Exam SSCP topic 3 question 52 discussion

Actual exam question from ISC's SSCP

Question #: 52
Topic #: 3

[All SSCP Questions]

A periodic review of user account management should not determine:

A. Conformity with the concept of least privilege.
B. Whether active accounts are still being used.
C. Strength of user-chosen passwords.
D. Whether management authorizations are up-to-date.

Show Suggested Answer

Suggested Answer: C 🗳️
Organizations should have a process for (1) requesting, establishing, issuing, and closing user accounts; (2) tracking users and their respective access authorizations; and (3) managing these functions.
Reviews should examine the levels of access each individual has, conformity with the concept of least privilege, whether all accounts are still active, whether management authorizations are up-to-date, whether required training has been completed, and so forth. These reviews can be conducted on at least two levels:
(1) on an application-by-application basis, or (2) on a system wide basis.
The strength of user passwords is beyond the scope of a simple user account management review, since it requires specific tools to try and crack the password file/database through either a dictionary or brute-force attack in order to check the strength of passwords.
Reference(s) used for this question:
SWANSON, Marianne & GUTTMAN, Barbara, National Institute of Standards and Technology (NIST), NIST Special Publication 800-14, Generally Accepted
Principles and Practices for Securing Information Technology Systems, September 1996 (page 28).

by xymavu at April 4, 2025, 11:19 p.m.

Comments

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!