ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 311:

  Which of the following is NOT a symmetric key algorithm?

  A. Blowfish
  B. Digital Signature Standard (DSS)
  C. Triple DES (3DES)
  D. RC5
  B. Digital Signature Standard (DSS)

  ---

  Digital Signature Standard (DSS) specifies a Digital Signature Algorithm (DSA) appropriate for applications requiring a digital signature, providing the capability to generate signatures (with the use of a private key) and verify them (with the use of the corresponding public key).

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  8: Cryptography (page 550).

  Reference: DSS: http://www.itl.nist.gov/fipspubs/fip186.htm.

• Question 312:

  Which of the following describes a technique in which a number of processor units are employed in a single computer system to increase the performance of the system in its application environment above the performance of a single processor of the same kind?

  A. Multitasking
  B. Multiprogramming
  C. Pipelining
  D. Multiprocessing
  D. Multiprocessing

  ---

  Multiprocessing is an organizational technique in which a number of processor units are employed in a single computer system to increase the performance of the system in its application environment above the performance of a single processor of the same kind. In order to cooperate on a single application or class of applications, the processors share a common resource. Usually this resource is primary memory, and the multiprocessor is called a primary memory multiprocessor. A system in which each processor has a private (local) main memory and shares secondary (global) memory with the others is a secondary memory multiprocessor, sometimes called a multicomputer system because of the looser coupling between processors. The more common multiprocessor systems incorporate only processors of the same type and performance and thus are called homogeneous multiprocessors; however, heterogeneous multiprocessors are also employed. A special case is the attached processor, in which a second processor module is attached to a first processor in a closely coupled fashion so that the first can perform input/ output and operating system functions, enabling the attached processor to concentrate on the application workload. The following were incorrect answers:

  Multiprogramming: The interleaved execution of two or more programs by a computer, in which the central processing unit executes a few instructions from each program in succession.

  Multitasking: The concurrent operation by one central processing unit of two or more processes.

  Pipelining: A procedure for processing instructions in a computer program more rapidly, in which each instruction is divided into numerous small stages, and a population of instructions are in various stages at any given time. One instruction

  does not have to wait for the previous one to complete all of the stages before it gets into the pipeline. It would be similiar to an assembly chain in the real world.

  References:

  TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

  http://www.answers.com/

• Question 313:

  Good security is built on which of the following concept?

  A. The concept of a pass-through device that only allows certain traffic in and out
  B. The Concept of defense in depth
  C. The Concept of Preventative controls
  D. The Concept of Defensive Controls
  B. The Concept of defense in depth

  ---

  This the best of the four answers as a defense that depends on multiple layers is superior to one where all protection is embedded in a single layer (e.g., a firewall). Defense in depth would include all categories of controls.

  The Following answers are incorrect:

  "Concept of a pass through device that only allows certain traffic in and out" is incorrect. This is one definition of a firewall which can be a component of a defense in depth strategy in combination with other measures.

  "Concept of preventative controls" is incorrect. This is a component of a defense in depth strategy but the core concept is that there must be multiple layers of defenses.

  "Concept of defensive controls" is incorrect. This is a component of a defense in depth strategy but the core concept is that there must be multiple layers of defenses.

  References:

  http://en.wikipedia.org/wiki/Defense_in_depth_(computing)

  http://www.nsa.gov/snac/support/defenseindepth.pdf

• Question 314:

  Which of the following would assist the most in Host Based intrusion detection?

  A. audit trails.
  B. access control lists.
  C. security clearances.
  D. host-based authentication.
  A. audit trails.

  ---

  To assist in Intrusion Detection you would review audit logs for access violations.

  The following answers are incorrect:

  access control lists. This is incorrect because access control lists determine who has access to what but do not detect intrusions.

  security clearances. This is incorrect because security clearances determine who has access to what but do not detect intrusions.

  host-based authentication. This is incorrect because host-based authentication determine who have been authenticated to the system but do not dectect intrusions.

• Question 315:

  Which of the following is often the greatest challenge of distributed computing solutions?

  A. scalability
  B. security
  C. heterogeneity
  D. usability
  B. security

  ---

  The correct answer to this "security". It is a major factor in deciding if a centralized or decentralized environment is more appropriate.

  Example: In a centralized computing environment, you have a central server and workstations (often "dumb terminals") access applications, data, and everything else from that central servers. Therefore, the vast majority of your security

  resides on a centrally managed server. In a decentralized (or distributed) environment, you have a collection of PC's each with their own operating systems to maintain, their own software to maintain, local data storage requiring protection

  and backup. You may also have PDA's and "smart phones", data watches, USB devices of all types able to store data... the list gets longer all the time.

  It is entirely possible to reach a reasonable and acceptable level of security in a distributed environment. But doing so is significantly more difficult, requiring more effort, more money, and more time.

  The other answers are not correct because:

  scalability - A distributed computing environment is almost infinitely scalable. Much more so than a centralized environment. This is therefore a bad answer.

  heterogeneity - Having products and systems from multiple vendors in a distributed environment is significantly easier than in a centralized environment. This would not be a "challenge of distributed computing solutions" and so is not a good

  answer.

  usability - This is potentially a challenge in either environment, but whether or not this is a problem has very little to do with whether it is a centralized or distributed environment.

  Therefore, this would not be a good answer.

  Reference:

  Official ISC2 Guide page: 313-314

  All in One Third Edition page: (unavailable at this time)

• Question 316:

  Which of the following addresses a portion of the primary memory by specifying the actual address of the memory location?

  A. direct addressing
  B. Indirect addressing
  C. implied addressing
  D. indexed addressing
  A. direct addressing

  ---

  Absolute/Direct

  +------+-----+--------------------------------------+

  | load | reg | address |

  +------+-----+--------------------------------------+

  (Effective address = address as given in instruction) This requires space in an instruction for quite a large address. It is often available on CISC machines which have variable-length instructions, such as x86. Some RISC machines have a

  special Load Upper Literal instruction which places a 16-bit constant in the top half of a register. An OR literal instruction can be used to insert a 16-bit constant in the lower half of that register, so that a full 32-bit address can then be used via

  the register-indirect addressing mode, which itself is provided as "base-plus-offset" with an offset of 0.

  http://en.wikipedia.org/wiki/Addressing_mode (Very good coverage of the subject)

  also see:

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, page 186.

  also see:

  http://www.comsci.us/ic/notes/am.html

• Question 317:

  What is the primary goal of setting up a honeypot?

  A. To lure hackers into attacking unused systems
  B. To entrap and track down possible hackers
  C. To set up a sacrificial lamb on the network
  D. To know when certain types of attacks are in progress and to learn about attack techniques so the network can be fortified.
  D. To know when certain types of attacks are in progress and to learn about attack techniques so the network can be fortified.

  ---

  The primary purpose of a honeypot is to study the attack methods of an attacker for the purposes of understanding their methods and improving defenses. "To lure hackers into attacking unused systems" is incorrect. Honeypots can serve as

  decoys but their primary purpose is to study the behaviors of attackers.

  "To entrap and track down possible hackers" is incorrect. There are a host of legal issues around enticement vs entrapment but a good general rule is that entrapment is generally prohibited and evidence gathered in a scenario that could be

  considered as "entrapping" an attacker would not be admissible in a court of law.

  "To set up a sacrificial lamb on the network" is incorrect. While a honeypot is a sort of sacrificial lamb and may attract attacks that might have been directed against production systems, its real purpose is to study the methods of attackers with

  the goals of better understanding and improving network defenses.

  References

  AIO3, p. 213

• Question 318:

  Which of the following transmission media would NOT be affected by cross talk or interference?

  A. Copper cable
  B. Radio System
  C. Satellite radiolink
  D. Fiber optic cables
  D. Fiber optic cables

  ---

  Only fiber optic cables are not affected by crosstalk or interference. For your exam you should know the information about transmission media:

  Copper Cable

  Copper cable is very simple to install and easy to tap. It is used mostly for short distance and supports voice and data.

  Copper has been used in electric wiring since the invention of the electromagnet and the telegraph in the 1820s.The invention of the telephone in 1876 created further demand for copper wire as an electrical conductor.

  Copper is the electrical conductor in many categories of electrical wiring. Copper wire is used in power generation, power transmission, power distribution, telecommunications, electronics circuitry, and countless types of electrical equipment.

  Copper and its alloys are also used to make electrical contacts. Electrical wiring in buildings is the most important market for the copper industry. Roughly half of all copper mined is used to manufacture electrical wire and cable conductors.

  Copper Cable

  

  Image Source - http://i00.i.aliimg.com/photo/v0/570456138/FRLS_HR_PVC_Copper_Cable.jpg Coaxial cable Coaxial cable, or coax (pronounced 'ko.aks), is a type of cable that has an inner conductor surrounded by a tubular insulating layer, surrounded by a tubular conducting shield. Many coaxial cables also have an insulating outer sheath or

  jacket. The term coaxial comes from the inner conductor and the outer shield sharing a geometric axis. Coaxial cable was invented by English engineer and mathematician Oliver Heaviside, who patented the design in 1880.Coaxial cable differs from other shielded cable used for carrying lower-frequency signals, such as audio signals, in that the dimensions of the cable are controlled to give a precise, constant conductor spacing, which is needed for it to function efficiently as a radio frequency transmission line.

  Coaxial cable are expensive and does not support many LAN's. It supports data and video Coaxial Cable

  

  Image Source - http://www.tlc-direct.co.uk/Images/Products/size_3/CARG59.JPG Fiber optics

  An optical fiber cable is a cable containing one or more optical fibers that are used to carry light. The optical fiber elements are typically individually coated with plastic layers and contained in a protective tube suitable for the environment

  where the cable will be deployed. Different types of cable are used for different applications, for example long distance telecommunication, or providing a high-speed data connection between different parts of a building.

  Fiber optics used for long distance, hard to splice, not vulnerable to cross talk and difficult to tap.

  It supports voice data, image and video.

  Radio System

  Radio systems are used for short distance,cheap and easy to tap.

  Radio is the radiation (wireless transmission) of electromagnetic signals through the atmosphere or free space.

  Information, such as sound, is carried by systematically changing (modulating) some property of the radiated waves, such as their amplitude, frequency, phase, or pulse width. When radio waves strike an electrical conductor, the oscillating fields induce an alternating current in the conductor. The information in the waves can be extracted and transformed back into its original form.

  Fiber Optics

  

  Image Source - http://aboveinfranet.com/wp-content/uploads/2014/04/fiber-optic-cables-above- infranet- solutions.jpg

  Microwave radio system

  Microwave transmission refers to the technology of transmitting information or energy by the use of radio waves whose wavelengths are conveniently measured in small numbers of centimetre; these are called microwaves. Microwaves are widely used for point-to-point communications because their small wavelength allows conveniently-sized antennas to direct them in narrow beams, which can be pointed directly at the receiving antenna. This allows nearby microwave equipment to use the same frequencies without interfering with each other, as lower frequency radio waves do. Another advantage is that the high frequency of microwaves gives the microwave band a very large information-carrying capacity; the microwave band has a bandwidth 30 times that of all the rest of the radio spectrum below it. A disadvantage is that microwaves are limited to line of sight propagation; they cannot pass around hills or mountains as lower frequency radio waves can.

  Microwave radio transmission is commonly used in point-to-point communication systems on the surface of the Earth, in satellite communications, and in deep space radio communications. Other parts of the microwave radio band are used for radars, radio navigation systems, sensor systems, and radio astronomy.

  Microwave radio systems are carriers for voice data signal, cheap and easy to tap. Microwave Radio System

  

  Image Source - http://www.valiantcom.com/images/applications/e1_digital_microwave_radio.gif Satellite Radio Link

  Satellite radio is a radio service broadcast from satellites primarily to cars, with the signal broadcast nationwide, across a much wider geographical area than terrestrial radio stations. It is available by subscription, mostly commercial free, and

  offers subscribers more stations and a wider variety of programming options than terrestrial radio.

  Satellite radio link uses transponder to send information and easy to tap.

  The following answers are incorrect:

  Copper Cable - Copper cable is very simple to install and easy to tap. It is used mostly for short distance and supports voice and data.

  Radio System - Radio systems are used for short distance,cheap and easy to tap.

  Satellite Radio Link - Satellite radio link uses transponder to send information and easy to tap.

  The following reference(s) were/was used to create this question:

  CISA review manual 2014 page number 265 and

  Official ISC2 guide to CISSP CBK 3rd Edition Page number 233

• Question 319:

  A host-based IDS is resident on which of the following?

  A. On each of the critical hosts
  B. decentralized hosts
  C. central hosts
  D. bastion hosts
  A. On each of the critical hosts

  ---

  A host-based IDS is resident on a host and reviews the system and event logs in order to detect an attack on the host and to determine if the attack was successful. All critical serves should have a Host Based Intrusion Detection System (HIDS) installed. As you are well aware, network based IDS cannot make sense or detect pattern of attacks within encrypted traffic. A HIDS might be able to detect such attack after the traffic has been decrypted on the host. This is why critical servers should have both NIDS and HIDS.

  FROM WIKIPEDIA:

  A HIDS will monitor all or part of the dynamic behavior and of the state of a computer system. Much as a NIDS will dynamically inspect network packets, a HIDS might detect which program accesses what resources and assure that (say) a word-processor hasn\'t suddenly and inexplicably started modifying the system password-database. Similarly a HIDS might look at the state of a system, its stored information, whether in RAM, in the file-system, or elsewhere; and check that the contents of these appear as expected.

  One can think of a HIDS as an agent that monitors whether anything/anyone - internal or external - has circumvented the security policy that the operating system tries to enforce.

  http://en.wikipedia.org/wiki/Host-based_intrusion_detection_system

• Question 320:

  If any server in the cluster crashes, processing continues transparently, however, the cluster suffers some performance degradation. This implementation is sometimes called a:

  A. server farm
  B. client farm
  C. cluster farm
  D. host farm
  A. server farm

  ---

  If any server in the cluster crashes, processing continues transparently, however, the cluster suffers some performance degradation. This implementation is sometimes called a "server farm." Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 67.