ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 1051:

  Which type of password provides maximum security because a new password is required for each new log-on?

  A. One-time or dynamic password
  B. Congnitive password
  C. Static password
  D. Passphrase
  A. One-time or dynamic password

  ---

  "one-time password" provides maximum security because a new password is required for each new log- on.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 36.

• Question 1052:

  What kind of certificate is used to validate a user identity?

  A. Public key certificate
  B. Attribute certificate
  C. Root certificate
  D. Code signing certificate
  A. Public key certificate

  ---

  In cryptography, a public key certificate (or identity certificate) is an electronic document which incorporates a digital signature to bind together a public key with an identity -- information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual.

  In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). In a web of trust scheme, the signature is of either the user (a self-signed certificate) or other users ("endorsements"). In either case, the signatures on a certificate are attestations by the certificate signer that the identity information and the public key belong together.

  In computer security, an authorization certificate (also known as an attribute certificate) is a digital document that describes a written permission from the issuer to use a service or a resource that the issuer controls or has access to use. The permission can be delegated.

  Some people constantly confuse PKCs and ACs. An analogy may make the distinction clear. A PKC can be considered to be like a passport: it identifies the holder, tends to last for a long time, and should not be trivial to obtain. An AC is more like an entry visa: it is typically issued by a different authority and does not last for as long a time. As acquiring an entry visa typically requires presenting a passport, getting a visa can be a simpler process. A real life example of this can be found in the mobile software deployments by large service providers and are typically applied to platforms such as Microsoft Smartphone (and related), Symbian OS, J2ME, and others.

  In each of these systems a mobile communications service provider may customize the mobile terminal client distribution (ie. the mobile phone operating system or application environment) to include one or more root certificates each associated with a set of capabilities or permissions such as "update firmware", "access address book", "use radio interface", and the most basic one, "install and execute". When a developer wishes to enable distribution and execution in one of these controlled environments they must acquire a certificate from an appropriate CA, typically a large commercial CA, and in the process they usually have their identity verified using out-of- band mechanisms such as a combination of phone call, validation of their legal entity through government and commercial databases, etc., similar to the high assurance SSL certificate vetting process, though often there are additional specific requirements imposed on would-be developers/publishers.

  Once the identity has been validated they are issued an identity certificate they can use to sign their software; generally the software signed by the developer or publisher's identity certificate is not distributed but rather it is submitted to processor to possibly test or profile the content before generating an authorization certificate which is unique to the particular software release. That certificate is then used with an ephemeral asymmetric key-pair to sign the software as the last step of preparation for distribution. There are many advantages to separating the identity and authorization certificates especially relating to risk mitigation of new content being accepted into the system and key management as well as recovery from errant software which can be used as attack vectors.

  References:

  HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne, page 540.

  http://en.wikipedia.org/wiki/Attribute_certificate

  http://en.wikipedia.org/wiki/Public_key_certificate

• Question 1053:

  Which of the following is an advantage of prototyping?

  A. Prototype systems can provide significant time and cost savings.
  B. Change control is often less complicated with prototype systems.
  C. It ensures that functions or extras are not added to the intended system.
  D. Strong internal controls are easier to implement.
  A. Prototype systems can provide significant time and cost savings.

  ---

  Prototype systems can provide significant time and cost savings, however they also have several disadvantages. They often have poor internal controls, change control becomes much more complicated and it often leads to functions or extras being added to the system that were not originally intended.

  Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 306).

• Question 1054:

  What is the highest amount a company should spend annually on countermeasures for protecting an asset valued at $1,000,000 from a threat that has an annualized rate of occurrence (ARO) of once every five years and an exposure factor (EF) of 30%?

  A. $300,000
  B. $150,000
  C. $60,000
  D. $1,500
  C. $60,000

  ---

  The cost of a countermeasure should not be greater in cost than the risk it mitigates (ALE). For a quantitative risk assessment, the equation is ALE = ARO x SLE where the SLE is calculated as the product of asset value x exposure factor. An

  event that happen once every five years would have an ARO of .2 (1 divided by 5).

  SLE = Asset Value (AV) x Exposure Fact (EF)

  SLE = 1,000,000 x .30 = 300,000

  ALE = SLE x Annualized Rate of Occurance (ARO)

  ALE = 300,000 x .2 = 60,000

  Know your acronyms: ALE -- Annual loss expectancy ARO -- Annual rate of occurrence

  SLE -- Single loss expectancy

  The following are incorrect answers:

  $300,000 is incorrect. See the of the correct answer for the correct calculation.

  $150,000 is incorrect. See the of the correct answer for the correct calculation.

  $1,500 is incorrect. See the of the correct answer for the correct calculation.

  Reference(s) used for this question:

  Mc Graw Hill, Shon Harris, CISSP All In One (AIO) book, Sixth Edition , Pages 87-88

  and

  Official ISC2 Guide to the CISSP Exam, (OIG), Pages 60-61

• Question 1055:

  Which of the following computer design approaches is based on the fact that in earlier technologies, the instruction fetch was the longest part of the cycle?

  A. Pipelining
  B. Reduced Instruction Set Computers (RISC)
  C. Complex Instruction Set Computers (CISC)
  D. Scalar processors
  C. Complex Instruction Set Computers (CISC)

  ---

  Complex Instruction Set Computer (CISC) uses instructions that perform many operations per instruction. It was based on the fact that in earlier technologies, the instruction fetch was the longest part of the cycle. Therefore, by packing more operations into an instruction, the number of fetches could be reduced. Pipelining involves overlapping the steps of different instructions to increase the performance in a computer. Reduced Instruction Set Computers (RISC) involve simpler instructions that require fewer clock cycles to execute. Scalar processors are processors that execute one instruction at a time.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 5: Security Architectures and Models (page 188).

• Question 1056:

  Which backup type run at regular intervals would take the least time to complete?

  A. Full Backup
  B. Differential Backup
  C. Incremental Backup
  D. Disk Mirroring
  C. Incremental Backup

  ---

  Incremental backups only backup changed data (changes archive bit to not backup again if not changed).

  Although the incremental backup is fastest to backup, it is usually more time consuming for the restore process.

  In some cases, the window available for backup may not be long enough to backup all the data on the system during each backup. In that case, differential or incremental backups may be more appropriate.

  In an incremental backup, only the files that changed since the last backup will be backed up.

  In a differential backup, only the files that changed since the last full backup will be backed up.

  In general, differentials require more space than incremental backups while incremental backups are faster to perform. On the other hand, restoring data from incremental backups requires more time than differential backups. To restore from

  incremental backups, the last full backup and all of the incremental backups performed are combined. In contrast, restoring from a differential backup requires only the last full backup and the latest differential.

  The following are incorrect answers:

  Differential backups backup all data since the last full backup (does not reset archive bit)

  Full backups backup all selected data, regardless of archive bit, and resets the archive bit.

  Disk mirroring is not considered as a backup type.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 20385-20390). Auerbach Publications. Kindle Edition.

  and

  HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 9:

  Disaster Recovery and Business continuity (page 618).

• Question 1057:

  Which of the following statements pertaining to a security policy is incorrect?

  A. Its main purpose is to inform the users, administrators and managers of their obligatory requirements for protecting technology and information assets.
  B. It specifies how hardware and software should be used throughout the organization.
  C. It needs to have the acceptance and support of all levels of employees within the organization in order for it to be appropriate and effective.
  D. It must be flexible to the changing environment.
  B. It specifies how hardware and software should be used throughout the organization.

  ---

  A security policy would NOT define how hardware and software should be used throughout the organization. A standard or a procedure would provide such details but not a policy. A security policy is a formal statement of the rules that people who are given access to anorganization's technology and information assets must abide. The policy communicates the security goals to all of the users, the administrators, and the managers. The goals will be largely determined by the following key tradeoffs: services offered versus security provided, ease of use versus security, and cost of security versus risk of loss.

  The main purpose of a security policy is to inform the users, the administrators and the managers of their obligatory requirements for protecting technology and information assets. The policy should specify the mechanisms through which these requirements can be met. Another purpose is to provide a baseline from which to acquire, configure and audit computer systems and networks for compliance with the policy. In order for a security policy to be appropriate and effective, it needs to have the acceptance and support of all levels of employees within the organization. A good security policy must:

  Be able to be implemented through system administration procedures, publishing of acceptable use guidelines, or other appropriate methods

  Be able to be enforced with security tools, where appropriate, and with sanctions, where actual prevention is not technically feasible

  Clearly define the areas of responsibility for the users, the administrators, and the managers

  Be communicated to all once it is established

  Be flexible to the changing environment of a computer network since it is a living document

  Reference(s) used for this question:

  National Security Agency, Systems and Network Attack Center (SNAC),The 60 Minute Network Security Guide, February 2002, page 7.

  or

  A local copy is kept at:

  https://www.freepracticetests.org/documents/The%2060%20Minute%20Network%20Security % 20Guide.pdf

• Question 1058:

  The first step in the implementation of the contingency plan is to perform:

  A. A firmware backup
  B. A data backup
  C. An operating systems software backup
  D. An application software backup
  B. A data backup

  ---

  A data backup is the first step in contingency planning.

  Without data, there is nothing to process. "No backup, no recovery".

  Backup for hardware should be taken care of next.

  Formal arrangements must be made for alternate processing capability in case the need should arise.

  Operating systems and application software should be taken care of afterwards.

  Source: VALLABHANENI, S. Rao, CISSP Examination Textbooks, Volume 2: Practice, SRV Professional Publications, 2002, Chapter 8, Business Continuity Planning and Disaster Recovery Planning (page 506).

• Question 1059:

  Which of the following was not designed to be a proprietary encryption algorithm?

  A. RC2
  B. RC4
  C. Blowfish
  D. Skipjack
  C. Blowfish

  ---

  Blowfish is a symmetric block cipher with variable-length key (32 to 448 bits) designed in 1993 by Bruce Schneier as an unpatented, license-free, royalty-free replacement for DES or IDEA.

  See attributes below:

  Block cipher: 64-bit block

  Variable key length: 32 bits to 448 bits

  Designed by Bruce Schneier

  Much faster than DES and IDEA

  Unpatented and royalty-free

  No license required

  Free source code available

  Rivest Cipher #2 (RC2) is a proprietary, variable-key-length block cipher invented by Ron Rivest for RSA Data Security, Inc.

  Rivest Cipher #4 (RC4) is a proprietary, variable-key-length stream cipher invented by Ron Rivest for RSA Data Security, Inc.

  The Skipjack algorithm is a Type II block cipher [NIST] with a block size of 64 bits and a key size of 80 bits that was developed by NSA and formerly classified at the U.S. Department of Defense "Secret" level. The NSA announced on June

  23, 1998, that Skipjack had been declassified.

  References:

  RSA Laboratories

  http://www.rsa.com/rsalabs/node.asp?id=2250

  RFC 2828 - Internet Security Glossary

  http://www.faqs.org/rfcs/rfc2828.html

• Question 1060:

  Which of the following is best at defeating frequency analysis?

  A. Substitution cipher
  B. Polyalphabetic cipher
  C. Transposition cipher
  D. Ceasar Cipher
  B. Polyalphabetic cipher

  ---

  Simple substitution and transposition ciphers are vulnerable to attacks that perform frequency analysis.

  In every language, there are words and patterns that are used more than others. Some patterns common to a language can actually help attackers figure out the transformation between plaintext and ciphertext, which enables them to figure

  out the key that was used to perform the transformation. Polyalphabetic ciphers use different alphabets to defeat frequency analysis.

  The ceasar cipher is a very simple substitution cipher that can be easily defeated and it does show repeating letters.

  Out of list presented, it is the Polyalphabetic cipher that would provide the best protection against simple frequency analysis attacks.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter

  8: Cryptography (page 507).

  And : DUPUIS, Clement, CISSP Open Study Guide on domain 5, cryptography, April 1999.