ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 11:

  The number of violations that will be accepted or forgiven before a violation record is produced is called which of the following?

  A. clipping level
  B. acceptance level
  C. forgiveness level
  D. logging level
  A. clipping level

  ---

  The correct answer is "clipping level". This is the point at which a system decides to take some sort of action when an action repeats a preset number of times. That action may be to log the activity, lock a user account, temporarily close a

  port, etc.

  Example: The most classic example of a clipping level is failed login attempts. If you have a system configured to lock a user's account after three failed login attemts, that is the "clipping level".

  The other answers are not correct because:

  Acceptance level, forgiveness level, and logging level are nonsensical terms that do not exist (to my knowledge) within network security.

  Reference:

  Official ISC2 Guide - The term "clipping level" is not in the glossary or index of that book. I cannot find it in the text either. However, I'm quite certain that it would be considered part of the CBK, despite its exclusion from the Official Guide.

  All in One Third Edition page: 136 - 137

• Question 12:

  What is the most correct choice below when talking about the steps to resume normal operation at the primary site after the green light has been given by the salvage team?

  A. The most critical operations are moved from alternate site to primary site before others
  B. Operation may be carried by a completely different team than disaster recovery team
  C. The least critical functions should be moved back first
  D. You moves items back in the same order as the categories document in your plan or exactly in the same order as you did on your way to the alternate site
  C. The least critical functions should be moved back first

  ---

  It's interesting to note that the steps to resume normal processing operations will be different than the steps of the recovery plan; that is, the least critical work should be brought back first to the primary site.

  The most important point above in the steps would be to move the least critical items or resources back to the primary site first. This way you can ensure that the site was really well prepared and that all is working fine.

  Before that first step would be done, you would get the green light from the salvage team that it is fine to move back to the primary site. The first step after getting the green light would be to move the least critical elements first.

  As stated in the Shon Harris book:

  The least critical functions should be moved back first, so if there are issues in network configurations or connectivity, or important steps were not carried out, the critical operations of the company are not negatively affected. Why go through

  the trouble of moving the most critical systems and operations to a safe and stable site, only to return it to a main site that is untested? Let the less critical departments act as the canary. If they survive, then move over the more critical components of the company. When it is time for the company to move back into its original site or a new site, the company enters the reconstitution phase. A company is not out of an emergency state until it is back in operation at the original primary site or a new site that

  was constructed to replace the primary site, because the company is always vulnerable while operating in a backup facility.

  Many logistical issues need to be considered as to when a company must return from the alternate site to the original site. The following lists a few of these issues:

  Ensuring the safety of employees

  Ensuring an adequate environment is provided (power, facility infrastructure, water, HVAC)

  Ensuring that the necessary equipment and supplies are present and in working order

  Ensuring proper communications and connectivity methods are working

  Properly testing the new environment

  Once the coordinator, management, and salvage team sign off on the readiness of the facility, the salvage team should carry out the following steps:

  Back up data from the alternate site and restore it within the new facility.

  Carefully terminate contingency operations.

  Securely transport equipment and personnel to the new facility.

  All other choices are not the correct answer.

  Reference(s) used for this question:

  Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Location 19389). McGraw- Hill. Kindle Edition.

  and

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Page 290.

• Question 13:

  Which access control model is also called Non Discretionary Access Control (NDAC)?

  A. Lattice based access control
  B. Mandatory access control
  C. Role-based access control
  D. Label-based access control
  C. Role-based access control

  ---

  RBAC is sometimes also called non-discretionary access control (NDAC) (as Ferraiolo says "to distinguish it from the policy-based specifics of MAC"). Another model that fits within the NDAC category is Rule- Based Access Control (RuBAC

  or RBAC). Most of the CISSP books use the same acronym for both models but NIST tend to use a lowercase "u" in between R and B to differentiate the two models.

  You can certainly mimic MAC using RBAC but true MAC makes use of Labels which contains the sensitivity of the objects and the categories they belong to. No labels means MAC is not being used.

  One of the most fundamental data access control decisions an organization must make is the amount of control it will give system and data owners to specify the level of access users of that data will have. In every organization there is a

  balancing point between the access controls enforced by organization and system policy and the ability for information owners to determine who can have access based on specific business requirements. The process of translating that

  balance into a workable access control model can be defined by three general access frameworks:

  Discretionary access control

  Mandatory access control

  Nondiscretionary access control

  A role-based access control (RBAC) model bases the access control authorizations on the roles (or functions) that the user is assigned within an organization. The determination of what roles have access to a resource can be governed by

  the owner of the data, as with DACs, or applied based on policy, as with MACs.

  Access control decisions are based on job function, previously defined and governed by policy, and each role (job function) will have its own access capabilities. Objects associated with a role will inherit privileges assigned to that role. This is

  also true for groups of users, allowing administrators to simplify access control strategies by assigning users to groups and groups to roles. There are several approaches to RBAC. As with many system controls, there are variations on how

  they can be applied within a computer system.

  There are four basic RBAC architectures:

  1.

  Non-RBAC: Non-RBAC is simply a user-granted access to data or an application by traditional mapping, such as with ACLs. There are no formal "roles" associated with the mappings, other than any identified by the particular user.

  2.

  Limited RBAC: Limited RBAC is achieved when users are mapped to roles within a single application rather than through an organization-wide role structure. Users in a limited RBAC system are also able to access non-RBAC-based applications or data. For example, a user may be assigned to multiple roles within several applications and, in addition, have direct access to another application or system independent of his or her assigned role. The key attribute of limited RBAC is that the role for that user is defined within an application and not necessarily based on the user's organizational job function.

  3.

  Hybrid RBAC: Hybrid RBAC introduces the use of a role that is applied to multiple applications or systems based on a user's specific role within the organization. That role is then applied to applications or systems that subscribe to the organization's role-based model. However, as the term "hybrid" suggests, there are instances where the subject may also be assigned to roles defined solely within specific applications, complimenting (or, perhaps, contradicting) the larger, more encompassing organizational role used by other systems.

  4.

  Full RBAC: Full RBAC systems are controlled by roles defined by the organization's policy and access control infrastructure and then applied to applications and systems across the enterprise. The applications, systems, and associated

  data apply permissions based on that enterprise definition, and not one defined by a specific application or system.

  Be careful not to try to make MAC and DAC opposites of each other -- they are two different access control strategies with RBAC being a third strategy that was defined later to address some of the limitations of MAC and DAC.

  The other answers are not correct because:

  Mandatory access control is incorrect because though it is by definition not discretionary, it is not called "non-discretionary access control." MAC makes use of label to indicate the sensitivity of the object and it also makes use of categories to

  implement the need to know.

  Label-based access control is incorrect because this is not a name for a type of access control but simply a bogus detractor.

  Lattice based access control is not adequate either. A lattice is a series of levels and a subject will be granted an upper and lower bound within the series of levels. These levels could be sensitivity levels or they could be confidentiality levels

  or they could be integrity levels.

  Reference(s) used for this question:

  All in One, third edition, page 165.

  Ferraiolo, D., Kuhn, D. and Chandramouli, R. (2003). Role-Based Access Control, p. 18.

  Ferraiolo, D., Kuhn, D. (1992). Role-Based Access Controls. http://csrc.nist.gov/rbac/ Role_Based_Access_Control-1992.html

  Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :

  Access Control ((ISC)2 Press) (Kindle Locations 1557-1584). Auerbach Publications. Kindle Edition.

  Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :

  Access Control ((ISC)2 Press) (Kindle Locations 1474-1477). Auerbach Publications. Kindle Edition.

• Question 14:

  Which of the following is an example of a passive attack?

  A. Denying services to legitimate users
  B. Shoulder surfing
  C. Brute-force password cracking
  D. Smurfing
  B. Shoulder surfing

  ---

  Shoulder surfing is a form of a passive attack involving stealing passwords, personal identification numbers or other confidential information by looking over someone's shoulder. All other forms of attack are active attacks, where a threat makes a modification to the system in an attempt to take advantage of a vulnerability.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  3: Security Management Practices (page 63).

• Question 15:

  A copy of evidence or oral description of its contents; which is not as reliable as best evidence is what type of evidence?

  A. Direct evidence
  B. Circumstantial evidence
  C. Hearsay evidence
  D. Secondary evidence
  D. Secondary evidence

  ---

  Secondary evidence is a copy of evidence or oral description of its contents; not as reliable as best evidence Here are other types of evidence: Best evidence -- original or primary evidence rather than a copy of duplicate of the evidence Direct evidence -- proves or disproves a specific act through oral testimony based on information gathered through the witness's five senses Conclusive evidence -- incontrovertible; overrides all other evidence Opinions -- two types: Expert -- may offer an opinion based on personal expertise and facts, Non-expert -- may testify only as to facts Circumstantial evidence -- inference of information from other, immediate, relevant facts Corroborative evidence -- supporting evidence used to help prove an idea or point; used as a supplementary tool to help prove a primary piece of evidence Hearsay evidence (3rdparty) -- oral or written evidence that is presented in court that is second hand and has no firsthand proof of accuracy or reliability

  (i)

  Usually not admissible in court

  (ii)

  Computer generated records and other business records are in hearsay category

  (iii) Certain exceptions to hearsay rule:

  (1)

  Made during the regular conduct of business and authenticated by witnesses familiar with their use

  (2)

  Relied upon in the regular course of business

  (3)

  Made by a person with knowledge of records

  (4)

  Made by a person with information transmitted by a person with knowledge

  (5)

  Made at or near the time of occurrence of the act being investigated

  (6)

  In the custody of the witness on a regular basis Reference: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 310. and CISSP for Dummies, Peter Gregory, page 270-271

• Question 16:

  Business Continuity Planning (BCP) is not defined as a preparation that facilitates:

  A. the rapid recovery of mission-critical business operations
  B. the continuation of critical business functions
  C. the monitoring of threat activity for adjustment of technical controls
  D. the reduction of the impact of a disaster
  C. the monitoring of threat activity for adjustment of technical controls

  ---

  Although important, The monitoring of threat activity for adjustment of technical controls is not facilitated by a Business Continuity Planning The following answers are incorrect: All of the other choices are facilitated by a BCP: the continuation of critical business functions the rapid recovery of mission-critical business operations the reduction of the impact of a disaster

• Question 17:

  Which of the following could be BEST defined as the likelihood of a threat agent taking advantage of a vulnerability?

  A. A risk
  B. A residual risk
  C. An exposure
  D. A countermeasure
  A. A risk

  ---

  Risk is the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact. If a firewall has several ports open , there is a higher likelihood that an intruder will use one to access the network in an

  unauthorized method.

  The following answers are incorrect :

  Residual Risk is very different from the notion of total risk. Residual Risk would be the risks that still exists after countermeasures have been implemented. Total risk is the amount of risk a company faces if it chooses not to implement any

  type of safeguard.

  Exposure: An exposure is an instance of being exposed to losses from a threat agent.

  Countermeasure: A countermeasure or a safeguard is put in place to mitigate the potential risk. Examples of countermeasures include strong password management , a security guard.

  REFERENCES : SHON HARRIS ALL IN ONE 3rd EDITION

  Chapter - 3: Security Management Practices , Pages : 57-59

• Question 18:

  Of the reasons why a Disaster Recovery plan gets outdated, which of the following is not true?

  A. Personnel turnover
  B. Large plans can take a lot of work to maintain
  C. Continous auditing makes a Disaster Recovery plan irrelevant
  D. Infrastructure and environment changes
  C. Continous auditing makes a Disaster Recovery plan irrelevant

  ---

  Although a auditing is a part of corporate security, it in no way supercedes the requirments for a disaster recovery plan. All others can be blamed for a plan going out of date. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  9: Disaster Recovery and Business continuity (page 609).

• Question 19:

  What is the maximum allowable key size of the Rijndael encryption algorithm?

  A. 128 bits
  B. 192 bits
  C. 256 bits
  D. 512 bits
  C. 256 bits

  ---

  The Rijndael algorithm, chosen as the Advanced Encryption Standard (AES) to replace DES, can be categorized as an iterated block cipher with a variable block length and key length that can be independently chosen as 128, 192 or 256

  bits.

  Below you have a summary of the differences between AES and Rijndael.

  AES is the advanced encryption standard defined by FIPS 197. It is implemented differently than Rijndael:

  FIPS-197 specifies that the block size must always be 128 bits in AES, and that the key size may be either 128, 192, or 256 bits. Therefore AES-128, AES-192, and AES-256 are actually:

  Key Size (bits) Number of rounds

  Block Size (bits) AES-128 128 10 Rounds AES-192

  192 12 Rounds

  AES-256 256 14 Rounds Some book will say "up to 9 rounds will be done with a 128 bits keys". Really it is 10 rounds because you must include round zero which is the first round. By contrast, the Rijndael specification per se is specified with block and key sizes that may be any multiple of 32 bits, both with a minimum of 128 and a maximum of 256 bits.

  Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 4: Cryptography (page 153).

  and

  FIPS 197

  and

  https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

• Question 20:

  Which of the following are suitable protocols for securing VPN connections at the lower layers of the OSI model?

  A. S/MIME and SSH
  B. TLS and SSL
  C. IPsec and L2TP
  D. PKCS#10 and X.509
  C. IPsec and L2TP

  ---

  Reference: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw- Hill/Osborne, page 467; SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.