. Hypertext Transfer Protocol (HTTP)

Who publishes the list of cryptographic modules validated according to the Federal Information Processing Standard (FIPS) 140-2?

• A. The U.S. Office of Management and Budget (OMB)

• B. The International Standards Organization (ISO)

• C. International Information System Security Certification Consortium, or (ISC) 2

• D. The National Institute of Standards and Technology (NIST)

Who performs the review process for hardware security modules (HSMs) in accordance with the Federal Information Processing Standard (FIPS) 140-2?

• A. The National Institute of Standards and Technology (NIST)

• B. The National Security Agency (NSA)

• C. Independent (private) laboratories

• D. The European Union Agency for Network and Information Security (ENISA)

In terms of the number of security functions offered, which is the highest Federal Information Processing Standard (FIPS) 140-2 security level a cryptographic module can achieve in certification?

• A. 1

• B. 2

• C. 3

• D. 4