ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 391:

  Which of the following media is MOST resistant to tapping?

  A. microwave.
  B. twisted pair.
  C. coaxial cable.
  D. fiber optic.
  D. fiber optic.

  ---

  Fiber Optic is the most resistant to tapping because Fiber Optic uses a light to transmit the signal. While there are some technologies that will allow to monitor the line passively, it is very difficult to tap into without detection sot this technology

  would be the MOST resistent to tapping.

  The following answers are in correct:

  microwave. Is incorrect because microwave transmissions can be intercepted if in the path of the broadcast without detection.

  twisted pair. Is incorrect because it is easy to tap into a twisted pair line.

  coaxial cable. Is incorrect because it is easy to tap into a coaxial cable line.

• Question 392:

  Which of the following statements pertaining to disaster recovery is incorrect?

  A. A recovery team's primary task is to get the pre-defined critical business functions at the alternate backup processing site.
  B. A salvage team's task is to ensure that the primary site returns to normal processing conditions.
  C. The disaster recovery plan should include how the company will return from the alternate site to the primary site.
  D. When returning to the primary site, the most critical applications should be brought back first.
  D. When returning to the primary site, the most critical applications should be brought back first.

  ---

  It's interesting to note that the steps to resume normal processing operations will be different than the steps in the recovery plan; that is, the least critical work should be brought back first to the primary site.

  My at the point where the primary site is ready to receive operations again, less critical systems should be brought back first because one has to make sure that everything will be running smoothly at the primary site before returning critical systems, which are already operating normally at the recovery site. This will limit the possible interruption of processing to a minimum for most critical systems, thus making it the best option.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 8: Business Continuity Planning and Disaster Recovery Planning (page 291).

• Question 393:

  What is a TFTP server most useful for?

  A. Transferring configurations to and from network devices.
  B. Transferring files to web servers.
  C. Terminal access to network devices.
  D. Terminal access to file servers.
  A. Transferring configurations to and from network devices.

  ---

  A Trivial File Transfer Protocol (TFTP) server can be used when configuring network devices to transfer configurations to and from network devices. Many networking devices now support TFTP.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 73).

• Question 394:

  Like the Kerberos protocol, SESAME is also subject to which of the following?

  A. timeslot replay
  B. password guessing
  C. symmetric key guessing
  D. asymmetric key guessing
  B. password guessing

  ---

  Sesame is an authentication and access control protocol, that also supports communication confidentiality and integrity. It provides public key based authentication along with the Kerberos style authentication, that uses symmetric key cryptography. Sesame supports the Kerberos protocol and adds some security extensions like public key based authentication and an ECMA- style Privilege Attribute Service.

  The users under SESAME can authenticate using either symmetric encryption as in Kerberos or Public Key authentication. When using Symmetric Key authentication as in Kerberos, SESAME is also vulnerable to password guessing just like Kerberos would be. The Symmetric key being used is based on the password used by the user when he logged on the system. If the user has a simple password it could be guessed or compromise. Even thou Kerberos or SESAME may be use, there is still a need to have strong password discipline.

  The Basic Mechanism in Sesame for strong authentication is as follow:

  The user sends a request for authentication to the Authentication Server as in Kerberos, except that SESAME is making use of public key cryptography for authentication where the client will present his digital certificate and the request will be signed using a digital signature. The signature is communicated to the authentication server through the preauthentication fields. Upon receipt of this request, the authentication server will verifies the certificate, then validate the signature, and if all is fine the AS will issue a ticket granting ticket (TGT) as in Kerberos. This TGT will be use to communicate with the privilage attribute server (PAS) when access to a resource is needed.

  Users may authenticate using either a public key pair or a conventional (symmetric) key. If public key cryptography is used, public key data is transported in preauthentication data fields to help establish identity.

  Kerberos uses tickets for authenticating subjects to objects and SESAME uses Privileged Attribute Certificates (PAC), which contain the subject's identity, access capabilities for the object, access time period, and lifetime of the PAC. The PAC is digitally signed so that the object can validate that it came from the trusted authentication server, which is referred to as the privilege attribute server (PAS). The PAS holds a similar role as the KDC within Kerberos. After a user successfully authenticates to the authentication service (AS), he is presented with a token to give to the PAS. The PAS then creates a PAC for the user to present to the resource he is trying to access.

  Reference(s) used for this question: http://srg.cs.uiuc.edu/Security/nephilim/Internal/SESAME.txt

  and

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 43.

• Question 395:

  Which of the following would best define a digital envelope?

  A. A message that is encrypted and signed with a digital certificate.
  B. A message that is signed with a secret key and encrypted with the sender's private key.
  C. A message encrypted with a secret key attached with the message. The secret key is encrypted with the public key of the receiver.
  D. A message that is encrypted with the recipient's public key and signed with the sender's private key.
  C. A message encrypted with a secret key attached with the message. The secret key is encrypted with the public key of the receiver.

  ---

  A digital envelope for a recipient is a combination of encrypted data and its encryption key in an encrypted form that has been prepared for use of the recipient.

  It consists of a hybrid encryption scheme in sealing a message, by encrypting the data and sending both it and a protected form of the key to the intended recipient, so that one else can open the message.

  In PKCS #7, it means first encrypting the data using a symmetric encryption algorithm and a secret key, and then encrypting the secret key using an asymmetric encryption algorithm and the public key of the intended recipient.

  Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

• Question 396:

  Almost all types of detection permit a system's sensitivity to be increased or decreased during an inspection process. If the system's sensitivity is increased, such as in a biometric authentication system, the system becomes increasingly selective and has the possibility of generating:

  A. Lower False Rejection Rate (FRR)
  B. Higher False Rejection Rate (FRR)
  C. Higher False Acceptance Rate (FAR)
  D. It will not affect either FAR or FRR
  B. Higher False Rejection Rate (FRR)

  ---

  Almost all types of detection permit a system's sensitivity to be increased or decreased during an inspection process. If the system's sensitivity is increased, such as in a biometric authentication system, the system becomes increasingly

  selective and has a higher False Rejection Rate (FRR).

  Conversely, if the sensitivity is decreased, the False Acceptance Rate (FRR) will increase. Thus, to have a valid measure of the system performance, the Cross Over Error (CER) rate is used. The Crossover Error Rate (CER) is the point at

  which the false rejection rates and the false acceptance rates are equal. The lower the value of the CER, the more accurate the system. There are three categories of biometric accuracy measurement (all represented as percentages):

  False Reject Rate (a Type I Error): When authorized users are falsely rejected as unidentified or unverified.

  False Accept Rate (a Type II Error): When unauthorized persons or imposters are falsely accepted as authentic.

  Crossover Error Rate (CER): The point at which the false rejection rates and the false acceptance rates are equal. The smaller the value of the CER, the more accurate the system.

  NOTE:

  Within the ISC2 book they make use of the term Accept or Acceptance and also Reject or Rejection when referring to the type of errors within biometrics. Below we make use of Acceptance and Rejection throughout the text for conistency.

  However, on the real exam you could see either of the terms.

  Performance of biometrics

  Different metrics can be used to rate the performance of a biometric factor, solution or application. The most common performance metrics are the False Acceptance Rate FAR and the False Rejection Rate FRR.

  When using a biometric application for the first time the user needs to enroll to the system. The system requests fingerprints, a voice recording or another biometric factor from the operator, this input is registered in the database as a template

  which is linked internally to a user ID. The next time when the user wants to authenticate or identify himself, the biometric input provided by the user is compared to the template(s) in the database by a matching algorithm which responds with

  acceptance (match) or rejection (no match).

  FAR and FRR

  The FAR or False Acceptance rate is the probability that the system incorrectly authorizes a non- authorized person, due to incorrectly matching the biometric input with a valid template. The FAR is normally expressed as a percentage,

  following the FAR definition this is the percentage of invalid inputs which are incorrectly accepted.

  The FRR or False Rejection Rate is the probability that the system incorrectly rejects access to an authorized person, due to failing to match the biometric input provided by the user with a stored template. The FRR is normally expressed as a

  percentage, following the FRR definition this is the percentage of valid inputs which are incorrectly rejected.

  FAR and FRR are very much dependent on the biometric factor that is used and on the technical implementation of the biometric solution. Furthermore the FRR is strongly person dependent, a personal FRR can be determined for each

  individual.

  Take this into account when determining the FRR of a biometric solution, one person is insufficient to establish an overall FRR for a solution. Also FRR might increase due to environmental conditions or incorrect use, for example when using

  dirty fingers on a fingerprint reader. Mostly the FRR lowers when a user gains more experience in how to use the biometric device or software.

  FAR and FRR are key metrics for biometric solutions, some biometric devices or software even allow to tune them so that the system more quickly matches or rejects. Both FRR and FAR are important, but for most applications one of them is

  considered most important. Two examples to illustrate this:

  When biometrics are used for logical or physical access control, the objective of the application is to disallow access to unauthorized individuals under all circumstances. It is clear that a very low FAR is needed for such an application, even if

  it comes at the price of a higher FRR.

  When surveillance cameras are used to screen a crowd of people for missing children, the objective of the application is to identify any missing children that come up on the screen. When the identification of those children is automated using

  a face recognition software, this software has to be set up with a low FRR. As such a higher number of matches will be false positives, but these can be reviewed quickly by surveillance personnel.

  False Acceptance Rate is also called False Match Rate, and False Rejection Rate is sometimes referred to as False Non-Match Rate.

  crossover error rate

  

  Above see a graphical representation of FAR and FRR errors on a graph, indicating the CER

  CER

  The Crossover Error Rate or CER is illustrated on the graph above. It is the rate where both FAR and FRR are equal.

  The matching algorithm in a biometric software or device uses a (configurable) threshold which determines how close to a template the input must be for it to be considered a match. This threshold value is in some cases referred to as

  sensitivity, it is marked on the X axis of the plot. When you reduce this threshold there will be more false acceptance errors (higher FAR) and less false rejection errors (lower FRR), a higher threshold will lead to lower FAR and higher FRR.

  Speed

  Most manufacturers of biometric devices and softwares can give clear numbers on the time it takes to enroll as well on the time for an individual to be authenticated or identified using their application. If speed is important then take your time

  to consider this, 5 seconds might seem a short time on paper or when testing a device but if hundreds of people will use the device multiple times a day the cumulative loss of time might be significant.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 2723-2731). Auerbach Publications. Kindle Edition.

  and

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 37.

  and

  http://www.biometric-solutions.com/index.php?story=performance_biometrics

• Question 397:

  What is called an exception to the search warrant requirement that allows an officer to conduct a search without having the warrant in-hand if probable cause is present and destruction of the evidence is deemed imminent?

  A. Evidence Circumstance Doctrine
  B. Exigent Circumstance Doctrine
  C. Evidence of Admissibility Doctrine
  D. Exigent Probable Doctrine
  B. Exigent Circumstance Doctrine

  ---

  An Exigent Circumstance is an unusual and time-sensitive circumstance that justifies conduct that might not be permissible or lawful in other circumstances.

  For example, exigent circumstances may justify actions by law enforcement officers acting without a warrant such as a mortal danger to a young child. Examples of other exigent circumstances include protecting evidence or property from

  imminent destruction.

  In US v Martinez, Justice Thomas of the United States Court of Appeal used these words:

  "As a general rule, we define exigent circumstances as those circumstances that would cause a reasonable person to believe that entry was necessary to prevent physical harm to the officers or other persons, the destruction of relevant

  evidence, the escape of the suspect, or some other consequence improperly frustrating legitimate law enforcement efforts."

  In Alvarado, Justice Blackburn of the Court of Appeals of Georgia referred to exigent circumstances in the context of a drug bust:

  "The exigent circumstance doctrine provides that when probable cause has been established to believe that evidence will be removed or destroyed before a warrant can be obtained, a warrantless search and seizure can be justified. As many

  courts have noted, the need for the exigent circumstance doctrine is particularly compelling in narcotics cases, because contraband and records can be easily and quickly destroyed while a search is progressing. Police officers relying on this

  exception must demonstrate an objectively reasonable basis for deciding that immediate action is required."

  All of the other answers were only detractors made up and not legal terms.

  Reference(s) used for this question:

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 313.

  and

  http://www.duhaime.org/LegalDictionary/E/ExigentCircumstances.aspx

• Question 398:

  Which of the following statements pertaining to key management is incorrect?

  A. The more a key is used, the shorter its lifetime should be.
  B. When not using the full keyspace, the key should be extremely random.
  C. Keys should be backed up or escrowed in case of emergencies.
  D. A key's lifetime should correspond with the sensitivity of the data it is protecting.
  B. When not using the full keyspace, the key should be extremely random.

  ---

  A key should always be using the full spectrum of the keyspace and be extremely random. Other statements are correct. Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 6).

• Question 399:

  Which of the following remote access authentication systems is the most robust?

  A. TACACS+
  B. RADIUS
  C. PAP
  D. TACACS
  A. TACACS+

  ---

  TACACS+ is a proprietary Cisco enhancement to TACACS and is more robust than RADIUS. PAP is not a remote access authentication system but a remote node security protocol.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 122).

• Question 400:

  Which of the following test makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems?

  A. Recovery testing
  B. Security testing
  C. Stress/volume testing
  D. Interface testing
  B. Security testing

  ---

  Security testing makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems.

  Recovery testing checks the system's ability to recover after a software or hardware failure. Stress/volume testing involves testing an application with large quantities of data in order to evaluate performance during peak hours.

  Interface testing evaluates the connection of two or more components that pass information from one area to another.

  Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 300).