ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 411:

  Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of a software product?

  A. Estimating the cost of the changes requested
  B. Recreating and analyzing the problem
  C. Determining the interface that is presented to the user
  D. Establishing the priorities of requests
  D. Establishing the priorities of requests

  ---

  Change control sub-phase includes Recreating and analyzing the problem, Determining the interface that is presented to the user, and Establishing the priorities of requests.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 7: Applications and Systems Development (page 252).

• Question 412:

  Valuable paper insurance coverage does not cover damage to which of the following?

  A. Inscribed, printed and Written documents
  B. Manuscripts
  C. Records
  D. Money and Securities
  D. Money and Securities

  ---

  All businesses are driven by records. Even in today's electronic society businesses generate mountains of critical documents everyday. Invoices, client lists, calendars, contracts, files, medical records, and innumerable other records are generated every day.

  Stop and ask yourself what happens if your business lost those documents today.

  Valuable papers business insurance coverage provides coverage to your business in case of a loss of vital records. Over the years policy language has evolved to include a number of different types of records. Generally, the policy will cover "written, printed, or otherwise inscribed documents and records, including books, maps, films, drawings, abstracts, deeds, mortgages, and manuscripts." But, read the policy coverage carefully. The policy language typically "does not mean "money" or "securities," converted data,programs or instructions used in your data processing operations, including the materials on which the data is recorded." The coverage is often included as a part of property insurance or as part of a small business owner policy. For example, a small business owner policy includes in many cases valuable papers coverage up to $25,000.

  It is important to realize what the coverage actually entails and, even more critical, to analyze your business to determine what it would cost to replace records.

  The coverage pays for the loss of vital papers and the cost to replace the records up to the limit of the insurance and after application of any deductible. For example, the insurer will pay to have waterlogged papers dried and reproduced (remember, fires are put out by water and the fire department does not stop to remove your book keeping records). The insurer may cover temporary storage or the cost of moving records to avoid a loss.

  For some businesses, losing customer lists, some business records, and contracts, can mean the expense and trouble of having to recreate those documents, but is relatively easy and a low level risk and loss. Larger businesses and especially professionals (lawyers, accountants, doctors) are in an entirely separate category and the cost of replacement of documents is much higher. Consider, in analyzing your business and potential risk, what it would actually cost to reproduce your critical business records. Would you need to hire temporary personnel? How many hours of productivity would go into replacing the records? Would you need to obtain originals? Would original work need to be recreated (for example, home inspectors, surveyors, cartographers)?

  Often when a business owner considers the actual cost related to the reproduction of records, the owner quickly realizes that their business insurance policy limits for valuable papers coverage is woefully inadequate.

  Insurers (and your insurance professional)will often suggest higher coverages for valuable papers. The extra premium is often worth the cost and should be considered.

  Finally, most policies will require records to be protected. You need to review your declarations pages and speak with your insurer to determine what is required. Some insurers may offer discounted coverage if there is a document retention and back up plan in place and followed. There are professional organizations that can assist your business in designing a records management policy to lower the risk (and your premiums). For example, ARMA International has been around since 1955 and its members consist of some of the top document retention and storage companies.

  Reference(s) used for this question:

  http://businessinsure.about.com/od/propertyinsurance/f/vpcov.htm

• Question 413:

  Which of the following is the biggest concern with firewall security?

  A. Internal hackers
  B. Complex configuration rules leading to misconfiguration
  C. Buffer overflows
  D. Distributed denial of service (DDOS) attacks
  B. Complex configuration rules leading to misconfiguration

  ---

  Firewalls tend to give a false sense of security. They can be very hard to bypass but they need to be properly configured. The complexity of configuration rules can introduce a vulnerability when the person responsible for its configuration does not fully understand all possible options and switches. Denial of service attacks mainly concerns availability.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter

  3: Telecommunications and Network Security (page 412).

• Question 414:

  Which of the following statements is NOT true of IPSec Transport mode?

  A. It is required for gateways providing access to internal systems
  B. Set-up when end-point is host or communications terminates at end-points
  C. If used in gateway-to-host communication, gateway must act as host
  D. When ESP is used for the security protocol, the hash is only applied to the upper layer protocols contained in the packet
  A. It is required for gateways providing access to internal systems

  ---

  Source: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 2, 2001, CRC Press, NY, Pages 166-167.

• Question 415:

  Virus scanning and content inspection of SMIME encrypted e-mail without doing any further processing is:

  A. Not possible
  B. Only possible with key recovery scheme of all user keys
  C. It is possible only if X509 Version 3 certificates are used
  D. It is possible only by "brute force" decryption
  A. Not possible

  ---

  Content security measures presumes that the content is available in cleartext on the central mail server. Encrypted emails have to be decrypted before it can be filtered (e.g. to detect viruses), so you need the decryption key on the central "crypto mail server".

  There are several ways for such key management, e.g. by message or key recovery methods. However, that would certainly require further processing in order to achieve such goal.

• Question 416:

  Which of the following should be emphasized during the Business Impact Analysis (BIA) considering that the BIA focus is on business processes?

  A. Composition
  B. Priorities
  C. Dependencies
  D. Service levels
  C. Dependencies

  ---

  The Business Impact Analysis (BIA) identifies time-critical aspects of the critical business processes, and determines their maximum tolerable downtime. The BIA helps to Identify organization functions, the capabilities of each organization unit to handle outages, and the priority and sequence of functions and applications to be recovered, identify resources required for recovery of those areas and interdependencies

  In performing the Business Impact Analysis (BIA) it is very important to consider what the dependencies are. You cannot bring a system up if it depends on another system to be operational. You need to look at not only internal dependencies but external as well. You might not be able to get the raw materials for your business so dependencies are very important aspect of a BIA.

  The BIA committee will not truly understand all business processes, the steps that must take place, or the resources and supplies these processes require. So the committee must gather this information from the people who do know-department managers and specific employees throughout the organization. The committee starts by identifying the people who will be part of the BIA data-gathering sessions. The committee needs to identify how it will collect the data from the selected employees, be it through surveys, interviews, or workshops. Next, the team needs to collect the information by actually conducting surveys, interviews, and workshops. Data points obtained as part of the information gathering will be used later during analysis. It is important that the team members ask about how different tasks-- whether processes, transactions, or services, along with any relevant dependencies-- get accomplished within the organization.

  The following answers are incorrect:

  composition This is incorrect because it is not the best answer. While the make up of business may be important, if you have not determined the dependencies first you may not be able to bring the critical business processes to a ready state or have the materials on hand that are needed. priorities This is incorrect because it is not the best answer. While the priorities of processes are important, if you have not determined the dependencies first you may not be able to bring the critical business processes to a ready state or have the materials on hand that are needed.

  service levels This is incorrect because it is not the best answer. Service levels are not as important as dependencies.

  Reference(s) used for this question:

  Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Business Continuity and Disaster Recovery Planning (Kindle Locations 188-191). . Kindle Edition.

  and

  Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 18562-18568). McGraw-Hill. Kindle Edition.

• Question 417:

  SMTP can best be described as:

  A. a host-to-host email protocol.
  B. an email retrieval protocol.
  C. a web-based e-mail reading protocol.
  D. a standard defining the format of e-mail messages.
  A. a host-to-host email protocol.

  ---

  Simple Mail Transfer Protocol (SMTP) is a host-to-host email protocol. An SMTP server accepts email messages from other systems and stores them for the addressees. Stored email can be read in various ways. Users with interactive accounts on the email server machine can read the email using local email applications. Users on other systems can download their email via email clients using POP or IMAP email retrieval protocols. Sometimes mail can also be read through a webbased interface (using HTTP or HTTPS). MIME is a standard defining the format of e-mail messages, as stated in RFC2045. Source: GUTTMAN, Barbara and BAGWILL, Robert, NIST Special Publication 800-xx, Internet Security Policy: A Technical Guide, Draft Version, May 25, 2000 (pages 91-92).

• Question 418:

  Which of the following would BEST be defined as an absence or weakness of safeguard that could be exploited?

  A. A threat
  B. A vulnerability
  C. A risk
  D. An exposure
  B. A vulnerability

  ---

  It is a software , hardware or procedural weakness that may provide an attacker the open door he is looking for to enter a computer or network and have unauthorized access to resources within the environment. A vulnerability characterizes the absence or weakness of a safeguard that could be exploited. This vulnerability may be a service running on a server, unpatched applications or operating system software etc.

  The following answers are incorrect because:

  Threat: A threat is defined as a potential danger to information or systems. The threat is someone or something will identify a specific vulnerability and use it against the company or individual. The entity that takes advantage of a vulnerability

  is referred to as a 'Threat Agent'. A threat agent could be an intruder accessing the network through a port on the firewall , a process accessing data that violates the security policy.

  Risk:A risk is the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact. If a firewall has several ports open , there is a higher likelihood that an intruder will use one to access the network in an

  unauthorized method.

  Exposure: An exposure is an instance of being exposed to losses from a threat agent.

  REFERENCES:

  SHON HARRIS , ALL IN ONE THIRD EDITION : Chapter 3 : Security Management Practices , Pages: 57

• Question 419:

  Cryptography does NOT help in:

  A. Detecting fraudulent insertion.
  B. Detecting fraudulent deletion.
  C. Detecting fraudulent modification.
  D. Detecting fraudulent disclosure.
  D. Detecting fraudulent disclosure.

  ---

  Cryptography is a detective control in the fact that it allows the detection of fraudulent insertion, deletion or modification. It also is a preventive control is the fact that it prevents disclosure, but it usually does not offers any means of detecting disclosure.

  Source: DUPUIS, Clement, CISSP Open Study Guide on domain 5, cryptography, April 1999.

• Question 420:

  How would nonrepudiation be best classified as?

  A. A preventive control
  B. A logical control
  C. A corrective control
  D. A compensating control
  A. A preventive control

  ---

  Systems accountability depends on the ability to ensure that senders cannot deny sending information and that receivers cannot deny receiving it. Because the mechanisms implemented in nonrepudiation prevent the ability to successfully repudiate an action, it can be considered as a preventive control. Source: STONEBURNER, Gary, NIST Special Publication 800-33: Underlying Technical Models for Information Technology Security, National Institute of Standards and Technology, December 2001, page 7.