ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 281:

  Which layer of the OSI/ISO model handles physical addressing, network topology, line discipline, error notification, orderly delivery of frames, and optional flow control?

  A. Physical
  B. Data link
  C. Network
  D. Session
  B. Data link

  ---

  The Data Link layer provides data transport across a physical link. It handles physical addressing, network topology, line discipline, error notification, orderly delivery of frames, and optional flow control. Source: ROTHKE, Ben, CISSP CBK Review presentation on domain 2, August 1999.

• Question 282:

  Which of the following statements regarding an off-site information processing facility is TRUE?

  A. It should have the same amount of physical access restrictions as the primary processing site.
  B. It should be located in proximity to the originating site so that it can quickly be made operational.
  C. It should be easily identified from the outside so in the event of an emergency it can be easily found.
  D. Need not have the same level of environmental monitoring as the originating site since this would be cost prohibitive.
  A. It should have the same amount of physical access restrictions as the primary processing site.

  ---

  It is very important that the offsite has the same restrictions in order to avoide misuse.

  The following answers are incorrect because:

  It should be located in proximity to the originating site so that it can quickly be made operational is incorrect as the offsite is also subject to the same disaster as of the primary site.

  It should be easily identified from the outside so in the event of an emergency it can be easily found is also incorrect as it should not be easily identified to prevent intentional sabotage.

  Need not have the same level of environmental monitoring as the originating site since this would be cost prohibitive is also incorrect as it should be like its primary site.

  Reference : Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 5: Disaster Recovery and Business Continuity (page 265).

• Question 283:

  What mechanism automatically causes an alarm originating in a data center to be transmitted over the local municipal fire or police alarm circuits for relaying to both the local police/fire station and the appropriate headquarters?

  A. Central station alarm
  B. Proprietary alarm
  C. A remote station alarm
  D. An auxiliary station alarm
  D. An auxiliary station alarm

  ---

  Auxiliary station alarms automatically cause an alarm originating in a data center to be transmitted over the local municipal fire or police alarm circuits for relaying to both the local police/fire station and the appropriate headquarters. They are

  usually Municipal Fire Alarm Boxes are installed at your business or building, they are wired directly into the fire station.

  Central station alarms are operated by private security organizations. It is very similar to a proprietary alarm system (see below). However, the biggest difference is the monitoring and receiving of alarm is done off site at a central location

  manned by non staff members. It is a third party.

  Proprietary alarms are similar to central stations alarms except that monitoring is performed directly on the protected property. This type of alarm is usually use to protect large industrials or commercial buildings. Each of the buildings in the

  same vincinity has their own alarm system, they are all wired together at a central location within one of the building acting as a common receiving point. This point is usually far away from the other building so it is not under the same danger.

  It is usually man 24 hours a day by a trained team who knows how to react under different conditions.

  A remote station alarm is a direct connection between the signal-initiating device at the protected property and the signal-receiving device located at a remote station, such as the fire station or usually a monitoring service. This is the most

  popular type of implementation and the owner of the premise must pay a monthly monitoring fee. This is what most people use in their home where they get a company like ADT to receive the alarms on their behalf.

  A remote system differs from an auxiliary system in that it does not use the municipal fire of police alarm circuits.

  Reference(s) used for this question:

  ANDRESS, Mandy, Exam Cram CISSP, Coriolis, 2001, Chapter 11: Physical Security (page 211).

  and

  Great presentation J.T.A. Stone on SlideShare

• Question 284:

  Layer 4 of the OSI stack is known as:

  A. the data link layer
  B. the transport layer
  C. the network layer
  D. the presentation layer
  B. the transport layer

  ---

  Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 285:

  Which of the following is NOT a basic component of security architecture?

  A. Motherboard
  B. Central Processing Unit (CPU
  C. Storage Devices
  D. Peripherals (input/output devices)
  A. Motherboard

  ---

  The CPU, storage devices and peripherals each have specialized roles in the security archecture. The CPU, or microprocessor, is the brains behind a computer system and performs calculations as it solves problemes and performs system tasks. Storage devices provide both long- and short- term stoarge of information that the CPU has either processed or may process. Peripherals (scanners, printers, modems, etc) are devices that either input datra or receive the data output by the CPU.

  The motherboard is the main circuit board of a microcomputer and contains the connectors for attaching additional boards. Typically, the motherboard contains the CPU, BIOS, memory, mass storage interfaces, serial and parallel ports,

  expansion slots, and all the controllers required to control standard peripheral devices.

  Reference(s) used for this question:

  TIPTON, Harold F., The Official (ISC)2 Guide to the CISSP CBK (2007), page 308.

• Question 286:

  Which of the following statements pertaining to packet filtering is incorrect?

  A. It is based on ACLs.
  B. It is not application dependant.
  C. It operates at the network layer.
  D. It keeps track of the state of a connection.
  D. It keeps track of the state of a connection.

  ---

  Packet filtering is used in the first generation of firewalls and does not keep track of the state of a connection. Stateful packet filtering does. Source: WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#2 Telecommunications and Network Security (page 6)

• Question 287:

  Which of the following backup sites is the most effective for disaster recovery?

  A. Time brokers
  B. Hot sites
  C. Cold sites
  D. Reciprocal Agreement
  B. Hot sites

  ---

  A hot site has the equipment, software and communications capabilities to facilitate a recovery within a few minutes or hours following the notification of a disaster to the organization's primary site. With the exception of providing your own hot site, commercial hot sites provide the greatest protection. Most will allow you up to six weeks to restore your sites if you declare a disaster. They also permit an annual amount of time to test the Disaster Plan.

  The following answers are incorrect:

  Cold sites. Cold sites are empty computer rooms consisting only of environmental systems, such as air conditioning and raised floors, etc. They do not meet the requirements of most regulators and boards of directors that the disaster plan be

  tested at least annually.

  Reciprocal Agreement. Reciprocal agreements are not contracts and cannot be enforced. You cannot force someone you have such an agreement with to provide processing to you. Government regulators do not accept reciprocal agreements as valid disaster recovery backup sites. Time Brokers. Time Brokers promise to deliver processing time on other systems. They charge a fee, but cannot guaranty that processing will always be available, especially in areas that experienced multiple disasters.

  The following reference(s) were/was used to create this question: ISC2 OIG, 2007 p368 Shon Harris AIO v3. p.710

• Question 288:

  Which type of encryption is considered to be unbreakable if the stream is truly random and is as large as the plaintext and never reused in whole or part?

  A. One Time Pad (OTP)
  B. One time Cryptopad (OTC)
  C. Cryptanalysis
  D. Pretty Good Privacy (PGP)
  A. One Time Pad (OTP)

  ---

  OTP or One Time Pad is considered unbreakable if the key is truly random and is as large as the plaintext and never reused in whole or part AND kept secret. In cryptography, a one-time pad is a system in which a key generated randomly is used only once to encrypt a message that is then decrypted by the receiver using the matching one-time pad and key. Messages encrypted with keys based on randomness have the advantage that there is theoretically no way to "break the code" by analyzing a succession of messages. Each encryption is unique and bears no relation to the next encryption so that some pattern can be detected.

  With a one-time pad, however, the decrypting party must have access to the same key used to encrypt the message and this raises the problem of how to get the key to the decrypting party safely or how to keep both keys secure. One-time pads have sometimes been used when the both parties started out at the same physical location and then separated, each with knowledge of the keys in the one-time pad. The key used in a one-time pad is called a secret key because if it is revealed, the messages encrypted with it can easily be deciphered.

  One-time pads figured prominently in secret message transmission and espionage before and during World War II and in the Cold War era. On the Internet, the difficulty of securely controlling secret keys led to the invention of public key cryptography.

  The biggest challenge with OTP was to get the pad security to the person or entity you wanted to communicate with. It had to be done in person or using a trusted courrier or custodian. It certainly did not scale up very well and it would not be usable for large quantity of data that needs to be encrypted as we often time have today.

  The following answers are incorrect:

  -

  One time Cryptopad: Almost but this isn't correct. Cryptopad isn't a valid term in cryptography.

  -

  Cryptanalysis: Sorry, incorrect. Cryptanalysis is the process of analyzing information in an effort to breach the cryptographic security systems.

  -

  PGP - Pretty Good Privacy: PGP, written by Phil Zimmermann is a data encryption and decryption program that provides cryptographic privacy and authentication for data. Still isn't the right answer though. Read more here about PGP.

  The following reference(s) was used to create this question: To get more info on this

• Question 289:

  Communications devices must operate:

  A. at different speeds to communicate.
  B. at the same speed to communicate.
  C. at varying speeds to interact.
  D. at high speed to interact.
  B. at the same speed to communicate.

  ---

  Communications devices must operate at the same speed to communicate.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 100.

• Question 290:

  How should a doorway of a manned facility with automatic locks be configured?

  A. It should be configured to be fail-secure.
  B. It should be configured to be fail-safe.
  C. It should have a door delay cipher lock.
  D. It should not allow piggybacking.
  B. It should be configured to be fail-safe.

  ---

  Access controls are meant to protect facilities and computers as well as people.

  In some situations, the objectives of physical access controls and the protection of people's lives may come into conflict. In theses situations, a person's life always takes precedence.

  Many physical security controls make entry into and out of a facility hard, if not impossible. However, special consideration needs to be taken when this could affect lives. In an information processing facility, different types of locks can be

  used and piggybacking should be prevented, but the issue here with automatic locks is that they can either be configured as fail-safe or fail- secure.

  Since there should only be one access door to an information processing facility, the automatic lock to the only door to a man-operated room must be configured to allow people out in case of emergency, hence to be fail-safe (sometimes

  called fail-open), meaning that upon fire alarm activation or electric power failure, the locking device unlocks. This is because the solenoid that maintains power to the lock to keep it in a locked state fails and thus opens or unlocks the

  electronic lock.

  Fail Secure works just the other way. The lock device is in a locked or secure state with no power applied. Upon authorized entry, a solinoid unlocks the lock temporarily. Thus in a Fail Secure lock, loss of power of fire alarm activation causes

  the lock to remain in a secure mode.

  Reference(s) used for this question:

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 451). McGraw-Hill.

  Kindle Edition.

  and

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 20249-20251). Auerbach Publications. Kindle Edition.