ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 171:

  What works as an E-mail message transfer agent?

  A. SMTP
  B. SNMP
  C. S-RPC
  D. S/MIME
  A. SMTP

  ---

  SMTP (Simple Mail Transfer Protocol) works as a message transfer agent.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2001, Page 821.

• Question 172:

  The three classic ways of authenticating yourself to the computer security software are by something you know, by something you have, and by something:

  A. you need.
  B. non-trivial
  C. you are.
  D. you can get.
  C. you are.

  ---

  This is more commonly known as biometrics and is one of the most accurate ways to authenticate an individual. The rest of the answers are incorrect because they not one of the three recognized forms for Authentication.

• Question 173:

  Which TCSEC level is labeled Controlled Access Protection?

  A. C1
  B. C2
  C. C3
  D. B1
  B. C2

  ---

  C2 is labeled Controlled Access Protection.

  The TCSEC defines four divisions: D, C, B and A where division A has the highest security.

  Each division represents a significant difference in the trust an individual or organization can place on the evaluated system. Additionally divisions C, B and A are broken into a series of hierarchical subdivisions called classes: C1, C2, B1, B2,

  B3 and A1.

  Each division and class expands or modifies as indicated the requirements of the immediately prior division or class.

  D -- Minimal protection

  Reserved for those systems that have been evaluated but that fail to meet the requirements for a higher division

  C -- Discretionary protection

  C1 -- Discretionary Security Protection

  Identification and authentication

  Separation of users and data

  Discretionary Access Control (DAC) capable of enforcing access limitations on an individual basis

  Required System Documentation and user manuals

  C2 -- Controlled Access Protection

  More finely grained DAC

  Individual accountability through login procedures

  Audit trails

  Object reuse

  Resource isolation

  B -- Mandatory protection

  B1 -- Labeled Security Protection

  Informal statement of the security policy model

  Data sensitivity labels

  Mandatory Access Control (MAC) over selected subjects and objects Label exportation capabilities

  All discovered flaws must be removed or otherwise mitigated

  Design specifications and verification

  B2 -- Structured Protection

  Security policy model clearly defined and formally documented

  DAC and MAC enforcement extended to all subjects and objects

  Covert storage channels are analyzed for occurrence and bandwidth

  Carefully structured into protection-critical and non-protection-critical elements

  Design and implementation enable more comprehensive testing and review

  Authentication mechanisms are strengthened

  Trusted facility management is provided with administrator and operator segregation

  Strict configuration management controls are imposed

  B3 -- Security Domains

  Satisfies reference monitor requirements

  Structured to exclude code not essential to security policy enforcement

  Significant system engineering directed toward minimizing complexity

  Security administrator role defined

  Audit security-relevant events

  Automated imminent intrusion detection, notification, and response

  Trusted system recovery procedures

  Covert timing channels are analyzed for occurrence and bandwidth

  An example of such a system is the XTS-300, a precursor to the XTS-400 A -- Verified protection

  A1 -- Verified Design

  Functionally identical to B3

  Formal design and verification techniques including a formal top-level specification

  Formal management and distribution procedures

  An example of such a system is Honeywell's Secure Communications Processor SCOMP, a precursor to the XTS-400

  Beyond A1

  System Architecture demonstrates that the requirements of self-protection and completeness for reference monitors have been implemented in the Trusted Computing Base (TCB).

  Security Testing automatically generates test-case from the formal top-level specification or formal lower- level specifications.

  Formal Specification and Verification is where the TCB is verified down to the source code level, using formal verification methods where feasible.

  Trusted Design Environment is where the TCB is designed in a trusted facility with only trusted (cleared) personnel.

  The following are incorrect answers:

  C1 is Discretionary security

  C3 does not exists, it is only a detractor

  B1 is called Labeled Security Protection.

  Reference(s) used for this question:

  HARE, Chris, Security management Practices CISSP Open Study Guide, version 1.0, april 1999.

  and

  AIOv4 Security Architecture and Design (pages 357 - 361)

  AIOv5 Security Architecture and Design (pages 358 - 362)

• Question 174:

  Which of the following classes is defined in the TCSEC (Orange Book) as discretionary protection?

  A. C
  B. B
  C. A
  D. D
  A. C

  ---

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, page 197.

  Also: THE source for all TCSEC "level" questions: http://csrc.nist.gov/publications/secpubs/rainbow/std001.txt

• Question 175:

  A prolonged power supply that is below normal voltage is a:

  A. brownout
  B. blackout
  C. surge
  D. fault
  A. brownout

  ---

  A prolonged power supply that is below normal voltage is a brownout.

  From: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 3rd. Edition McGraw- Hill/Osborne, 2005, page 368.

• Question 176:

  The preliminary steps to security planning include all of the following EXCEPT which of the following?

  A. Establish objectives.
  B. List planning assumptions.
  C. Establish a security audit function.
  D. Determine alternate courses of action
  C. Establish a security audit function.

  ---

  The keyword within the question is: preliminary

  This means that you are starting your effort, you cannot audit if your infrastructure is not even in place.

  Reference used for this question:

  TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 177:

  In a Public Key Infrastructure, how are public keys published?

  A. They are sent via e-mail.
  B. Through digital certificates.
  C. They are sent by owners.
  D. They are not published.
  B. Through digital certificates.

  ---

  Public keys are published through digital certificates, signed by certification authority (CA), binding the certificate to the identity of its bearer.

  A bit more details:

  Although "Digital Certificates" is the best (or least wrong!) in the list of answers presented, for the past decade public keys have been published (ie: made known to the World) by the means of a LDAP server or a key distribution server (ex.:

  http://pgp.mit.edu/). An indirect publishing method is through OCSP servers (to validate digital signatures' CRL) Reference used for this question:

  TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

  and

  http://technet.microsoft.com/en-us/library/dd361898.aspx

• Question 178:

  Which of the following is not an example of a block cipher?

  A. Skipjack
  B. IDEA
  C. Blowfish
  D. RC4
  D. RC4

  ---

  RC4 is a proprietary, variable-key-length stream cipher invented by Ron Rivest for RSA Data Security, Inc. Skipjack, IDEA and Blowfish are examples of block ciphers. Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

• Question 179:

  A packet containing a long string of NOP's followed by a command is usually indicative of what?

  A. A syn scan.
  B. A half-port scan.
  C. A buffer overflow attack.
  D. A packet destined for the network's broadcast address.
  C. A buffer overflow attack.

  ---

  A series of the same control, hexidecimal, characters imbedded in the string is usually an indicator of a buffer overflow attack. A NOP is a instruction which does nothing (No Operation - the hexadecimal equivalent is 0x90)

  The following answers are incorrect:

  A syn scan. This is incorrect because a SYN scan is when a SYN packet is sent to a specific port and the results are then analyzed.

  A half-port scan. This is incorrect because the port scanner generates a SYN packet. If the target port is open, it will respond with a SYN-ACK packet. The scanner host responds with a RST packet, closing the connection before the

  handshake is completed. Also known as a Half Open Port scan.

  A packet destined for the network's broadcast address. This is incorrect because this type of packet would not contain a long string of NOP characters.

• Question 180:

  Which of the following is related to physical security and is not considered a technical control?

  A. Access control Mechanisms
  B. Intrusion Detection Systems
  C. Firewalls
  D. Locks
  D. Locks

  ---

  All of the above are considered technical controls except for locks, which are physical controls.

  Administrative, Technical, and Physical Security Controls

  Administrative security controls are primarily policies and procedures put into place to define and guide employee actions in dealing with the organization's sensitive information. For example, policy might dictate (and procedures indicate how) that human resources conduct background checks on employees with access to sensitive information. Requiring that information be classified and the process to classify and review information classifications is another example of an administrative control. The organization security awareness program is an administrative control used to make employees cognizant of their security roles and responsibilities. Note that administrative security controls in the form of a policy can be enforced or verified with technical or physical security controls. For instance, security policy may state that computers without antivirus software cannot connect to the network, but a technical control, such as network access control software, will check for antivirus software when a computer tries to attach to the network.

  Technical security controls (also called logical controls) are devices, processes, protocols, and other measures used to protect the C.I.A. of sensitive information. Examples include logical access systems, encryptions systems, antivirus systems, firewalls, and intrusion detection systems.

  Physical security controls are devices and means to control physical access to sensitive information and to protect the availability of the information. Examples are physical access systems (fences, mantraps, guards), physical intrusion detection systems (motion detector, alarm system), and physical protection systems (sprinklers, backup generator). Administrative and technical controls depend on proper physical security controls being in place. An administrative policy allowing only authorized employees access to the data center do little good without some kind of physical access control.

  From the GIAC.ORG website