ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 161:

  Similar to Secure Shell (SSH-2), Secure Sockets Layer (SSL) uses symmetric encryption for encrypting the bulk of the data being sent over the session and it uses asymmetric or public key cryptography for:

  A. Peer Authentication
  B. Peer Identification
  C. Server Authentication
  D. Name Resolution
  A. Peer Authentication

  ---

  SSL provides for Peer Authentication. Though peer authentication is possible, authentication of the client is seldom used in practice when connecting to public e-commerce web sites. Once authentication is complete, confidentiality is assured over the session by the use of symmetric encryption in the interests of better performance.

  The following answers were all incorrect:

  "Peer identification" is incorrect. The desired attribute is assurance of the identity of the communicating parties provided by authentication and NOT identification. Identification is only who you claim to be.

  Authentication is proving who you claim to be.

  "Server authentication" is incorrect. While server authentication only is common practice, the protocol provides for peer authentication (i.e., authentication of both client and server). This answer was not complete.

  "Name resolution" is incorrect. Name resolution is commonly provided by the Domain Name System (DNS) not SSL.

  Reference(s) used for this question:

  CBK, pp. 496 - 497.

• Question 162:

  Which of the following is the most secure firewall implementation?

  A. Dual-homed host firewalls
  B. Screened-subnet firewalls
  C. Screened-host firewalls
  D. Packet-filtering firewalls
  B. Screened-subnet firewalls

  ---

  One the most secure implementations of firewall architectures is the screened-subnet firewall. It employs two packet-filtering routers and a bastion host. Like a screened host firewall, this firewall supports both packet-filtering and proxy services.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 93).

• Question 163:

  In which of the following phases of system development life cycle (SDLC) is contingency planning most important?

  A. Initiation
  B. Development/acquisition
  C. Implementation
  D. Operation/maintenance
  A. Initiation

  ---

  Contingency planning requirements should be considered at every phase of SDLC, but most importantly when a new IT system is being conceived. In the initiation phase, system requirements are identified and matched to their related operational processes, allowing determination of the system's appropriate recovery priority.

  Source: SWANSON, Marianne, and al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 12).

  and

  The Official ISC2 Guide to the CBK, Second Edition, Application Security, page 180-185

• Question 164:

  Frame relay uses a public switched network to provide:

  A. Local Area Network (LAN) connectivity.
  B. Metropolitan Area Network (MAN) connectivity.
  C. Wide Area Network (WAN) connectivity.
  D. World Area Network (WAN) connectivity.
  C. Wide Area Network (WAN) connectivity.

  ---

  Frame relay uses a public switched network to provide Wide Area Network (WAN) connectivity.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 73.

• Question 165:

  Crackers today are MOST often motivated by their desire to:

  A. Help the community in securing their networks.
  B. Seeing how far their skills will take them.
  C. Getting recognition for their actions.
  D. Gaining Money or Financial Gains.
  D. Gaining Money or Financial Gains.

  ---

  A few years ago the best choice for this question would have been seeing how far their skills can take them. Today this has changed greatly, most crimes committed are financially motivated. Profit is the most widespread motive behind all

  cybercrimes and, indeed, most crimes- everyone wants to make money. Hacking for money or for free services includes a smorgasbord of crimes such as embezzlement, corporate espionage and being a "hacker for hire". Scams are easier

  to undertake but the likelihood of success is much lower. Money-seekers come from any lifestyle but those with persuasive skills make better con artists in the same way as those who are exceptionally tech-savvy make better "hacks for hire".

  "White hats" are the security specialists (as opposed to Black Hats) interested in helping the community in securing their networks. They will test systems and network with the owner authorization. A Black Hat is someone who uses his skills

  for offensive purpose. They do not seek authorization before they attempt to comprise the security mechanisms in place. "Grey Hats" are people who sometimes work as a White hat and other times they will work as a "Black Hat", they have

  not made up their mind yet as to which side they prefer to be.

  The following are incorrect answers:

  All the other choices could be possible reasons but the best one today is really for financial gains.

  References used for this question:

  http://library.thinkquest.org/04oct/00460/crimeMotives.html and http://www.informit.com/articles/article.aspx?p=1160835 and http://www.aic.gov.au/documents/1/B/A/%7B1BA0F612-613A-494D-B6C5- 06938FE8BB53% 7Dhtcb006.pdf

• Question 166:

  In biometric identification systems, the parts of the body conveniently available for identification are:

  A. neck and mouth
  B. hands, face, and eyes
  C. feet and hair
  D. voice and neck
  B. hands, face, and eyes

  ---

  Today implementation of fast, accurate, reliable, and user-acceptable biometric identification systems are already under way. Because most identity authentication takes place when a people are fully clothed (neck to feet and wrists), the parts of the body conveniently available for this purpose are hands, face, and eyes.

  From: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 1, Page 7.

• Question 167:

  A contingency plan should address:

  A. Potential risks.
  B. Residual risks.
  C. Identified risks.
  D. All answers are correct.
  D. All answers are correct.

  ---

  Because it is rarely possible or cost effective to eliminate all risks, an attempt is made to reduce risks to an acceptable level through the risk assessment process. This process allows, from a set of potential risks (whether likely or not), to come up with a set of identified, possible risks.

  The implementation of security controls allows reducing the identified risks to a smaller set of residual risks. Because these residual risks represent the complete set of situations that could affect system performance, the scope of the contingency plan may be reduced to address only this decreased risk set. As a result, the contingency plan can be narrowly focused, conserving resources while ensuring an effective system recovery capability.

  Source: SWANSON, Marianne, and al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 7).

• Question 168:

  Which of the following is covered under Crime Insurance Policy Coverage?

  A. Inscribed, printed and Written documents
  B. Manuscripts
  C. Accounts Receivable
  D. Money and Securities
  D. Money and Securities

  ---

  Source: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 1, Property Insurance overview, Page 589.

• Question 169:

  Which of the following is NOT a transaction redundancy implementation?

  A. on-site mirroring
  B. Electronic Vaulting
  C. Remote Journaling
  D. Database Shadowing
  A. on-site mirroring

  ---

  Three concepts are used to create a level of fault tolerance and redundancy in transaction processing.

  They are Electronic vaulting, remote journaling and database shadowing provide redundancy at the transaction level.

  Electronic vaulting is accomplished by backing up system data over a network. The backup location is usually at a separate geographical location known as the vault site. Vaulting can be used as a mirror or a backup mechanism using the

  standard incremental or differential backup cycle. Changes to the host system are sent to the vault server in real-time when the backup method is implemented as a mirror. If vaulting updates are recorded in real-time, then it will be necessary

  to perform regular backups at the off- site location to provide recovery services due to inadvertent or malicious alterations to user or system data.

  Journaling or Remote Journaling is another technique used by database management systems to provide redundancy for their transactions. When a transaction is completed, the database management system duplicates the journal entry at a

  remote location. The journal provides sufficient detail for the transaction to be replayed on the remote system. This provides for database recovery in the event that the database becomes corrupted or unavailable.

  There are also additional redundancy options available within application and database software platforms. For example, database shadowing may be used where a database management system updates records in multiple locations. This

  technique updates an entire copy of the database at a remote location.

  Reference used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 20403-20407). Auerbach Publications. Kindle Edition.

  and

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 20375-20377). Auerbach Publications. Kindle Edition.

• Question 170:

  ICMP and IGMP belong to which layer of the OSI model?

  A. Datagram Layer.
  B. Network Layer.
  C. Transport Layer.
  D. Data Link Layer.
  B. Network Layer.

  ---

  The network layer contains the Internet Protocol (IP), the Internet Control Message Protocol (ICMP), and the Internet Group Management Protocol (IGMP)

  The following answers are incorrect:

  Datagram Layer. Is incorrect as a distractor as there is no Datagram Layer.

  Transport Layer. Is incorrect because it is used to data between applications and uses the TCP and UDP protocols.

  Data Link Layer. Is incorrect because this layer deals with addressing hardware.