ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 1071:

  The throughput rate is the rate at which individuals, once enrolled, can be processed and identified or authenticated by a biometric system. Acceptable throughput rates are in the range of:

  A. 100 subjects per minute.
  B. 25 subjects per minute.
  C. 10 subjects per minute.
  D. 50 subjects per minute.
  C. 10 subjects per minute.

  ---

  The throughput rate is the rate at which individuals, once enrolled, can be processed and identified or authenticated by a biometric system.

  Acceptable throughput rates are in the range of 10 subjects per minute. Things that may impact the throughput rate for some types of biometric systems may include:

  A concern with retina scanning systems may be the exchange of body fluids on the eyepiece.

  Another concern would be the retinal pattern that could reveal changes in a person's health, such as diabetes or high blood pressure.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 38.

• Question 1072:

  What is called the formal acceptance of the adequacy of a system's overall security by the management?

  A. Certification
  B. Acceptance
  C. Accreditation
  D. Evaluation
  C. Accreditation

  ---

  Accreditation is the authorization by management to implement software or systems in a production environment. This authorization may be either provisional or full.

  The following are incorrect answers:

  Certification is incorrect. Certification is the process of evaluating the security stance of the software or system against a selected set of standards or policies. Certification is the technical evaluation of a product. This may precede

  accreditation but is not a required precursor.

  Acceptance is incorrect. This term is sometimes used as the recognition that a piece of software or system has met a set of functional or service level criteria (the new payroll system has passed its acceptance test).

  Certification is the better tem in this context.

  Evaluation is incorrect. Evaluation is certainly a part of the certification process but it is not the best answer to the question.

  Reference(s) used for this question:

  The Official Study Guide to the CBK from ISC2, pages 559-560

  AIO3, pp. 314 - 317

  AIOv4 Security Architecture and Design (pages 369 - 372)

  AIOv5 Security Architecture and Design (pages 370 - 372)

• Question 1073:

  Which of the following statements pertaining to stream ciphers is correct?

  A. A stream cipher is a type of asymmetric encryption algorithm.
  B. A stream cipher generates what is called a keystream.
  C. A stream cipher is slower than a block cipher.
  D. A stream cipher is not appropriate for hardware-based encryption.
  B. A stream cipher generates what is called a keystream.

  ---

  A stream cipher is a type of symmetric encryption algorithm that operates on continuous streams of plain text and is appropriate for hardware-based encryption.

  Stream ciphers can be designed to be exceptionally fast, much faster than any block cipher. A stream cipher generates what is called a keystream (a sequence of bits used as a key).

  Stream ciphers can be viewed as approximating the action of a proven unbreakable cipher, the one-time pad (OTP), sometimes known as the Vernam cipher. A one-time pad uses a keystream of completely random digits. The keystream is

  combined with the plaintext digits one at a time to form the ciphertext. This system was proved to be secure by Claude Shannon in 1949. However, the keystream must be (at least) the same length as the plaintext, and generated completely

  at random. This makes the system very cumbersome to implement in practice, and as a result the one-time pad has not been widely used, except for the most critical applications.

  A stream cipher makes use of a much smaller and more convenient key -- 128 bits, for example. Based on this key, it generates a pseudorandom keystream which can be combined with the plaintext digits in a similar fashion to the one-time

  pad. However, this comes at a cost: because the keystream is now pseudorandom, and not truly random, the proof of security associated with the one-time pad no longer holds: it is quite possible for a stream cipher to be completely insecure

  if it is not implemented properly as we have seen with the Wired Equivalent Privacy (WEP) protocol.

  Encryption is accomplished by combining the keystream with the plaintext, usually with the bitwise XOR operation.

  Source: DUPUIS, Clement, CISSP Open Study Guide on domain 5, cryptography, April 1999.

  More details can be obtained on Stream Ciphers in RSA Security's FAQ on Stream Ciphers.

• Question 1074:

  Asynchronous Communication transfers data by sending:

  A. bits of data sequentially
  B. bits of data sequentially in irregular timing patterns
  C. bits of data in sync with a heartbeat or clock
  D. bits of data simultaneously
  B. bits of data sequentially in irregular timing patterns

  ---

  Asynchronous Communication transfers data by sending bits of data in irregular timing patterns.

  In asynchronous transmission each character is transmitted separately, that is one character at a time. The character is preceded by a start bit, which tells the receiving end where the character coding begins, and is followed by a stop bit,

  which tells the receiver where the character coding ends. There will be intervals of ideal time on the channel shown as gaps. Thus there can be gaps between two adjacent characters in the asynchronous communication scheme. In this

  scheme, the bits within the character frame (including start, parity and stop bits) are sent at the baud rate.

  The START BIT and STOP BIT including gaps allow the receiving and sending computers to synchronise the data transmission. Asynchronous communication is used when slow speed peripherals communicate with the computer. The main

  disadvantage of asynchronous communication is slow speed transmission. Asynchronous communication however, does not require the complex and costly hardware equipments as is required for synchronous transmission.

  Asynchronous communication is transmission of data without the use of an external clock signal. Any timing required to recover data from the communication symbols is encoded within the symbols. The most significant aspect of

  asynchronous communications is variable bit rate, or that the transmitter and receiver clock generators do not have to be exactly synchronized. The asynchronous communication technique is a physical layer transmission technique which is

  most widely used for personal computers providing connectivity to printers, modems, fax machines, etc.

  An asynchronous link communicates data as a series of characters of fixed size and format. Each character is preceded by a start bit and followed by 1-2 stop bits.

  Parity is often added to provide some limited protection against errors occurring on the link.

  The use of independent transmit and receive clocks constrains transmission to relatively short characters (<8 bits) and moderate data rates (< 64 kbps, but typically lower).

  The asynchronous transmitter delimits each character by a start sequence and a stop sequence. The start bit (0), data (usually 8 bits plus parity) and stop bit(s) (1) are transmitted using a shift register clocked at the nominal data rate.

  When asynchronous transmission is used to support packet data links (e.g. IP), then special characters have to be used ("framing") to indicate the start and end of each frame transmitted.

  One character (none as an escape character) is reserved to mark any occurrence of the special characters within the frame. In this way the receiver is able to identify which characters are part of the frame and which are part of the "framing".

  Packet communication over asynchronous links is used by some users to get access to a network using a modem.

  Most Wide Area Networks use synchronous links and a more sophisticated link protocol

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 100.

  and

  http://en.wikipedia.org/wiki/Asynchronous_communication

  and

  http://www.erg.abdn.ac.uk/users/gorry/course/phy-pages/async.html

  and

  http://www.ligaturesoft.com/data_communications/async-data-transmission.html