ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 21:

  Which type of firewall can be used to track connectionless protocols such as UDP and RPC?

  A. Stateful inspection firewalls
  B. Packet filtering firewalls
  C. Application level firewalls
  D. Circuit level firewalls
  A. Stateful inspection firewalls

  ---

  Packets in a stateful inspection firewall are queued and then analyzed at all OSI layers, providing a more complete inspection of the data. By examining the state and context of the incoming data packets, it helps to track the protocols that are considered "connectionless", such as UDP-based applications and Remote Procedure Calls (RPC).

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 91).

• Question 22:

  Which of the following is not a security goal for remote access?

  A. Reliable authentication of users and systems
  B. Protection of confidential data
  C. Easy to manage access control to systems and network resources
  D. Automated login for remote users
  D. Automated login for remote users

  ---

  An automated login function for remote users would imply a weak authentication, thus certainly not a security goal.

  Source: TIPTON, Harold F. and KRAUSE, Micki, Information Security Management Handbook, 4th edition, volume 2, 2001, CRC Press, Chapter 5: An Introduction to Secure Remote Access (page 100).

• Question 23:

  What is called the access protection system that limits connections by calling back the number of a previously authorized location?

  A. Sendback systems
  B. Callback forward systems
  C. Callback systems
  D. Sendback forward systems
  C. Callback systems

  ---

  The Answer: Call back Systems; Callback systems provide access protection by calling back the number of a previously authorized location, but this control can be compromised by call forwarding. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 35.

• Question 24:

  In Mandatory Access Control, sensitivity labels attached to object contain what information?

  A. The item's classification
  B. The item's classification and category set
  C. The item's category
  D. The items's need to know
  B. The item's classification and category set

  ---

  A Sensitivity label must contain at least one classification and one category set. Category set and Compartment set are synonyms, they mean the same thing. The sensitivity label must contain at least one Classification and at least one

  Category. It is common in some environments for a single item to belong to multiple categories. The list of all the categories to which an item belongs is called a compartment set or category set.

  The following answers are incorrect:

  the item's classification. Is incorrect because you need a category set as well. the item's category. Is incorrect because category set and classification would be both be required. The item's need to know. Is incorrect because there is no such

  thing. The need to know is indicated by the catergories the object belongs to. This is NOT the best answer.

  Reference(s) used for this question:

  OIG CBK, Access Control (pages 186 - 188)

  AIO, 3rd Edition, Access Control (pages 162 - 163)

  AIO, 4th Edittion, Access Control, pp 212-214.

  Wikipedia - http://en.wikipedia.org/wiki/Mandatory_Access_Control

• Question 25:

  What is the appropriate role of the security analyst in the application system development or acquisition project?

  A. policeman
  B. control evaluator and consultant
  C. data owner
  D. application user
  B. control evaluator and consultant

  ---

  The correct answer is "control evaluator and consultant". During any system development or acquisition, the security staff should evaluate security controls and advise (or consult) on the strengths and weaknesses with those responsible for

  making the final decisions on the project.

  The other answers are not correct because:

  policeman - It is never a good idea for the security staff to be placed into this type of role (though it is sometimes unavoidable). During system development or acquisition, there should be no need of anyone filling the role of policeman.

  data owner - In this case, the data owner would be the person asking for the new system to manage, control, and secure information they are responsible for. While it is possible the security staff could also be the data owner for such a project

  if they happen to have responsibility for the information, it is also possible someone else would fill this role. Therefore, the best answer remains "control evaluator and consultant".

  application user - Again, it is possible this could be the security staff, but it could also be many other people or groups. So this is not the best answer.

  Reference:

  Official ISC2 Guide page: 555 - 560

  All in One Third Edition page: 832 - 846

• Question 26:

  Who is responsible for providing reports to the senior management on the effectiveness of the security controls?

  A. Information systems security professionals
  B. Data owners
  C. Data custodians
  D. Information systems auditors
  D. Information systems auditors

  ---

  IT auditors determine whether systems are in compliance with the security policies, procedures, standards, baselines, designs, architectures, management direction and other requirements" and "provide top company management with an

  independent view of the controls that have been designed and their effectiveness."

  "Information systems security professionals" is incorrect. Security professionals develop the security policies and supporting baselines, etc.

  "Data owners" is incorrect. Data owners have overall responsibility for information assets and assign the appropriate classification for the asset as well as ensure that the asset is protected with the proper controls.

  "Data custodians" is incorrect. Data custodians care for an information asset on behalf of the data owner.

  References:

  CBK, pp. 38 - 42.

  AIO3. pp. 99 - 104

• Question 27:

  What is the maximum number of different keys that can be used when encrypting with Triple DES?

  A. 1
  B. 2
  C. 3
  D. 4
  C. 3

  ---

  Triple DES encrypts a message three times. This encryption can be accomplished in several ways. The most secure form of triple DES is when the three encryptions are performed with three different keys. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 4: Cryptography (page 152).

• Question 28:

  What is the framing specification used for transmitting digital signals at 1.544 Mbps on a T1 facility?

  A. DS-0
  B. DS-1
  C. DS-2
  D. DS-3
  B. DS-1

  ---

  Digital Signal level 1 (DS-1) is the framing specification used for transmitting digital signals at 1.544 Mbps on a T1 facility. DS-0 is the framing specification used in transmitting digital signals over a single 64 Kbps channel over a T1 facility. DS-3 is the framing specification used for transmitting digital signals at 44.736 Mbps on a T3 facility. DS-2 is not a defined framing specification.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 114).

• Question 29:

  Which port does the Post Office Protocol Version 3 (POP3) make use of?

  A. 110
  B. 109
  C. 139
  D. 119
  A. 110

  ---

  The other answers are not correct because of the following protocol/port numbers matrix: Post Office Protocol (POP2) 109 Network News Transfer Protocol 119 NetBIOS 139

• Question 30:

  Which of the following recovery plan test results would be most useful to management?

  A. elapsed time to perform various activities.
  B. list of successful and unsuccessful activities.
  C. amount of work completed.
  D. description of each activity.
  B. list of successful and unsuccessful activities.

  ---

  After a test has been performed the most useful test results for manangement would be knowing what worked and what didn't so that they could correct the mistakes where needed.

  The following answers are incorrect:

  elapsed time to perform various activities. This is incorrect because it is not the best answer, these results are not as useful as list of successful and unsuccessful activities would be to managment.

  amount of work completed. This is incorrect because it is not the best answer, these results are not as useful as list of successful and unsuccessful activities would be to managment.

  description of each activity. This is incorrect because it is not the best answer, these results are not as useful as list of successful and unsuccessful activities would be to managment.