ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 991:

  Which of the following protocol was used by the INITIAL version of the Terminal Access Controller Access Control System TACACS for communication between clients and servers?

  A. TCP
  B. SSL
  C. UDP
  D. SSH
  C. UDP

  ---

  The original TACACS, developed in the early ARPANet days, had very limited functionality and used the UDP transport. In the early 1990s, the protocol was extended to include additional functionality and the transport changed to TCP.

  TACACS is defined in RFC 1492, and uses (either TCP or UDP) port 49 by default. TACACS allows a client to accept a username and password and send a query to a TACACS authentication server, sometimes called a TACACS daemon or simply TACACSD. TACACSD uses TCP and usually runs on port

  49. It would determine whether to accept or deny the authentication request and send a response back.

  TACACS+

  TACACS+ and RADIUS have generally replaced TACACS and XTACACS in more recently built or updated networks. TACACS+ is an entirely new protocol and is not compatible with TACACS or XTACACS. TACACS+ uses the Transmission

  Control Protocol (TCP) and RADIUS uses the User Datagram Protocol (UDP). Since TCP is connection oriented protocol, TACACS+ does not have to implement transmission control. RADIUS, however, does have to detect and correct

  transmission errors like packet loss, timeout etc. since it rides on UDP which is connectionless.

  RADIUS encrypts only the users' password as it travels from the RADIUS client to RADIUS server. All other information such as the username, authorization, accounting are transmitted in clear text. Therefore it is vulnerable to different types

  of attacks. TACACS+ encrypts all the information mentioned above and therefore does not have the vulnerabilities present in the RADIUS protocol.

  RADIUS and TACACS + are client/ server protocols, which means the server portion cannot send unsolicited commands to the client portion. The server portion can only speak when spoken to. Diameter is a peer-based protocol that allows

  either end to initiate communication. This functionality allows the Diameter server to send a message to the access server to request the user to provide another authentication credential if she is attempting to access a secure resource.

  Reference(s) used for this question:

  http://en.wikipedia.org/wiki/TACACS

  and

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 239). McGraw-Hill.

  Kindle Edition.

• Question 992:

  What kind of encryption is realized in the S/MIME-standard?

  A. Asymmetric encryption scheme
  B. Password based encryption scheme
  C. Public key based, hybrid encryption scheme
  D. Elliptic curve based encryption
  C. Public key based, hybrid encryption scheme

  ---

  S/MIME (for Secure MIME, or Secure Multipurpose Mail Extension) is a security process used for e-mail exchanges that makes it possible to guarantee the confidentiality and non-repudiation of electronic messages.

  S/MIME is based on the MIME standard, the goal of which is to let users attach files other than ASCII text files to electronic messages. The MIME standard therefore makes it possible to attach all types of files to e-mails.

  S/MIME was originally developed by the company RSA Data Security. Ratified in July 1999 by the IETF, S/ MIME has become a standard, whose specifications are contained in RFCs 2630 to 2633.

  How S/MIME works

  The S/MIME standard is based on the principle of public-key encryption. S/MIME therefore makes it possible to encrypt the content of messages but does not encrypt the communication.

  The various sections of an electronic message, encoded according to the MIME standard, are each encrypted using a session key.

  The session key is inserted in each section's header, and is encrypted using the recipient's public key. Only the recipient can open the message's body, using his private key, which guarantees the confidentiality and integrity of the received

  message.

  In addition, the message's signature is encrypted with the sender's private key. Anyone intercepting the communication can read the content of the message's signature, but this ensures the recipient of the sender's identity, since only the

  sender is capable of encrypting a message (with his private key) that can be decrypted with his public key.

  Reference(s) used for this question:

  http://en.kioskea.net/contents/139-cryptography-s-mime

  RFC 2630: Cryptographic Message Syntax;

  OPPLIGER, Rolf, Secure Messaging with PGP and S/MIME, 2000, Artech House;

  HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne, page 570;

  SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.

• Question 993:

  A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

  A. Mandatory Access Control
  B. Discretionary Access Control
  C. Non-Discretionary Access Control
  D. Rule-based Access control
  C. Non-Discretionary Access Control

  ---

  A central authority determines what subjects can have access to certain objects based on the organizational security policy.

  The key focal point of this question is the 'central authority' that determines access rights. Cecilia one of the quiz user has sent me feedback informing me that NIST defines MAC as:

  "MAC Policy means that Access Control Policy Decisions are made by a CENTRAL AUTHORITY. Which seems to indicate there could be two good answers to this question.

  However if you read the NISTR document mentioned in the references below, it is also mentioned that:

  MAC is the most mentioned NDAC policy. So MAC is a form of NDAC policy.

  Within the same document it is also mentioned: "In general, all access control policies other than DAC are grouped in the category of non- discretionary access control (NDAC). As the name implies, policies in this category have rules that are

  not established at the discretion of the user. Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action."

  Under NDAC you have two choices:

  Rule Based Access control and Role Base Access Control MAC is implemented using RULES which makes it fall under RBAC which is a form of NDAC.

  It is a subset of NDAC.

  This question is representative of what you can expect on the real exam where you have more than once choice that seems to be right. However, you have to look closely if one of the choices would be higher level or if one of the choice falls

  under one of the other choice. In this case NDAC is a better choice because MAC is falling under NDAC through the use of Rule Based Access Control.

  The following are incorrect answers:

  MANDATORY ACCESS CONTROL

  In Mandatory Access Control the labels of the object and the clearance of the subject determines access rights, not a central authority. Although a central authority (Better known as the Data Owner) assigns the label to the object, the system

  does the determination of access rights automatically by comparing the Object label with the Subject clearance. The subject clearance MUST dominate (be equal or higher) than the object being accessed.

  The need for a MAC mechanism arises when the security policy of a system dictates that:

  1.

  Protection decisions must not be decided by the object owner.

  2.

  The system must enforce the protection decisions (i.e., the system enforces the security policy over the wishes or intentions of the object owner).

  Usually a labeling mechanism and a set of interfaces are used to determine access based on the MAC policy; for example, a user who is running a process at the Secret classification should not be allowed to read a file with a label of Top Secret. This is known as the "simple security rule," or "no read up."

  Conversely, a user who is running a process with a label of Secret should not be allowed to write to a file with a label of Confidential. This rule is called the "*-property" (pronounced "star property") or "no write down." The *-property is required to maintain system security in an automated environment.

  DISCRETIONARY ACCESS CONTROL

  In Discretionary Access Control the rights are determined by many different entities, each of the persons who have created files and they are the owner of that file, not one central authority.

  DAC leaves a certain amount of access control to the discretion of the object's owner or anyone else who is authorized to control the object's access. For example, it is generally used to limit a user's access to a file; it is the owner of the file who controls other users' accesses to the file. Only those users specified by the owner may have some combination of read, write, execute, and other permissions to the file.

  DAC policy tends to be very flexible and is widely used in the commercial and government sectors. However, DAC is known to be inherently weak for two reasons:

  First, granting read access is transitive; for example, when Ann grants Bob read access to a file, nothing stops Bob from copying the contents of Ann's file to an object that Bob controls. Bob may now grant any other user access to the copy of Ann's file without Ann's knowledge.

  Second, DAC policy is vulnerable to Trojan horse attacks. Because programs inherit the identity of the invoking user, Bob may, for example, write a program for Ann that, on the surface, performs some useful function, while at the same time destroys the contents of Ann's files. When investigating the problem, the audit files would indicate that Ann destroyed her own files. Thus, formally, the drawbacks of DAC are as follows:

  Discretionary Access Control (DAC) Information can be copied from one object to another; therefore, there is no real assurance on the flow of information in a system.

  No restrictions apply to the usage of information when the user has received it.

  The privileges for accessing objects are decided by the owner of the object, rather than through a system- wide policy that reflects the organization's security requirements. ACLs and owner/group/other access control mechanisms are by far the most common mechanism for implementing DAC policies. Other mechanisms, even though not designed with DAC in mind, may have the capabilities to implement a DAC policy.

  RULE BASED ACCESS CONTROL

  In Rule-based Access Control a central authority could in fact determine what subjects can have access when assigning the rules for access. However, the rules actually determine the access and so this is not the most correct answer.

  RuBAC (as opposed to RBAC, role-based access control) allow users to access systems and information based on pre determined and configured rules. It is important to note that there is no commonly understood definition or formally defined standard for rule-based access control as there is for DAC, MAC, and RBAC. "Rule-based access" is a generic term applied to systems that allow some form of organization-defined rules, and therefore rule-based access control encompasses a broad range of systems. RuBAC may in fact be combined with other models, particularly RBAC or DAC. A RuBAC system intercepts every access request and compares the rules with the rights of the user to make an access decision. Most of the rule-based access control relies on a security label system, which dynamically composes a set of rules defined by a security policy. Security labels are attached to all objects, including files, directories, and devices. Sometime roles to subjects (based on their attributes) are assigned as well. RuBAC meets the business needs as well as the technical needs of controlling service access. It allows business rules to be applied to access control--for example, customers who have overdue balances may be denied service access. As a mechanism for MAC, rules of RuBAC cannot be changed by users. The rules can be established by any attributes of a system related to the users such as domain, host, protocol, network, or IP addresses. For example, suppose that a user wants to access an object in another network on the other side of a router. The router employs RuBAC with the rule composed by the network addresses, domain, and protocol to decide whether or not the user can be granted access. If employees change their roles within the organization, their existing authentication credentials remain in effect and do not need to be re configured. Using rules in conjunction with roles adds greater flexibility because rules can be applied to people as well as to devices. Rule-based access control can be combined with role- based access control, such that the role of a user is one of the attributes in rule setting. Some provisions of access control systems have rule- based policy engines in addition to a role-based policy engine and certain implemented dynamic policies [Des03]. For example, suppose that two of the primary types of software users are product engineers and quality engineers. Both groups usually have access to the same data, but they have different roles to perform in relation to the data and the application's function. In addition, individuals within each group have different job responsibilities that may be identified using several types of attributes such as developing programs and testing areas. Thus, the access decisions can be made in real time by a scripted policy that regulates the access between the groups of product engineers and quality engineers, and each individual within these groups. Rules can either replace or complement role-based access control. However, the creation of rules and security policies is also a complex process, so each organization will need to strike the appropriate balance.

  References used for this question:

  http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316.pdf

  and

  AIO v3 p162-167 and OIG (2007) p.186-191 also

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 33.

• Question 994:

  Which of the following best corresponds to the type of memory addressing where the address location that is specified in the program instruction contains the address of the final desired location?

  A. Direct addressing
  B. Indirect addressing
  C. Indexed addressing
  D. Program addressing
  B. Indirect addressing

  ---

  Indirect addressing is when the address location that is specified in the program instruction contains the address of the final desired location. Direct addressing is when a portion of primary memory is accessed by specifying the actual address of the memory location. Indexed addressing is when the contents of the address defined in the program's instruction is added to that of an index register. Program addressing is not a defined memory addressing mode.

  Source: WALLHOFF, John, CBK#6 Security Architecture and Models (CISSP Study Guide), April 2002 (page 2).

• Question 995:

  Which of the following devices enables more than one signal to be sent out simultaneously over one physical circuit?

  A. Router
  B. Multiplexer
  C. Channel service unit/Data service unit (CSU/DSU)
  D. Wan switch
  B. Multiplexer

  ---

  Multiplexers are devices that enable enables more than one signal to be sent out simultaneously over one physical circuit.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 118).

• Question 996:

  Which of the following is based on the premise that the quality of a software product is a direct function of the quality of its associated software development and maintenance processes?

  A. The Software Capability Maturity Model (CMM)
  B. The Spiral Model
  C. The Waterfall Model
  D. Expert Systems Model
  A. The Software Capability Maturity Model (CMM)

  ---

  The Capability Maturity Model (CMM) is a service mark owned by Carnegie Mellon University (CMU) and refers to a development model elicited from actual data. The data was collected from organizations that contracted with the U.S.

  Department of Defense, who funded the research, and became the foundation from which CMU created the Software Engineering Institute (SEI). Like any model, it is an abstraction of an existing system.

  The Capability Maturity Model (CMM) is a methodology used to develop and refine an organization's software development process. The model describes a five-level evolutionary path of increasingly organized and systematically more mature

  processes. CMM was developed and is promoted by the Software Engineering Institute (SEI), a research and development center sponsored by the U.S. Department of Defense (DoD). SEI was founded in 1984 to address software

  engineering issues and, in a broad sense, to advance software engineering methodologies. More specifically, SEI was established to optimize the process of developing, acquiring, and maintaining heavily software-reliant systems for the DoD.

  Because the processes involved are equally applicable to the software industry as a whole, SEI advocates industry-wide adoption of the CMM.

  The CMM is similar to ISO 9001, one of the ISO 9000 series of standards specified by the International Organization for Standardization (ISO). The ISO 9000 standards specify an effective quality system for manufacturing and service

  industries; ISO 9001 deals specifically with software development and maintenance. The main difference between the two systems lies in their respective purposes: ISO 9001 specifies a minimal acceptable quality level for software

  processes, while the CMM establishes a framework for continuous process improvement and is more explicit than the ISO standard in defining the means to be employed to that end.

  CMM's Five Maturity Levels of Software Processes

  At the initial level, processes are disorganized, even chaotic. Success is likely to depend on individual efforts, and is not considered to be repeatable, because processes would not be sufficiently defined and documented to allow them to be

  replicated.

  At the repeatable level, basic project management techniques are established, and successes could be repeated, because the requisite processes would have been made established, defined, and documented.

  At the defined level, an organization has developed its own standard software process through greater attention to documentation, standardization, and integration.

  At the managed level, an organization monitors and controls its own processes through data collection and analysis.

  At the optimizing level, processes are constantly being improved through monitoring feedback from current processes and introducing innovative processes to better serve the organization's particular needs.

  When it is applied to an existing organization's software development processes, it allows an effective approach toward improving them. Eventually it became clear that the model could be applied to other processes. This gave rise to a more

  general concept that is applied to business processes and to developing people.

  CMM is superseded by CMMI

  The CMM model proved useful to many organizations, but its application in software development has sometimes been problematic. Applying multiple models that are not integrated within and across an organization could be costly in terms

  of training, appraisals, and improvement activities. The Capability Maturity Model Integration (CMMI) project was formed to sort out the problem of using multiple CMMs.

  For software development processes, the CMM has been superseded by Capability Maturity Model Integration (CMMI), though the CMM continues to be a general theoretical process capability model used in the public domain.

  CMM is adapted to processes other than software development

  The CMM was originally intended as a tool to evaluate the ability of government contractors to perform a contracted software project. Though it comes from the area of software development, it can be, has been, and continues to be widely

  applied as a general model of the maturity of processes (e.g., IT Service Management processes) in IS/IT (and other) organizations.

  Source:

  http://searchsoftwarequality.techtarget.com/sDefinition/0,,sid92_gci930057,00.html

  and

  http://en.wikipedia.org/wiki/Capability_Maturity_Model

• Question 997:

  Which of the following elements is NOT included in a Public Key Infrastructure (PKI)?

  A. Timestamping
  B. Repository
  C. Certificate revocation
  D. Internet Key Exchange (IKE)
  D. Internet Key Exchange (IKE)

  ---

  Other elements are included in a PKI.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 4: Cryptography (page 165).

• Question 998:

  This is a common security issue that is extremely hard to control in large environments. It occurs when a user has more computer rights, permissions, and access than what is required for the tasks the user needs to fulfill. What best describes this scenario?

  A. Excessive Rights
  B. Excessive Access
  C. Excessive Permissions
  D. Excessive Privileges
  D. Excessive Privileges

  ---

  Even thou all 4 terms are very close to each other, the best choice is Excessive Privileges which would include the other three choices presented.

  Reference(s) used for this question:

  HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2001, Page 645.

  and

• Question 999:

  Why does fiber optic communication technology have significant security advantage over other transmission technology?

  A. Higher data rates can be transmitted.
  B. Interception of data traffic is more difficult.
  C. Traffic analysis is prevented by multiplexing.
  D. Single and double-bit errors are correctable.
  B. Interception of data traffic is more difficult.

  ---

  It would be correct to select the first answer if the world "security" was not in the question. Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 1000:

  The communications products and services, which ensure that the various components of a network (such as devices, protocols, and access methods) work together refers to:

  A. Netware Architecture.
  B. Network Architecture.
  C. WAN Architecture.
  D. Multiprotocol Architecture.
  B. Network Architecture.

  ---

  A Network Architecture refers to the communications products and services, which ensure that the various components of a network (such as devices, protocols, and access methods) work together. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 101.