ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 181:

  What is the essential difference between a self-audit and an independent audit?

  A. Tools used
  B. Results
  C. Objectivity
  D. Competence
  C. Objectivity

  ---

  To maintain operational assurance, organizations use two basic methods: system audits and monitoring. Monitoring refers to an ongoing activity whereas audits are one-time or periodic events and can be either internal or external. The essential difference between a self-audit and an independent audit is objectivity, thus indirectly affecting the results of the audit. Internal and external auditors should have the same level of competence and can use the same tools.

  Source: SWANSON, Marianne and GUTTMAN, Barbara, National Institute of Standards and Technology (NIST), NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, September 1996 (page 25).

• Question 182:

  Transport Layer Security (TLS) is a two-layered socket layer security protocol that contains the TLS Record Protocol and the::

  A. Transport Layer Security (TLS) Internet Protocol.
  B. Transport Layer Security (TLS) Data Protocol.
  C. Transport Layer Security (TLS) Link Protocol.
  D. Transport Layer Security (TLS) Handshake Protocol.
  D. Transport Layer Security (TLS) Handshake Protocol.

• Question 183:

  Rule-Based Access Control (RuBAC) access is determined by rules. Such rules would fit within what category of access control ?

  A. Discretionary Access Control (DAC)
  B. Mandatory Access control (MAC)
  C. Non-Discretionary Access Control (NDAC)
  D. Lattice-based Access control
  C. Non-Discretionary Access Control (NDAC)

  ---

  Rule-based access control is a type of non-discretionary access control because this access is determined by rules and the subject does not decide what those rules will be, the rules are uniformly applied to ALL of the users or subjects.

  In general, all access control policies other than DAC are grouped in the category of non- discretionary access control (NDAC). As the name implies, policies in this category have rules that are not established at the discretion of the user.

  Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action.

  Both Role Based Access Control (RBAC) and Rule Based Access Control (RuBAC) fall within Non Discretionary Access Control (NDAC). If it is not DAC or MAC then it is most likely NDAC.

  IT IS NOT ALWAYS BLACK OR WHITE

  The different access control models are not totally exclusive of each others. MAC is making use of Rules to be implemented. However with MAC you have requirements above and beyond having simple access rules. The subject would get

  formal approval from management, the subject must have the proper security clearance, objects must have labels/sensitivity levels attached to them, subjects must have the proper security clearance. If all of this is in place then you have

  MAC.

  BELOW YOU HAVE A DESCRIPTION OF THE DIFFERENT CATEGORIES:

  MAC = Mandatory Access Control Under a mandatory access control environment, the system or security administrator will define what permissions subjects have on objects. The administrator does not dictate user's access but simply configure the proper level of access as dictated by the Data Owner.

  The MAC system will look at the Security Clearance of the subject and compare it with the object sensitivity level or classification level. This is what is called the dominance relationship.

  The subject must DOMINATE the object sensitivity level. Which means that the subject must have a security clearance equal or higher than the object he is attempting to access.

  MAC also introduce the concept of labels. Every objects will have a label attached to them indicating the classification of the object as well as categories that are used to impose the need to know (NTK) principle. Even thou a user has a

  security clearance of Secret it does not mean he would be able to access any Secret documents within the system. He would be allowed to access only Secret document for which he has a Need To Know, formal approval, and object where

  the user belong to one of the categories attached to the object.

  If there is no clearance and no labels then IT IS NOT Mandatory Access Control.

  Many of the other models can mimic MAC but none of them have labels and a dominance relationship so they are NOT in the MAC category.

  NISTR-7316 Says:

  Usually a labeling mechanism and a set of interfaces are used to determine access based on the MAC policy; for example, a user who is running a process at the Secret classification should not be allowed to read a file with a label of Top Secret. This is known as the "simple security rule," or "no read up." Conversely, a user who is running a process with a label of Secret should not be allowed to write to a file with a label of Confidential. This rule is called the "*property" (pronounced "star property") or "no write down." The *-property is required to maintain system security in an automated environment. A variation on this rule called the "strict *-property" requires that information can be written at, but not above, the subject's clearance level. Multilevel security models such as the Bell-La Padula Confidentiality and Biba Integrity models are used to formally specify this kind of MAC policy.

  DAC = Discretionary Access Control

  DAC is also known as: Identity Based access control system.

  The owner of an object is define as the person who created the object. As such the owner has the discretion to grant access to other users on the network. Access will be granted based solely on the identity of those users.

  Such system is good for low level of security. One of the major problem is the fact that a user who has access to someone's else file can further share the file with other users without the knowledge or permission of the owner of the file. Very

  quickly this could become the wild wild west as there is no control on the dissimination of the information.

  RBAC = Role Based Access Control

  RBAC is a form of Non-Discretionary access control.

  Role Based access control usually maps directly with the different types of jobs performed by employees within a company.

  For example there might be 5 security administrator within your company. Instead of creating each of their profile one by one, you would simply create a role and assign the administrators to the role. Once an administrator has been assigned

  to a role, he will IMPLICITLY inherit the permissions of that role.

  RBAC is great tool for environment where there is a a large rotation of employees on a daily basis such as a very large help desk for example.

  RBAC or RuBAC = Rule Based Access Control

  RuBAC is a form of Non-Discretionary access control.

  A good example of a Rule Based access control device would be a Firewall. A single set of rules is imposed to all users attempting to connect through the firewall.

  NOTE FROM CLEMENT:

  Lot of people tend to confuse MAC and Rule Based Access Control.

  Mandatory Access Control must make use of LABELS. If there is only rules and no label, it cannot be Mandatory Access Control. This is why they call it Non Discretionary Access control (NDAC).

  There are even books out there that are WRONG on this subject. Books are sometimes opiniated and not strictly based on facts.

  In MAC subjects must have clearance to access sensitive objects. Objects have labels that contain the classification to indicate the sensitivity of the object and the label also has categories to enforce the need to know.

  Today the best example of rule based access control would be a firewall. All rules are imposed globally to any user attempting to connect through the device. This is NOT the case with MAC.

  I strongly recommend you read carefully the following document:

  NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316.pdf

  It is one of the best Access Control Study document to prepare for the exam. Usually I tell people not to worry about the hundreds of NIST documents and other reference. This document is an exception. Take some time to read it.

  Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 33.

  and

  NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316.pdf

  and

  Conrad, Eric; Misenar, Seth; Feldman, Joshua (2012-09-01). CISSP Study Guide (Kindle Locations 651- 652). Elsevier Science (reference). Kindle Edition.

• Question 184:

  Which of the following is more suitable for a hardware implementation?

  A. Stream ciphers
  B. Block ciphers
  C. Cipher block chaining
  D. Electronic code book
  A. Stream ciphers

  ---

  A stream cipher treats the message as a stream of bits or bytes and performs mathematical functions on them individually. The key is a random value input into the stream cipher, which it uses to ensure the randomness of the keystream data. They are more suitable for hardware implementations, because they encrypt and decrypt one bit at a time. They are intensive because each bit must be manipulated, which works better at the silicon level. Block ciphers operate a the block level, dividing the message into blocks of bits. Cipher Block chaining (CBC) and Electronic Code Book (ECB) are operation modes of DES, a block encryption algorithm.

  Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 2).

• Question 185:

  What is a characteristic of using the Electronic Code Book mode of DES encryption?

  A. A given block of plaintext and a given key will always produce the same ciphertext.
  B. Repetitive encryption obscures any repeated patterns that may have been present in the plaintext.
  C. Individual characters are encoded by combining output from earlier encryption routines with plaintext.
  D. The previous DES output is used as input.
  A. A given block of plaintext and a given key will always produce the same ciphertext.

  ---

  A given message and key always produce the same ciphertext.

  The following answers are incorrect:

  Repetitive encryption obscures any repeated patterns that may have been present in the plaintext. Is incorrect because with Electronic Code Book a given 64 bit block of plaintext always produces the same ciphertext

  Individual characters are encoded by combining output from earlier encryption routines with plaintext. This is incorrect because with Electronic Code Book processing 64 bits at a time until the end of the file was reached. This is a

  characteristic of Cipher Feedback. Cipher Feedback the ciphertext is run through a key- generating device to create the key for the next block of plaintext.

  The previous DES output is used as input. Is incorrect because This is incorrect because with Electronic Code Book processing 64 bits at a time until the end of the file was reached . This is a characteristic of Cipher Block Chaining. Cipher

  Block Chaining uses the output from the previous block to encrypt the next block.

• Question 186:

  Which of the following biometric parameters are better suited for authentication use over a long period of time?

  A. Iris pattern
  B. Voice pattern
  C. Signature dynamics
  D. Retina pattern
  A. Iris pattern

  ---

  The iris pattern is considered lifelong. Unique features of the iris are: freckles, rings, rifts, pits, striations, fibers, filaments, furrows, vasculature and coronas. Voice, signature and retina patterns are more likely to change over time, thus are not as suitable for authentication over a long period of time without needing re- enrollment.

  Source: FERREL, Robert G, Questions and Answers for the CISSP Exam, domain 1 (derived from the Information Security Management Handbook, 4th Ed., by Tipton and Krause).

• Question 187:

  Which of the following phases of a software development life cycle normally addresses Due Care and Due Diligence?

  A. Implementation
  B. System feasibility
  C. Product design
  D. Software plans and requirements
  D. Software plans and requirements

  ---

  The software plans and requirements phase addresses threats, vulnerabilities, security requirements, reasonable care, due diligence, legal liabilities, cost/benefit analysis, level of protection desired, test plans.

  Implementation is incorrect because it deals with Installing security software, running the system, acceptance testing, security software testing, and complete documentation certification and accreditation (where necessary).

  System Feasibility is incorrect because it deals with information security policy, standards, legal issues, and the early validation of concepts.

  Product design is incorrect because it deals with incorporating security specifications, adjusting test plans and data,

  determining access controls, design documentation, evaluating encryption options, and verification.

  Sources:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 7: Applications and Systems Development (page 252).

  KRUTZ, Ronald and VINES, Russel, The CISSP Prep Guide: Gold Edition, Wiley Publishing Inc., 2003, Chapter 7: Security Life Cycle Components, Figure 7.5 (page 346).

• Question 188:

  What is a decrease in amplitude as a signal propagates along a transmission medium best known as?

  A. Crosstalk
  B. Noise
  C. Delay distortion
  D. Attenuation
  D. Attenuation

  ---

  Attenuation is the loss of signal strength as it travels. The longer a cable, the more at tenuation occurs, which causes the signal carrying the data to deteriorate. This is why standards include suggested cable- run lengths. If a networking cable is too long, attenuation may occur. Basically, the data are in the form of electrons, and these electrons have to "swim" through a copper wire. However, this is more like swimming upstream, because there is a lot of resistance on the electrons working in this media. After a certain distance, the electrons start to slow down and their encoding format loses form. If the form gets too degraded, the receiving system cannot interpret them any longer. If a network administrator needs to run a cable longer than its recommended segment length, she needs to insert a repeater or some type of device that will amplify the signal and ensure it gets to its destination in the right encoding format.

  Attenuation can also be caused by cable breaks and malfunctions. This is why cables should be tested. If a cable is suspected of attenuation problems, cable testers can inject signals into the cable and read the results at the end of the cable.

  The following answers are incorrect:

  Crosstalk - Crosstalk is one example of noise where unwanted electrical coupling between adjacent lines causes the signal in one wire to be picked up by the signal in an adjacent wire.

  Noise - Noise is also a signal degradation but it refers to a large amount of electrical fluctuation that can interfere with the interpretation of the signal by the receiver.

  Delay distortion - Delay distortion can result in a misinterpretation of a signal that results from transmitting a digital signal with varying frequency components. The various components arrive at the receiver with varying delays.

  Following reference(s) were/was used to create this question:

  CISA review manual 2014 Page number 265

  Official ISC2 guide to CISSP CBK 3rd Edition Page number 229 and CISSP All-In-One Exam guide 6th Edition Page Number 561

• Question 189:

  Which of the following service is not provided by a public key infrastructure (PKI)?

  A. Access control
  B. Integrity
  C. Authentication
  D. Reliability
  D. Reliability

  ---

  A Public Key Infrastructure (PKI) provides confidentiality, access control, integrity, authentication and non- repudiation.

  It does not provide reliability services.

  Reference(s) used for this question:

  TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 190:

  What is the name of a one way transformation of a string of characters into a usually shorter fixed-length value or key that represents the original string? Such a transformation cannot be reversed?

  A. One-way hash
  B. DES
  C. Transposition
  D. Substitution
  A. One-way hash

  ---

  A cryptographic hash function is a transformation that takes an input (or 'message') and returns a fixed- size string, which is called the hash value (sometimes termed a message digest, a digital fingerprint, a digest or a checksum).

  The ideal hash function has three main properties - it is extremely easy to calculate a hash for any given data, it is extremely difficult or almost impossible in a practical sense to calculate a text that has a given hash, and it is extremely unlikely

  that two different messages, however close, will have the same hash.

  Functions with these properties are used as hash functions for a variety of purposes, both within and outside cryptography. Practical applications include message integrity checks, digital signatures, authentication, and various information

  security applications. A hash can also act as a concise representation of the message or document from which it was computed, and allows easy indexing of duplicate or unique data files.

  In various standards and applications, the two most commonly used hash functions are MD5 and SHA-1. In 2005, security flaws were identified in both of these, namely that a possible mathematical weakness might exist, indicating that a

  stronger hash function would be desirable. In 2007 the National Institute of Standards and Technology announced a contest to design a hash function which will be given the name SHA-3 and be the subject of a FIPS standard.

  A hash function takes a string of any length as input and produces a fixed length string which acts as a kind of "signature" for the data provided. In this way, a person knowing the hash is unable to work out the original message, but someone

  knowing the original message can prove the hash is created from that message, and none other. A cryptographic hash function should behave as much as possible like a random function while still being deterministic and efficiently

  computable.

  A cryptographic hash function is considered "insecure" from a cryptographic point of view, if either of the following is computationally feasible:

  finding a (previously unseen) message that matches a given digest

  finding "collisions", wherein two different messages have the same message digest.

  An attacker who can do either of these things might, for example, use them to substitute an authorized message with an unauthorized one.

  Ideally, it should not even be feasible to find two messages whose digests are substantially similar; nor would one want an attacker to be able to learn anything useful about a message given only its digest. Of course the attacker learns at

  least one piece of information, the digest itself, which for instance gives the attacker the ability to recognise the same message should it occur again.

  REFERENCES:

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Pages 40-41.

  also see:

  http://en.wikipedia.org/wiki/Cryptographic_hash_function