ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 141:

  One purpose of a security awareness program is to modify:

  A. employee's attitudes and behaviors towards enterprise's security posture
  B. management's approach towards enterprise's security posture
  C. attitudes of employees with sensitive data
  D. corporate attitudes about safeguarding data
  A. employee's attitudes and behaviors towards enterprise's security posture

  ---

  The Answer: security awareness training is to modify employees behaviour and attitude towards towards enterprise's security posture.

  Security-awareness training is performed to modify employees' behavior and attitude toward security. This can best be achieved through a formalized process of security-awareness training.

  It is used to increase the overall awareness of security throughout the company. It is targeted to every single employee and not only to one group of users.

  Unfortunately you cannot apply a patch to a human being, the only thing you can do is to educate employees and make them more aware of security issues and threats. Never underestimate human stupidity.

  Reference(s) used for this question:

  TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

  also see:

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 130). McGraw-Hill.

  Kindle Edition.

• Question 142:

  As per RFC 1122, which of the following is not a defined layer in the DoD TCP/IP protocol model?

  A. Application layer
  B. Session layer
  C. Internet layer
  D. Link/Network Access Layer
  B. Session layer

  ---

  As per RFC, The DoD TCP/IP protocol model defines four layers, with the layers having names, not numbers, as follows:

  Application (process-to-process) Layer:

  This is the scope within which applications create user data and communicate this data to other processes or applications on another or the same host. The communications partners are often called peers. This is where the "higher level"

  protocols such as SMTP, FTP, SSH, HTTP, etc. operate.

  Transport (host-to-host) Layer:

  The Transport Layer constitutes the networking regime between two network hosts, either on the local network or on remote networks separated by routers. The Transport Layer provides a uniform networking interface that hides the actual

  topology (layout) of the underlying network connections. This is where flow- control, error-correction, and connection protocols exist, such as TCP. This layer deals with opening and maintaining connections between internet hosts.

  Internet (internetworking) Layer:

  The Internet Layer has the task of exchanging datagrams across network boundaries. It is therefore also referred to as the layer that establishes internetworking; indeed, it defines and establishes the Internet. This layer defines the addressing

  and routing structures used for the TCP/IP protocol suite. The primary protocol in this scope is the Internet Protocol, which defines IP addresses. Its function in routing is to transport datagrams to the next IP router that has the connectivity to a

  network closer to the final data destination.

  Link (network access) Layer:

  This layer defines the networking methods with the scope of the local network link on which hosts communicate without intervening routers. This layer describes the protocols used to describe the local network topology and the interfaces needed to affect transmission of Internet Layer datagrams to next- neighbor hosts. The DoD tcp/ip model DoD model Osi Model

  

  Graphic above from: http://bit.kuas.edu.tw/

  REALITY VERSUS THE STANDARD In real life today, this is getting very confusing. Many books and references will not use exactly the same names as the initial RFC that was published. For example, the Link layer is often times called Network Access. The same applies with Transport which is often times called Host-to- Host and vice versa.

  The following answer is incorrect:

  The session layer is defined within the OSI/ISO model but not within the DOD model. Being incorrect it made it the best answer according to the question. It does not belong to the DoD TCP/IP Model.

  Reference(s) Used for this question:

  http://www.freesoft.org/CIE/RFC/1122/

  http://bit.kuas.edu.tw/~csshieh/teach/np/tcpip/

• Question 143:

  Which of the following binds a subject name to a public key value?

  A. A public-key certificate
  B. A public key infrastructure
  C. A secret key infrastructure
  D. A private key certificate
  A. A public-key certificate

  ---

  Remember the term Public-Key Certificate is synonymous with Digital Certificate or Identity certificate.

  The certificate itself provides the binding but it is the certificate authority who will go through the Certificate Practice Statements (CPS) actually validating the bindings and vouch for the identity of the owner of the key within the certificate.

  As explained in Wikipedia:

  In cryptography, a public key certificate (also known as a digital certificate or identity certificate) is an electronic document which uses a digital signature to bind together a public key with an identity -- information such as the name of a person

  or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual.

  In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). In a web of trust scheme such as PGP or GPG, the signature is of either the user (a self- signed certificate) or other users ("endorsements")

  by getting people to sign each other keys. In either case, the signatures on a certificate are attestations by the certificate signer that the identity information and the public key belong together.

  RFC 2828 defines the certification authority (CA) as:

  An entity that issues digital certificates (especially X.509 certificates) and vouches for the binding between the data items in a certificate.

  An authority trusted by one or more users to create and assign certificates. Optionally, the certification authority may create the user's keys.

  X509 Certificate users depend on the validity of information provided by a certificate. Thus, a CA should be someone that certificate users trust, and usually holds an official position created and granted power by a government, a corporation,

  or some other organization. A CA is responsible for managing the life cycle of certificates and, depending on the type of certificate and the CPS that applies, may be responsible for the life cycle of key pairs associated with the certificates

  Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

  and

  http://en.wikipedia.org/wiki/Public_key_certificate

• Question 144:

  Which of the following refers to the data left on the media after the media has been erased?

  A. remanence
  B. recovery
  C. sticky bits
  D. semi-hidden
  A. remanence

  ---

  Actually the term "remanence" comes from electromagnetism, the study of the electromagnetics. Originally referred to (and still does in that field of study) the magnetic flux that remains in a magnetic circuit after an applied magnetomotive

  force has been removed. Absolutely no way a candidate will see anywhere near that much detail on any similar CISSP question, but having read this, a candidate won't be likely to forget it either.

  It is becoming increasingly commonplace for people to buy used computer equipment, such as a hard drive, or router, and find information on the device left there by the previous owner; information they thought had been deleted. This is a

  classic example of data remanence: the remains of partial or even the entire data set of digital information. Normally, this refers to the data that remain on media after they are written over or degaussed. Data remanence is most common in

  storage systems but can also occur in memory.

  Specialized hardware devices known as degaussers can be used to erase data saved to magnetic media. The measure of the amount of energy needed to reduce the magnetic field on the media to zero is known as coercivity.

  It is important to make sure that the coercivity of the degausser is of sufficient strength to meet object reuse requirements when erasing data. If a degausser is used with insufficient coercivity, then a remanence of the data will exist.

  Remanence is the measure of the existing magnetic field on the media; it is the residue that remains after an object is degaussed or written over.

  Data is still recoverable even when the remanence is small. While data remanence exists, there is no assurance of safe object reuse.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 4207-4210). Auerbach Publications. Kindle Edition.

  and

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 19694-19699). Auerbach Publications. Kindle Edition.

• Question 145:

  Which of the following are not Remote Access concerns?

  A. Justification for remote access
  B. Auditing of activities
  C. Regular review of access privileges
  D. Access badges
  D. Access badges

  ---

  Access badges are more relevant to physical security rather than remote access.

  "Justification for remote access" is incorrect. Justification for remote access is a relevant concern. "Auditing of activities" is incorrect. Auditing of activites is an imporant aspect to assure that malicious or unauthorized activities are not

  occuring.

  "Regular review of access privileges" is incorrect. Regular review of remote accept privileges is an important management responsibility.

  References:

  AIO3, pp. 547 - 548

• Question 146:

  Which of the following backup method must be made regardless of whether Differential or Incremental methods are used?

  A. Full Backup Method.
  B. Incremental backup method.
  C. Supplemental backup method.
  D. Tape backup method.
  A. Full Backup Method.

  ---

  A Full Backup must be made regardless of whether Differential or Incremental methods are used.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 69.

  And: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 9:

  Disaster Recovery and Business continuity (pages 617-619).

• Question 147:

  A common way to create fault tolerance with leased lines is to group several T1s together with an inverse multiplexer placed:

  A. at one end of the connection.
  B. at both ends of the connection.
  C. somewhere between both end points.
  D. in the middle of the connection.
  B. at both ends of the connection.

  ---

  A common way to create fault tolerance with leased lines is to group several T1s together with an inverse multiplexer placed at both ends of the connection.

  In fact it would be a Multiplexer at one end and DeMultiplexer at other end or vice versa. Inverse Multiplexer at both end.

  In electronics, a multiplexer (or mux) is a device that selects one of several analog or digital input signals and forwards the selected input into a single line. A multiplexer of 2n inputs has n select lines, which are used to select which input line

  to send to the output. Multiplexers are mainly used to increase the amount of data that can be sent over the network within a certain amount of time and bandwidth. A multiplexer is also called a data selector.

  An electronic multiplexer makes it possible for several signals to share one device or resource, for example one A/D converter or one communication line, instead of having one device per input signal.

  On the other hand, a demultiplexer (or demux) is a device taking a single input signal and selecting one of many data-output-lines, which is connected to the single input. A multiplexer is often used with a complementary demultiplexer on the

  receiving end.

  An electronic multiplexer can be considered as a multiple-input, single-output switch, and a demultiplexer as a single-input, multiple-output switch References:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 72.

  and

  https://secure.wikimedia.org/wikipedia/en/wiki/Multiplexer

• Question 148:

  What is also known as 10Base5?

  A. Thinnet
  B. Thicknet
  C. ARCnet
  D. UTP
  B. Thicknet

  ---

  Thicknet is a coaxial cable with segments of up to 500 meters, also known as 10Base5. Thinnet is a coaxial cable with segments of up to 185 meters. Unshielded twisted pair (UTP) has three variations: 10 Mbps (10BaseT), 100 Mbps (100BaseT) or 1 Gbps (1000BaseT). ARCnet is a LAN media access method.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 108).

• Question 149:

  Which OSI/ISO layer does a SOCKS server operate at?

  A. Session layer
  B. Transport layer
  C. Network layer
  D. Data link layer
  A. Session layer

  ---

  A SOCKS based server operates at the Session layer of the OSI model. SOCKS is an Internet protocol that allows client-server applications to transparently use the services of a network firewall. SOCKS is an abbreviation for "SOCKetS". As

  of Version 5 of SOCK, both UDP and TCP is supported.

  One of the best known circuit-level proxies is SOCKS proxy server. The basic purpose of the protocol is to enable hosts on one side of a SOCKS server to gain access to hosts on the other side of a SOCKS Server, without requiring direct "IPreachability"

  The protocol was originally developed by David Koblas, a system administrator of MIPS Computer Systems. After MIPS was taken over by Silicon Graphics in 1992, Koblas presented a paper on SOCKS at that year's Usenix Security

  Symposium and SOCKS became publicly available. The protocol was extended to version 4 by Ying-Da Lee of NEC.

  SOCKS includes two components, the SOCKS server and the SOCKS client.

  The SOCKS protocol performs four functions:

  Making connection requests

  Setting up proxy circuits

  Relaying application data

  Performing user authentication (optional)

  Source:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 96).

  and

  http://en.wikipedia.org/wiki/SOCKS

  and

  http://www.faqs.org/rfcs/rfc1928.html

  and

  The ISC2 OIG on page 619

• Question 150:

  Which of the following is a large hardware/software backup system that uses the RAID technology?

  A. Tape Array.
  B. Scale Array.
  C. Crimson Array
  D. Table Array.
  A. Tape Array.

  ---

  A Tape Array is a large hardware/software backup system based on the RAID technology.

  There is a misconception that RAID can only be used with Disks.

  All large storage vendor from HP, to EMC, to Compaq have Tape Array based on RAID technology they offer.

  This is a VERY common type of storage at an affordable price as well.

  So RAID is not exclusively for DISKS. Often time this is referred to as Tape Librairies or simply RAIT.

  RAIT (redundant array of independent tapes) is similar to RAID, but uses tape drives instead of disk drives. Tape storage is the lowest-cost option for very large amounts of data, but is very slow compared to disk storage. As in RAID 1

  striping, in RAIT, data are striped in parallel to multiple tape drives, with or without a redundant parity drive. This provides the high capacity at low cost typical of tape storage, with higher-than- usual tape data transfer rates and optional data

  integrity.

  References:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 70.

  and

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 1271). McGraw-Hill.

  Kindle Edition.