ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 1021:

  Which of the following standards is concerned with message handling?

  A. X.400
  B. X.500
  C. X.509
  D. X.800
  A. X.400

  ---

  X.400 is used in e-mail as a message handling protocol. X.500 is used in directory services. X.509 is used in digital certificates and X.800 is used a network security standard. Reference: http://www.alvestrand.no/x400/.

• Question 1022:

  Which security model is based on the military classification of data and people with clearances?

  A. Brewer-Nash model
  B. Clark-Wilson model
  C. Bell-LaPadula model
  D. Biba model
  C. Bell-LaPadula model

  ---

  The Bell-LaPadula model is a confidentiality model for information security based on the military classification of data, on people with clearances and data with a classification or sensitivity model. The Biba, Clark-Wilson and Brewer-Nash models are concerned with integrity.

  Source: HARE, Chris, Security Architecture and Models, Area 6 CISSP Open Study Guide, January 2002.

• Question 1023:

  Which of the following would assist the most in Host Based intrusion detection?

  A. audit trails.
  B. access control lists.
  C. security clearances
  D. host-based authentication
  A. audit trails.

  ---

  To assist in Intrusion Detection you would review audit logs for access violations.

  The following answers are incorrect:

  access control lists. This is incorrect because access control lists determine who has access to what but do not detect intrusions.

  security clearances. This is incorrect because security clearances determine who has access to what but do not detect intrusions.

  host-based authentication. This is incorrect because host-based authentication determine who have been authenticated to the system but do not dectect intrusions.

• Question 1024:

  Communications and network security relates to transmission of which of the following?

  A. voice
  B. voice and multimedia
  C. data and multimedia
  D. voice, data and multimedia
  B. voice and multimedia

  ---

  From the published (ISC)2 goals for the Certified Information Systems Security Professional candidate:

  The CISSP candidate should be familiar to communications and network security as it relates to voice, data, multimedia, and facsimile transmissions in terms of local area, wide area, and remote access.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 57.

• Question 1025:

  Which xDSL flavour, appropriate for home or small offices, delivers more bandwidth downstream than upstream and over longer distance?

  A. VDSL
  B. SDSL
  C. ADSL
  D. HDSL
  C. ADSL

  ---

  Asymmetric digital subscriber line (ADSL) is designed to provide more bandwidth downstream (1 to 8 Mbps) than upstream (16 to 800Kb).

  DSL (Digital Subscriber Line) is a modem technology for broadband data access over ordinary copper telephone lines (POTS) from homes and businesses. xDSL refers collectively to all types of DSL, such as ADSL (and G.Lite), HDSL,

  SDSL, IDSL and VDSL etc. They are sometimes referred to as last-mile (or first mile) technologies because they are used only for connections from a telephone switching station to a home or office, not between switching stations.

  xDSL is similar to ISDN in as much as both operate over existing copper telephone lines (POTS) using sophisticated modulation schemes and both require the short runs to a central telephone office

  Graphic below from: http://computer.howstuffworks.com/vdsl3.htm

  

  DSL speed chart

  The following are incorrect answers:

  Single-line Digital Subscriber Line (SDSL) deliver 2.3 Mbps of bandwidth each way.

  High-rate Digital Subscriber Line (HDSL) deliver 1.544 Mbps of bandwidth each way.

  Very-high data-rate Digital Subscriber Line (VDSL) can deliver up to 52 Mbps downstream over a single copper twisted pair over a relatively short distance (1000 to 4500 feet).

  Reference used for this question:

  http://computer.howstuffworks.com/vdsl3.htm

  and

  http://www.javvin.com/protocolxDSL.html and KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 115).

• Question 1026:

  Controls are implemented to:

  A. eliminate risk and reduce the potential for loss
  B. mitigate risk and eliminate the potential for loss
  C. mitigate risk and reduce the potential for loss
  D. eliminate risk and eliminate the potential for loss
  C. mitigate risk and reduce the potential for loss

  ---

  Controls are implemented to mitigate risk and reduce the potential for loss. Preventive controls are put in place to inhibit harmful occurrences; detective controls are established to discover harmful occurrences; corrective controls are used to

  restore systems that are victims of harmful attacks.

  It is not feasible and possible to eliminate all risks and the potential for loss as risk/threats are constantly changing.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 32.

• Question 1027:

  Which of the following is used in database information security to hide information?

  A. Inheritance
  B. Polyinstantiation
  C. Polymorphism
  D. Delegation
  B. Polyinstantiation

  ---

  Polyinstantiation enables a relation to contain multiple tuples with the same primary keys with each instance distinguished by a security level. When this information is inserted into a database, lower-level subjects need to be restricted from this information. Instead of just restricting access, another set of data is created to fool the lower-level subjects into thinking that the information actually means something else.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  11: Application and System Development (page 727).

• Question 1028:

  The deliberate planting of apparent flaws in a system for the purpose of detecting attempted penetrations or confusing an intruder about which flaws to exploit is called:

  A. alteration
  B. investigation
  C. entrapment
  D. enticement.
  D. enticement.

  ---

  Enticement deals with someone that is breaking the law. Entrapment encourages someone to commit a crime that the individual may or many have had no intention of committing. Enticement is not necessarily illegal but does raise ethical

  arguments and may not be admissible in court. Enticement lures someone toward some evidence (a honeypot would be a great example) after that individual has already committed a crime.

  Entrapment is when you persuade someone to commit a crime when the person otherwise had no intention to commit a crime. Entrapment is committed by a law enforcement player where you get tricked into committing a crime for which you

  woud later on get arrested without knowing you rare committing such a scrime. It is illegal and unethical as well.

  All other choices were not applicable and only detractors.

  References:

  TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

  and

  CISSP Study Guide (Conrad, Misenar, Feldman). Elsevier. 2010. p. 428

  and

  http://www.dummies.com/how-to/content/security-certification-computer-forensics-and- inci.html

• Question 1029:

  Which of the following is most relevant to determining the maximum effective cost of access control?

  A. the value of information that is protected
  B. management's perceptions regarding data importance
  C. budget planning related to base versus incremental spending.
  D. the cost to replace lost data
  A. the value of information that is protected

  ---

  The cost of access control must be commensurate with the value of the information that is being protected.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 49.

• Question 1030:

  How are memory cards and smart cards different?

  A. Memory cards normally hold more memory than smart cards
  B. Smart cards provide a two-factor authentication whereas memory cards don't
  C. Memory cards have no processing power
  D. Only smart cards can be used for ATM cards
  C. Memory cards have no processing power

  ---

  The main difference between memory cards and smart cards is their capacity to process information. A memory card holds information but cannot process information. A smart card holds information and has the necessary hardware and

  software to actually process that information.

  A memory card holds a user's authentication information, so that this user needs only type in a user ID or PIN and presents the memory card to the system. If the entered information and the stored information match and are approved by an

  authentication service, the user is successfully authenticated.

  A common example of a memory card is a swipe card used to provide entry to a building. The user enters a PIN and swipes the memory card through a card reader. If this is the correct combination, the reader flashes green and the individual

  can open the door and enter the building.

  Memory cards can also be used with computers, but they require a reader to process the information. The reader adds cost to the process, especially when one is needed for every computer. Additionally, the overhead of PIN and card

  generation adds additional overhead and complexity to the whole authentication process. However, a memory card provides a more secure authentication method than using only a password because the attacker would need to obtain the

  card and know the correct PIN. Administrators and management need to weigh the costs and benefits of a memory card implementation as well as the security needs of the organization to determine if it is the right authentication mechanism

  for their environment.

  One of the most prevalent weaknesses of memory cards is that data stored on the card are not protected. Unencrypted data on the card (or stored on the magnetic strip) can be extracted or copied. Unlike a smart card, where security controls

  and logic are embedded in the integrated circuit, memory cards do not employ an inherent mechanism to protect the data from exposure.

  Very little trust can be associated with confidentiality and integrity of information on the memory cards.

  The following answers are incorrect:

  "Smart cards provide two-factor authentication whereas memory cards don't" is incorrect. This is not necessarily true. A memory card can be combined with a pin or password to offer two factors authentication where something you have and

  something you know are used for factors.

  "Memory cards normally hold more memory than smart cards" is incorrect. While a memory card may or may not have more memory than a smart card, this is certainly not the best answer to the question.

  "Only smart cards can be used for ATM cards" is incorrect. This depends on the decisions made by the particular institution and is not the best answer to the question.

  Reference(s) used for this question:

  Shon Harris, CISSP All In One, 6th edition , Access Control, Page 199 and also for people using the Kindle edition of the book you can look at Locations 4647-4650. Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK,

  Third Edition :

  Access Control ((ISC)2 Press) (Kindle Locations 2124-2139). Auerbach Publications. Kindle Edition.