ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 31:

  Which of the following would best classify as a management control?

  A. Review of security controls
  B. Personnel security
  C. Physical and environmental protection
  D. Documentation
  A. Review of security controls

  ---

  Management controls focus on the management of the IT security system and the management of risk for a system.

  They are techniques and concerns that are normally addressed by management.

  Routine evaluations and response to identified vulnerabilities are important elements of managing the risk of a system, thus considered management controls.

  SECURITY CONTROLS: The management, operational, and technical controls (i.e.,safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

  SECURITY CONTROL BASELINE: The set of minimum security controls defined for a low- impact, moderate-impact,or high-impact information system.

  The following are incorrect answers:

  Personnel security, physical and environmental protection and documentation are forms of operational controls. Reference(s) used for this question: http://csrc.nist.gov/publications/drafts/800-53-rev4/sp800-53-rev4-ipd.pdf and FIPS PUB 200 at http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

• Question 32:

  Which of the following proves or disproves a specific act through oral testimony based on information gathered through the witness's five senses?

  A. Direct evidence.
  B. Circumstantial evidence.
  C. Conclusive evidence.
  D. Corroborative evidence.
  A. Direct evidence.

  ---

  Direct evidence can prove a fact all by itself and does not need backup information to refer to. When using direct evidence, presumptions are not required. One example of direct evidence is the testimony of a witness who saw a crime take place. Although this oral evidence would be secondary in nature, meaning a case could not rest on just it alone, it is also direct evidence, meaning the lawyer does not necessarily need to provide other evidence to back it up. Direct evidence often is based on information gathered from a witness's five senses.

  The following answers are incorrect:

  Circumstantial evidence. Is incorrect because Circumstantial evidence can prove an intermediate fact that can then be used to deduce or assume the existence of another fact.

  Conclusive evidence. Is incorrect because Conclusive evidence is irrefutable and cannot be contradicted. Conclusive evidence is very strong all by itself and does not require corroboration.

  Corroborative evidence. Is incorrect because Corroborative evidence is supporting evidence used to help prove an idea or point. It cannot stand on its own, but is used as a supplementary tool to help prove a primary piece of evidence.

• Question 33:

  The RSA Algorithm uses which mathematical concept as the basis of its encryption?

  A. Geometry
  B. 16-round ciphers
  C. PI (3.14159...)
  D. Two large prime numbers
  D. Two large prime numbers

  ---

  Source: TIPTON, et. al, Official (ISC)2 Guide to the CISSP CBK, 2007 edition, page 254.

  And from the RSA web site, http://www.rsa.com/rsalabs/node.asp?id=2214 :

  The RSA cryptosystem is a public-key cryptosystem that offers both encryption and digital signatures (authentication). Ronald Rivest, Adi Shamir, and Leonard Adleman developed the RSA system in 1977 [RSA78]; RSA stands for the first letter in each of its inventors' last names.

  The RSA algorithm works as follows: take two large primes, p and q, and compute their product n = pq; n is called the modulus. Choose a number, e, less than n and relatively prime to (p-1)(q1), which means e and (p-1)(q-1) have no common factors except 1. Find another number d such that (ed 1) is divisible by (p-1)(q-1). The values e and d are called the public and private exponents, respectively. The public key is the pair (n, e); the private key is (n, d). The factors p and q may be destroyed or kept with the private key. It is currently difficult to obtain the private key d from the public key (n, e). However if one could factor n into p and q, then one could obtain the private key d. Thus the security of the RSA system is based on the assumption that factoring is difficult. The discovery of an easy method of factoring would "break" RSA (see

• Question 34:

  Which type of attack involves hijacking a session between a host and a target by predicting the target's choice of an initial TCP sequence number?

  A. IP spoofing attack
  B. SYN flood attack
  C. TCP sequence number attack
  D. Smurf attack
  C. TCP sequence number attack

  ---

  A TCP sequence number attack exploits the communication session which was established between the target and the trusted host that initiated the session. It involves hijacking the session between the host and the target by predicting the target's choice of an initial TCP sequence number. An IP spoofing attack is used to convince a system that it is communication with a known entity that gives an intruder access. It involves modifying the source address of a packet for a trusted source's address. A SYN attack is when an attacker floods a system with connection requests but does not respond when the target system replies to those requests. A smurf attack occurs when an attacker sends a spoofed (IP spoofing) PING (ICMP ECHO) packet to the broadcast address of a large network (the bounce site). The modified packet containing the address of the target system, all devices on its local network respond with a ICMP REPLY to the target system, which is then saturated with those replies.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 77).

• Question 35:

  What is called an attack where the attacker spoofs the source IP address in an ICMP ECHO broadcast packet so it seems to have originated at the victim's system, in order to flood it with REPLY packets?

  A. SYN Flood attack
  B. Smurf attack
  C. Ping of Death attack
  D. Denial of Service (DOS) attack
  B. Smurf attack

  ---

  Although it may cause a denial of service to the victim's system, this type of attack is a Smurf attack. A SYN Flood attack uses up all of a system's resources by setting up a number of bogus communication sockets on the victim's system. A Ping of Death attack is done by sending IP packets that exceed the maximum legal length (65535 octets).

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  11: Application and System Development (page 789).

• Question 36:

  Which of the following statements pertaining to a Criticality Survey is incorrect?

  A. It is implemented to gather input from all personnel that is going to be part of the recovery teams.
  B. The purpose of the survey must be clearly stated.
  C. Management's approval should be obtained before distributing the survey.
  D. Its intent is to find out what services and systems are critical to keeping the organization in business.
  A. It is implemented to gather input from all personnel that is going to be part of the recovery teams.

  ---

  The Criticality Survey is implemented through a standard questionnaire to gather input from the most knowledgeable people. Not all personnel that is going to be part of recovery teams is necessarily able to help in identifying critical functions

  of the organization. The intent of such a survey is to identify the services and systems that are critical to the organization.

  Having a clearly stated purpose for the survey helps in avoiding misinterpretations.

  Management's approval of the survey should be obtained before distributing it.

  Source: HARE, Chris, CISSP Study Guide: Business Continuity Planning Domain,

• Question 37:

  Which of the following enables the person responsible for contingency planning to focus risk management efforts and resources in a prioritized manner only on the identified risks?

  A. Risk assessment
  B. Residual risks
  C. Security controls
  D. Business units
  A. Risk assessment

  ---

  The risk assessment is critical because it enables the person responsible for contingency planning to focus risk management efforts and resources in a prioritized manner only on the identified risks. The risk management process includes the risk assessment and determination of suitable technical, management, and operational security controls based on the level of threat the risk imposes. Business units should be included in this process.

  Source: SWANSON, Marianne, and al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 7).

• Question 38:

  Which of the following computer recovery sites is only partially equipped with processing equipment?

  A. hot site
  B. rolling hot site
  C. warm site
  D. cold site
  C. warm site

  ---

  A warm site has some basic equipment or in some case almost all of the equipment but it is not sufficient to be operational without bringing in the last backup and in some cases more computers and other equipment.

  The following answers are incorrect:

  hot site. Is incorrect because a hot-site is fully configured with all the required hardware. The only thing missing is the last backup and you are up and running.

  Rolling hot site. Is incorrect because a rolling hot-site is fully configured with all the required hardware.

  cold site. Is incorrect because a cold site has basically power, HVAC, basic cabling, but no or little as far as processing equipment is concerned. All other equipment must be brought to this site. It might take a week or two to reconstruct.

  References:

  OIG CBK Business Continuity and Disaster Recovery Planning (pages 368 - 369)

• Question 39:

  Which of the following backup methods is primarily run when time and tape space permits, and is used for the system archive or baselined tape sets?

  A. full backup method.
  B. incremental backup method.
  C. differential backup method.
  D. tape backup method.
  A. full backup method.

  ---

  The Full Backup Method is primarily run when time and tape space permits, and is used for the system archive or baselined tape sets.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 69.

• Question 40:

  Making sure that the data has not been changed unintentionally, due to an accident or malice is:

  A. Integrity.
  B. Confidentiality.
  C. Availability.
  D. Auditability.
  A. Integrity.

  ---

  Integrity refers to the protection of information from unauthorized modification or deletion.

  Confidentiality is incorrect. Confidentiality refers to the protection of information from unauthorized disclosure.

  Availability is incorrect. Availability refers to the assurance that information and services will be available to authorized users in accordance with the service level objective.

  Auditability is incorrect. Auditability refers to the ability to trace an action to the identity that performed it and identify the date and time at which it occurred.

  References:

  CBK, pp. 5 - 6

  AIO3, pp. 56 - 57