ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 321:

  What principle focuses on the uniqueness of separate objects that must be joined together to perform a task? It is sometimes referred to as "what each must bring" and joined together when getting access or decrypting a file. Each of which does not reveal the other?

  A. Dual control
  B. Separation of duties
  C. Split knowledge
  D. Need to know
  C. Split knowledge

  ---

  Split knowledge involves encryption keys being separated into two components, each of which does not reveal the other. Split knowledge is the other complementary access control principle to dual control.

  In cryptographic terms, one could say dual control and split knowledge are properly implemented if no one person has access to or knowledge of the content of the complete cryptographic key being protected by the two rocesses. The sound

  implementation of dual control and split knowledge in a cryptographic environment necessarily means that the quickest way to break the key would be through the best attack known for the algorithm of that key. The principles of dual control

  and split knowledge primarily apply to access to plaintext keys.

  Access to cryptographic keys used for encrypting and decrypting data or access to keys that are encrypted under a master key (which may or may not be maintained under dual control and split knowledge) do not require dual control and split

  knowledge. Dual control and split knowledge can be summed up as the determination of any part of a key being protected must require the collusion between two or more persons with each supplying unique cryptographic materials that must

  be joined together to access the protected key.

  Any feasible method to violate the axiom means that the principles of dual control and split knowledge are not being upheld.

  Split knowledge is the unique "what each must bring" and joined together when implementing dual control. To illustrate, a box containing petty cash is secured by one combination lock and one keyed lock. One employee is given the

  combination to the combo lock and another employee has possession of the correct key to the keyed lock.

  In order to get the cash out of the box both employees must be present at the cash box at the same time. One cannot open the box without the other. This is the aspect of dual control.

  On the other hand, split knowledge is exemplified here by the different objects (the combination to the combo lock and the correct physical key), both of which are unique and necessary, that each brings to the meeting. Split knowledge

  focuses on the uniqueness of separate objects that must be joined together.

  Dual control has to do with forcing the collusion of at least two or more persons to combine their split knowledge to gain access to an asset. Both split knowledge and dual control complement each other and are necessary functions that

  implement the segregation of duties in high integrity cryptographic environments.

  The following are incorrect answers:

  Dual control is a procedure that uses two or more entities (usually persons) operating in concert to protect a system resource, such that no single entity acting alone can access that resource. Dual control is implemented as a security

  procedure that requires two or more persons to come together and collude to complete a process. In a cryptographic system the two (or more) persons would each supply a unique key, that when taken together, performs a cryptographic

  process. Split knowledge is the other complementary access control principle to dual control.

  Separation of duties - The practice of dividing the steps in a system function among different individuals, so as to keep a single individual from subverting the process.

  The need-to-know principle requires a user having necessity for access to, knowledge of, or possession of specific information required to perform official tasks or services.

  Reference(s) used for this question:

  Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :

  Cryptography (Kindle Locations 1621-1635). . Kindle Edition.

  and

  Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :

  Cryptography (Kindle Locations 1643-1650). . Kindle Edition.

  and

  Shon Harris, CISSP All In One (AIO), 6th Edition , page 126

• Question 322:

  Which of the following is not a physical control for physical security?

  A. lighting
  B. fences
  C. training
  D. facility construction materials
  C. training

  ---

  Some physical controls include fences, lights, locks, and facility construction materials. Some administrative controls include facility selection and construction, facility management, personnel controls, training, and emergency response and procedures.

  From: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 3rd. Ed., Chapter 6, page 403.

• Question 323:

  In the days before CIDR (Classless Internet Domain Routing), networks were commonly organized by classes. Which of the following would have been true of a Class B network?

  A. The first bit of the IP address would be set to zero.
  B. The first bit of the IP address would be set to one and the second bit set to zero.
  C. The first two bits of the IP address would be set to one, and the third bit set to zero.
  D. The first three bits of the IP address would be set to one.
  C. The first two bits of the IP address would be set to one, and the third bit set to zero.

  ---

  Each Class B network address has a 16-bit network prefix, with the two highest order bits set to 1-0.

  The following answers are incorrect:

  The first bit of the IP address would be set to zero. Is incorrect because, this would be a Class A network address.

  The first two bits of the IP address would be set to one, and the third bit set to zero. Is incorrect because, this would be a Class C network address.

  The first three bits of the IP address would be set to one. Is incorrect because, this is a distractor. Class D and E have the first three bits set to 1. Class D the 4th bit is 0 and for Class E the 4th bit to 1.

  Classless Internet Domain Routing (CIDR)

  High Order bits are shown in bold below.

  For Class A, the addresses are 0.0.0.0 - 127.255.255.255 The lowest Class A address is represented in binary as 00000000.00000000.0000000.00000000 For Class B networks, the addresses are 128.0.0.0 - 191.255.255.255. The lowest Class B address is represented in binary as 10000000.00000000.00000000.00000000 For Class C, the addresses are 192.0.0.0 - 223.255.255.255 The lowest Class C address is represented in binary as 11000000.00000000.00000000.00000000 For Class D, the addresses are 224.0.0.0 - 239.255.255.255 (Multicast) The lowest Class D address is represented in binary as 11100000.00000000.00000000.00000000 For Class E, the addresses are 240.0.0.0 - 255.255.255.255 (Reserved for future usage) The lowest Class E address is represented in binary as 11110000.00000000.00000000.00000000 Classful IP Address Format

  

  References: 3Com http://www.3com.com/other/pdfs/infra/corpinfo/en_US/501302.pdf AIOv3 Telecommunications and Networking Security (page 438)

• Question 324:

  This baseline sets certain thresholds for specific errors or mistakes allowed and the amount of these occurrences that can take place before it is considered suspicious?

  A. Checkpoint level
  B. Ceiling level
  C. Clipping level
  D. Threshold level
  C. Clipping level

  ---

  Organizations usually forgive a particular type, number, or pattern of violations, thus permitting a predetermined number of user errors before gathering this data for analysis. An organization attempting to track all violations, without sophisticated statistical computing ability, would be unable to manage the sheer quantity of such data. To make a violation listing effective, a clipping level must be established.

  The clipping level establishes a baseline for violation activities that may be normal user errors. Only after this baseline is exceeded is a violation record produced. This solution is particularly effective for small- to medium-sized installations. Organizations with large-scale computing facilities often track all violations and use statistical routines to cull out the minor infractions (e.g., forgetting a password or mistyping it several times).

  If the number of violations being tracked becomes unmanageable, the first step in correcting the problems should be to analyze why the condition has occurred. Do users understand how they are to interact with the computer resource? Are the rules too difficult to follow? Violation tracking and analysis can be valuable tools in assisting an organization to develop thorough but useable controls. Once these are in place and records are produced that accurately reflect serious violations, tracking and analysis become the first line of defense. With this procedure, intrusions are discovered before major damage occurs and sometimes early enough to catch the perpetrator. In addition, business protection and preservation are strengthened. The following answers are incorrect:

  All of the other choices presented were simply detractors.

  The following reference(s) were used for this question:

  Handbook of Information Security Management

• Question 325:

  Which access control model provides upper and lower bounds of access capabilities for a subject?

  A. Role-based access control
  B. Lattice-based access control
  C. Biba access control
  D. Content-dependent access control
  B. Lattice-based access control

  ---

  In the lattice model, users are assigned security clearences and the data is classified. Access decisions are made based on the clearence of the user and the classification of the object. Lattice-based access control is an essential ingredient

  of formal security models such as Bell- LaPadula, Biba, Chinese Wall, etc.

  The bounds concept comes from the formal definition of a lattice as a "partially ordered set for which every pair of elements has a greatest lower bound and a least upper bound." To see the application, consider a file classified as "SECRET"

  and a user Joe with a security clearence of "TOP SECRET." Under Bell- LaPadula, Joe's "least upper bound" access to the file is "READ" and his least lower bound is "NO WRITE" (star property).

  Role-based access control is incorrect. Under RBAC, the access is controlled by the permissions assigned to a role and the specific role assigned to the user.

  Biba access control is incorrect. The Biba integrity model is based on a lattice structure but the context of the question disqualiifes it as the best answer.

  Content-dependent access control is incorrect. In content dependent access control, the actual content of the information determines access as enforced by the arbiter.

  References:

  CBK, pp. 324-325.

  AIO3, pp. 291-293. See aprticularly Figure 5-19 on p. 293 for an illustration of bounds in action.

• Question 326:

  Which of the following is not appropriate in addressing object reuse?

  A. Degaussing magnetic tapes when they're no longer needed.
  B. Deleting files on disk before reusing the space.
  C. Clearing memory blocks before they are allocated to a program or data.
  D. Clearing buffered pages, documents, or screens from the local memory of a terminal or printer.
  B. Deleting files on disk before reusing the space.

  ---

  Object reuse requirements, applying to systems rated TCSEC C2 and above, are used to protect files, memory, and other objects in a trusted system from being accidentally accessed by users who are not authorized to access them. Deleting files on disk merely erases file headers in a directory structure. It does not clear data from the disk surface, thus making files still recoverable. All other options involve clearing used space, preventing any unauthorized access.

  Source: RUSSEL, Deborah and GANGEMI, G.T. Sr., Computer Security Basics, O'Reilly, July 1992 (page 119).

• Question 327:

  Hierarchical Storage Management (HSM) is commonly employed in:

  A. very large data retrieval systems
  B. very small data retrieval systems
  C. shorter data retrieval systems
  D. most data retrieval systems
  A. very large data retrieval systems

  ---

  Hierarchical Storage Management (HSM) is commonly employed in very large data retrieval systems.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 71.

• Question 328:

  The high availability of multiple all-inclusive, easy-to-use hacking tools that do NOT require much technical knowledge has brought a growth in the number of which type of attackers?

  A. Black hats
  B. White hats
  C. Script kiddies
  D. Phreakers
  C. Script kiddies

  ---

  As script kiddies are low to moderately skilled hackers using available scripts and tools to easily launch attacks against victims.

  The other answers are incorrect because :

  Black hats is incorrect as they are malicious , skilled hackers. White hats is incorrect as they are security professionals. Phreakers is incorrect as they are telephone/PBX (private branch exchange) hackers. Reference : Shon Harris AIO v3 ,

  Chapter 12: Operations security , Page : 830

• Question 329:

  Under United States law, an investigator's notebook may be used in court in which of the following scenarios?

  A. When the investigator is unwilling to testify.
  B. When other forms of physical evidence are not available.
  C. To refresh the investigators memory while testifying.
  D. If the defense has no objections.
  C. To refresh the investigators memory while testifying.

  ---

  An investigator's notebook cannot be used as evidence is court. It can only be used by the investigator to refresh his memory during a proceeding, but cannot be submitted as evidence in any form.

  The following answers are incorrect:

  When the investigator is unwilling to testify. Is incorrect because the notebook cannot be submitted as evidence in any form.

  When other forms of physical evidence are not available. Is incorrect because the notebook cannot be submitted as evidence in any form.

  If the defense has no objections. Is incorrect because the notebook cannot be submitted as evidence in any form.

• Question 330:

  Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?

  A. 10.0.42.5
  B. 11.0.42.5
  C. 12.0.42.5
  D. 13.0.42.5
  A. 10.0.42.5

  ---

  This is a valid Class A reserved address. For Class A, the reserved addresses are 10.0.0.0 - 10.255.255.255. The following answers are incorrect:

  11.0.42.5

  Is incorrect because it is not a Class A reserved address.

  12.0.42.5

  Is incorrect because it is not a Class A reserved address.

  13.0.42.5

  Is incorrect because it is not a Class A reserved address.

  The private IP address ranges are defined within RFC 1918:

  RFC 1918 private ip address range

  

  References: 3Com http://www.3com.com/other/pdfs/infra/corpinfo/en_US/501302.pdf AIOv3 Telecommunications and Networking Security (page 438)