ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 1:

  What does the simple security (ss) property mean in the Bell-LaPadula model?

  A. No read up
  B. No write down
  C. No read down
  D. No write up
  A. No read up

  ---

  The ss (simple security) property of the Bell-LaPadula access control model states that reading of information by a subject at a lower sensitivity level from an object at a higher sensitivity level is not permitted (no read up). Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 5: Security Architectures and Models (page 202).

• Question 2:

  Which of the following is NOT a common category/classification of threat to an IT system?

  A. Human
  B. Natural
  C. Technological
  D. Hackers
  D. Hackers

  ---

  Hackers are classified as a human threat and not a classification by itself.

  All the other answers are incorrect. Threats result from a variety of factors, although they are classified in three types: Natural (e.g., hurricane, tornado, flood and fire), human (e.g. operator error, sabotage, malicious code) or technological

  (e.g. equipment failure, software error, telecommunications network outage, electric power failure).

  Reference:

  SWANSON, Marianne, and al., National Institute of Standards and Technology (NIST), http://csrc.nist.gov/ publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf, June 2002 (page 6).

• Question 3:

  Which of the following would constitute the best example of a password to use for access to a system by a network administrator?

  A. holiday
  B. Christmas12
  C. Jenny
  D. GyN19Za!
  D. GyN19Za!

  ---

  GyN19Za! would be the the best answer because it contains a mixture of upper and lower case characters, alphabetic and numeric characters, and a special character making it less vulnerable to password attacks.

  All of the other answers are incorrect because they are vulnerable to brute force or dictionary attacks. Passwords should not be common words or names. The addition of a number to the end of a common word only marginally strengthens it because a common password attack would also check combinations of words:

  Christmas23 Christmas123 etc...

• Question 4:

  Which security model introduces access to objects only through programs?

  A. The Biba model
  B. The Bell-LaPadula model
  C. The Clark-Wilson model
  D. The information flow model
  C. The Clark-Wilson model

  ---

  In the Clark-Wilson model, the subject no longer has direct access to objects but instead must access them through programs (well -formed transactions).

  The ClarkWilson integrity model provides a foundation for specifying and analyzing an integrity policy for a computing system.

  The model is primarily concerned with formalizing the notion of information integrity. Information integrity is maintained by preventing corruption of data items in a system due to either error or malicious intent. An integrity policy describes how

  the data items in the system should be kept valid from one state of the system to the next and specifies the capabilities of various principals in the system. The model defines enforcement rules and certification rules.

  ClarkWilson is more clearly applicable to business and industry processes in which the integrity of the information content is paramount at any level of classification.

  Integrity goals of ClarkWilson model:

  Prevent unauthorized users from making modification (Only this one is addressed by the Biba model).

  Separation of duties prevents authorized users from making improper modifications.

  Well formed transactions: maintain internal and external consistency i.e. it is a series of operations that are carried out to transfer the data from one consistent state to the other.

  The following are incorrect answers:

  The Biba model is incorrect. The Biba model is concerned with integrity and controls access to objects based on a comparison of the security level of the subject to that of the object.

  The Bell-LaPdaula model is incorrect. The Bell-LaPaula model is concerned with confidentiality and controls access to objects based on a comparison of the clearence level of the subject to the classification level of the object.

  The information flow model is incorrect. The information flow model uses a lattice where objects are labelled with security classes and information can flow either upward or at the same level. It is similar in framework to the Bell-LaPadula

  model.

  References:

  ISC2 Official Study Guide, Pages 325 - 327

  AIO3, pp. 284 - 287

  AIOv4 Security Architecture and Design (pages 338 - 342)

  AIOv5 Security Architecture and Design (pages 341 - 344)

  Wikipedia at: https://en.wikipedia.org/wiki/Clark-Wilson_model

• Question 5:

  Which of the following remote access authentication systems is the most robust?

  A. TACACS+
  B. RADIUS
  C. PAP
  D. TACACS
  A. TACACS+

  ---

  TACACS+ is a proprietary Cisco enhancement to TACACS and is more robust than RADIUS. PAP is not a remote access authentication system but a remote node security protocol.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 122).

• Question 6:

  Which of the following statements pertaining to ethical hacking is incorrect?

  A. An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/or networking services.
  B. Testing should be done remotely to simulate external threats.
  C. Ethical hacking should not involve writing to or modifying the target systems negatively.
  D. Ethical hackers never use tools that have the potential of affecting servers or services.
  D. Ethical hackers never use tools that have the potential of affecting servers or services.

  ---

  This means that many of the tools used for ethical hacking have the potential of exploiting vulnerabilities and causing disruption to IT system. It is up to the individuals performing the tests to be familiar with their use and to make sure that no

  such disruption can happen or at least shoudl be avoided.

  The first step before sending even one single packet to the target would be to have a signed agreement with clear rules of engagement and a signed contract. The signed contract explains to the client the associated risks and the client must

  agree to them before you even send one packet to the target range. This way the client understand that some of the test could lead to interruption of service or even crash a server. The client signs that he is aware of such risks and willing to

  accept them.

  The following are incorrect answers:

  An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/or networking services. An ethical hacking firm's independence can be questioned if they sell security solutions at the same time

  as doing testing for the same client. There has to be independance between the judge (the tester) and the accuse (the client).

  Testing should be done remotely to simulate external threats Testing simulating a cracker from the Internet is often time one of the first test being done, this is to validate perimeter security. By performing tests remotely, the ethical hacking

  firm emulates the hacker's approach more realistically.

  Ethical hacking should not involve writing to or modifying the target systems negatively. Even though ethical hacking should not involve negligence in writing to or modifying the target systems or reducing its response time, comprehensive

  penetration testing has to be performed using the most complete tools available just like a real cracker would.

  Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Appendix F: The Case for Ethical Hacking (page 520).

• Question 7:

  What does the Clark-Wilson security model focus on?

  A. Confidentiality
  B. Integrity
  C. Accountability
  D. Availability
  B. Integrity

  ---

  The Clark-Wilson model addresses integrity. It incorporates mechanisms to enforce internal and external consistency, a separation of duty, and a mandatory integrity policy.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 5: Security Architectures and Models (page 205).

• Question 8:

  Attributes that characterize an attack are stored for reference using which of the following Intrusion Detection System (IDS) ?

  A. signature-based IDS
  B. statistical anomaly-based IDS
  C. event-based IDS
  D. inferent-based IDS
  A. signature-based IDS

  ---

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 49.

• Question 9:

  Which of the following is the LEAST user accepted biometric device?

  A. Fingerprint
  B. Iris scan
  C. Retina scan
  D. Voice verification
  C. Retina scan

  ---

  The biometric device that is least user accepted is the retina scan, where a system scans the blood-vessel pattern on the backside of the eyeball. When using this device, an individual has to place their eye up to a device, and may require a puff of air to be blown into the eye. The iris scan only needs for an individual to glance at a camera that could be placed above a door.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter

  4: Access Control (page 131).

• Question 10:

  Which of the following questions are least likely to help in assessing controls covering audit trails?

  A. Does the audit trail provide a trace of user actions?
  B. Are incidents monitored and tracked until resolved?
  C. Is access to online logs strictly controlled?
  D. Is there separation of duties between security personnel who administer the access control function and those who administer the audit trail?
  B. Are incidents monitored and tracked until resolved?

  ---

  Audit trails maintain a record of system activity by system or application processes and by user activity. In conjunction with appropriate tools and procedures, audit trails can provide individual accountability, a means to reconstruct events,

  detect intrusions, and identify problems. Audit trail controls are considered technical controls. Monitoring and tracking of incidents is more an operational control related to incident response capability.

  Reference(s) used for this question:

  SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-50 to A-51).

  NOTE: NIST SP 800-26 has been superceded By: FIPS 200, SP 800-53, SP 800-53A

  You can find the new replacement at: http://csrc.nist.gov/publications/PubsSPs.html

  However, if you really wish to see the old standard, it is listed as an archived document at:

  http://csrc.nist.gov/publications/PubsSPArch.html