ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 1061:

  What does the (star) property mean in the Bell-LaPadula model?

  A. No write up
  B. No read up
  C. No write down
  D. No read down
  C. No write down

  ---

  The (star) property of the Bell-LaPadula access control model states that writing of information by a subject at a higher level of sensitivity to an object at a lower level of sensitivity is not permitted (no write down). Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 5: Security Architectures and Models (page 202). Also check out: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw- Hill/Osborne, 2002, Chapter 5: Security Models and Architecture (page 242, 243).

• Question 1062:

  Which approach to a security program ensures people responsible for protecting the company's assets are DRIVING the program?

  A. The Delphi approach
  B. The top-down approach
  C. The bottom-up approach
  D. The technology approach
  B. The top-down approach

  ---

  A security program should use a top-down approach, meaning that the initiation, support, and direction come from top management; work their way through middle management; and then reach staff members.

  In contrast, a bottom-up approach refers to a situation in which staff members (usually IT ) try to develop a security program without getting proper management support and direction. A bottom- up approach is commonly less effective, not

  broad enough to address all security risks, and doomed to fail.

  A top-down approach makes sure the people actually responsible for protecting the company's assets (senior management) are driving the program.

  The following are incorrect answers:

  The Delphi approach is incorrect as this is for a brainstorming technique.

  The bottom-up approach is also incorrect as this approach would be if the IT department tried to develop a security program without proper support from upper management.

  The technology approach is also incorrect as it does not fit into the category of best answer.

  Reference(s) used for this question:

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 63). McGraw-Hill.

  Kindle Edition.

• Question 1063:

  What can best be described as an abstract machine which must mediate all access to subjects to objects?

  A. A security domain
  B. The reference monitor
  C. The security kernel
  D. The security perimeter
  B. The reference monitor

  ---

  The reference monitor is an abstract machine which must mediate all access to subjects to objects, be protected from modification, be verifiable as correct, and is always invoked. The security kernel is the hardware, firmware and software elements of a trusted computing base that implement the reference monitor concept. The security perimeter includes the security kernel as well as other security-related system functions that are within the boundary of the trusted computing base. System elements that are outside of the security perimeter need not be trusted. A security domain is a domain of trust that shares a single security policy and single management.

  Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 1064:

  In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person. This raised the necessity of answering 2 questions :

  A. what was the sex of a person and his age
  B. what part of body to be used and how to accomplish identification that is viable
  C. what was the age of a person and his income level
  D. what was the tone of the voice of a person and his habits
  B. what part of body to be used and how to accomplish identification that is viable

  ---

  Today implementation of fast, accurate reliable and user-acceptable biometric identification systems is already taking place. Unique physical attributes or behavior of a person are used for that purpose. From: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 1, Page 7.

• Question 1065:

  Where parties do not have a shared secret and large quantities of sensitive information must be passed, the most efficient means of transferring information is to use Hybrid Encryption Methods. What does this mean?

  A. Use of public key encryption to secure a secret key, and message encryption using the secret key.
  B. Use of the recipient's public key for encryption and decryption based on the recipient's private key.
  C. Use of software encryption assisted by a hardware encryption accelerator.
  D. Use of elliptic curve encryption.
  A. Use of public key encryption to secure a secret key, and message encryption using the secret key.

  ---

  A Public Key is also known as an asymmetric algorithm and the use of a secret key would be a symmetric algorithm.

  The following answers are incorrect:

  Use of the recipient's public key for encryption and decryption based on the recipient's private key. Is incorrect this would be known as an asymmetric algorithm.

  Use of software encryption assisted by a hardware encryption accelerator. This is incorrect, it is a distractor.

  Use of Elliptic Curve Encryption. Is incorrect this would use an asymmetric algorithm.

• Question 1066:

  Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?

  A. 192.168.42.5
  B. 192.166.42.5
  C. 192.175.42.5
  D. 192.1.42.5
  A. 192.168.42.5

  ---

  This is a valid Class C reserved address. For Class C, the reserved addresses are 192.168.0.0 - 192.168.255.255.

  The private IP address ranges are defined within RFC 1918:

  RFC 1918 private ip address range

  

  The following answers are incorrect:

  192.166.42.5 Is incorrect because it is not a Class C reserved address.

  192.175.42.5 Is incorrect because it is not a Class C reserved address.

  192.1.42.5 Is incorrect because it is not a Class C reserved address.

• Question 1067:

  Which of the following is not a disadvantage of symmetric cryptography when compared with Asymmetric Ciphers?

  A. Provides Limited security services
  B. Has no built in Key distribution
  C. Speed
  D. Large number of keys are needed
  C. Speed

  ---

  Symmetric cryptography ciphers are generally fast and hard to break. So speed is one of the key advantage of Symmetric ciphers and NOT a disadvantage. Symmetric Ciphers uses simple encryption steps such as XOR, substitution, permutation, shifting columns, shifting rows, etc... Such steps does not required a large amount of processing power compare to the complex mathematical problem used within Asymmetric Ciphers.

  Some of the weaknesses of Symmetric Ciphers are:

  The lack of automated key distribution. Usually an Asymmetric cipher would be use to protect the symmetric key if it needs to be communicated to another entity securely over a public network. In the good old day this was done manually

  where it was distributed using the Floppy Net sometimes called the Sneaker Net (you run to someone's office to give them the key).

  As far as the total number of keys are required to communicate securely between a large group of users, it does not scale very well. 10 users would require 45 keys for them to communicate securely with each other. If you have 1000 users then you would need almost half a million key to communicate secure. On Asymmetric ciphers there is only 2000 keys required for 1000 users. The formula to calculate the total number of keys required for a group of users who wishes to communicate securely with each others using Symmetric encryption is Total Number of Users (N) * Total Number of users minus one Divided by 2 or N (N-1)/2

  Symmetric Ciphers are limited when it comes to security services, they cannot provide all of the security services provided by Asymmetric ciphers. Symmetric ciphers provides mostly confidentiality but can also provide integrity and

  authentication if a Message Authentication Code (MAC) is used and could also provide user authentication if Kerberos is used for example. Symmetric Ciphers cannot provide Digital Signature and Non-Repudiation.

  Reference used for theis question:

  WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 2).

• Question 1068:

  Which of the following statements pertaining to disk mirroring is incorrect?

  A. Mirroring offers better performance in read operations but writing hinders system performance.
  B. Mirroring is a hardware-based solution only.
  C. Mirroring offers a higher fault tolerance than parity.
  D. Mirroring is usually the less cost-effective solution.
  B. Mirroring is a hardware-based solution only.

  ---

  With mirroring, the system writes the data simultaneously to separate drives or arrays.

  The advantage of mirroring are minimal downtime, simple data recovery, and increased performance in reading from the disk.

  The disadvantage of mirroring is that both drives or disk arrays are processing in the writing to disks function, which can hinder system performance.

  Mirroring has a high fault tolerance and can be implemented either through a hardware RAID controller or through the operating system. Since it requires twice the disk space than actual data, mirroring is the less cost-efficient data

  redundancy strategy.

  Source: SWANSON, Marianne, and al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 45).

• Question 1069:

  According to private sector data classification levels, how would salary levels and medical information be classified?

  A. Public.
  B. Internal Use Only.
  C. Restricted.
  D. Confidential.
  D. Confidential.

  ---

  Typically there are three to four levels of information classification used by most organizations:

  Confidential: Information that, if released or disclosed outside of the organization, would create severe problems for the organization. For example, information that provides a competitive advantage is important to the technical or financial success (like trade secrets, intellectual property, or research designs), or protects the privacy of individuals would be considered confidential. Information may include payroll information, health records, credit information, formulas, technical designs, restricted regulatory information, senior management internal correspondence, or business strategies or plans. These may also be called top secret, privileged, personal, sensitive, or highly confidential. In other words this information is ok within a defined group in the company such as marketing or sales, but is not suited for release to anyone else in the company without permission.

  The following answers are incorrect:

  Public: Information that may be disclosed to the general public without concern for harming the company, employees, or business partners. No special protections are required, and information in this category is sometimes referred to as unclassified. For example, information that is posted to a company's public Internet site, publicly released announcements, marketing materials, cafeteria menus, and any internal documents that would not present harm to the company if they were disclosed would be classified as public. While there is little concern for confidentiality, integrity and availability should be considered.

  Internal Use Only: Information that could be disclosed within the company, but could harm the company if disclosed externally. Information such as customer lists, vendor pricing, organizational policies, standards and procedures, and internal organization announcements would need baseline security protections, but do not rise to the level of protection as confidential information. In other words, the information may be used freely within the company but any unapproved use outside the company can pose a chance of harm.

  Restricted: Information that requires the utmost protection or, if discovered by unauthorized personnel, would cause irreparable harm to the organization would have the highest level of classification. There may be very few pieces of information like this within an organization, but data classified at this level requires all the access control and protection mechanisms available to the organization. Even when information classified at this level exists, there will be few copies of it

  Reference(s) Used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 952-976). Auerbach Publications. Kindle Edition.

• Question 1070:

  Which of the following is NOT a fundamental component of an alarm in an intrusion detection system?

  A. Communications
  B. Enunciator
  C. Sensor
  D. Response
  D. Response

  ---

  Response is the correct choice. A response would essentially be the action that is taken once an alarm has been produced by an IDS, but is not a fundamental component of the alarm.

  The following are incorrect answers:

  Communications is the component of an alarm that delivers alerts through a variety of channels such as email, pagers, instant messages and so on.

  An Enunciator is the component of an alarm that uses business logic to compose the content and format of an alert and determine the recipients of that alert.

  A sensor is a fundamental component of IDS alarms. A sensor detects an event and produces an appropriate notification.

  Domain: Access Control

  Reference:

  Official guide to the CISSP CBK. page 203.