ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 441:

  Which of the following choices describe a condition when RAM and Secondary storage are used together?

  A. Primary storage
  B. Secondary storage
  C. Virtual storage
  D. Real storage
  C. Virtual storage

  ---

  Virtual storage a service provided by the operating system where it uses a combination of RAM and disk storage to simulate a much larger address space than is actually present. Infrequently used portions of memory are paged out by being

  written to secondary storage and paged back in when required by a running program.

  Most OS's have the ability to simulate having more main memory than is physically available in the system. This is done by storing part of the data on secondary storage, such as a disk. This can be considered a virtual page. If the data

  requested by the system is not currently in main memory, a page fault is taken. This condition triggers the OS handler. If the virtual address is a valid one, the OS will locate the physical page, put the right information in that page, update the

  translation table, and then try the request again. Some other page might be swapped out to make room. Each process may have its own separate virtual address space along with its own mappings and protections.

  The following are incorrect answers:

  Primary storage is incorrect. Primary storage refers to the combination of RAM, cache and the processor registers. Primary Storage The data waits for processing by the processors, it sits in a staging area called primary storage. Whether

  implemented as memory, cache, or registers (part of the CPU), and regardless of its location, primary storage stores data that has a high probability of being requested by the CPU, so it is usually faster than long-term, secondary storage. The

  location where data is stored is denoted by its physical memory address. This memory register identifier remains constant and is independent of the value stored there. Some examples of primary storage devices include random-access

  memory (RAM), synchronous dynamic random- access memory (SDRAM), and read-only memory (ROM). RAM is volatile, that is, when the system shuts down, it flushes the data in RAM although recent research has shown that data may

  still be retrievable. Contrast this

  Secondary storage is incorrect. Secondary storage holds data not currently being used by the CPU and is used when data must be stored for an extended period of time using high-capacity, nonvolatile storage. Secondary storage includes

  disk, floppies, CD's, tape, etc. While secondary storage includes basically anything different from primary storage, virtual memory's use of secondary storage is usually confined to high-speed disk storage.

  Real storage is incorrect. Real storage is another word for primary storage and distinguishes physical memory from virtual memory.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 17164-17171). Auerbach Publications. Kindle Edition.

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 17196-17201). Auerbach Publications. Kindle Edition.

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 17186-17187). Auerbach Publications. Kindle Edition.

• Question 442:

  What is the length of an MD5 message digest?

  A. 128 bits
  B. 160 bits
  C. 256 bits
  D. varies depending upon the message size.
  A. 128 bits

  ---

  A hash algorithm (alternatively, hash "function") takes binary data, called the message, and produces a condensed representation, called the message digest. A cryptographic hash algorithm is a hash algorithm that is designed to achieve certain security properties. The Federal Information Processing Standard 180- 3, Secure Hash Standard, specifies five cryptographic hash algorithms - SHA-1, SHA-224, SHA-256, SHA- 384, and SHA-512 for federal use in the US; the standard was also widely adopted by the information technology industry and commercial companies. The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value. Specified in RFC 1321, MD5 has been employed in a wide variety of security applications, and is also commonly used to check data integrity. MD5 was designed by Ron Rivest in 1991 to replace an earlier hash function, MD4. An MD5 hash is typically expressed as a 32-digit hexadecimal number.

  However, it has since been shown that MD5 is not collision resistant; as such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property. In 1996, a flaw was found with the design of MD5, and while it was not a clearly fatal weakness, cryptographers began recommending the use of other algorithms, such as SHA-1 - which has since been found also to be vulnerable. In 2004, more serious flaws were discovered in MD5, making further use of the algorithm for security purposes questionable - specifically, a group of researchers described how to create a pair of files that share the same MD5 checksum. Further advances were made in breaking MD5 in 2005, 2006, and 2007. In December 2008, a group of researchers used this technique to fake SSL certificate validity, and US-CERT now says that MD5 "should be considered cryptographically broken and unsuitable for further use." and most U.S. government applications now require the SHA-2 family of hash functions.

  NIST CRYPTOGRAPHIC HASH PROJECT

  NIST announced a public competition in a Federal Register Notice on November 2, 2007 to develop a new cryptographic hash algorithm, called SHA-3, for standardization. The competition was NIST's response to advances made in the cryptanalysis of hash algorithms. NIST received sixty-four entries from cryptographers around the world by October 31, 2008, and selected fifty-one first-round candidates in December 2008, fourteen second-round candidates in July 2009, and round of the competition. Throughout the competition, the cryptographic community has provided an enormous amount of feedback. Most of the comments were sent to NIST and a public hash forum; in addition, many of the cryptanalysis and performance studies

  were published as papers in major cryptographic conferences or leading cryptographic journals. NIST also hosted a SHA-3 candidate conference in each round to obtain public feedback. Based on the public comments and internal review of the candidates, NIST announced Keccak as the winner of the SHA-3 Cryptographic Hash Algorithm Competition on October 2, 2012, and ended the five-year competition. Reference: Tipton, Harold, et. al., Officical (ISC)2 Guide to the CISSP CBK, 2007 edition, page 261. and https://secure.wikimedia.org/wikipedia/en/wiki/Md5 and http://csrc.nist.gov/groups/ST/hash/sha-3/index.html

• Question 443:

  Which of the following computer crime is MORE often associated with INSIDERS?

  A. IP spoofing
  B. Password sniffing
  C. Data diddling
  D. Denial of service (DOS)
  C. Data diddling

  ---

  It refers to the alteration of the existing data , most often seen before it is entered into an application.This type of crime is extremely common and can be prevented by using appropriate access controls and proper segregation of duties. It will

  more likely be perpetrated by insiders, who have access to data before it is processed.

  The other answers are incorrect because :

  IP Spoofing is not correct as the questions asks about the crime associated with the insiders. Spoofing is generally accomplished from the outside. Password sniffing is also not the BEST answer as it requires a lot of technical knowledge in

  understanding the encryption and decryption process. Denial of service (DOS) is also incorrect as most Denial of service attacks occur over the internet. Reference : Shon Harris , AIO v3 , Chapter-10 : Law , Investigation and Ethics , Page :

  758-760.

• Question 444:

  Configuration Management controls what?

  A. Auditing of changes to the Trusted Computing Base.
  B. Control of changes to the Trusted Computing Base.
  C. Changes in the configuration access to the Trusted Computing Base.
  D. Auditing and controlling any changes to the Trusted Computing Base.
  D. Auditing and controlling any changes to the Trusted Computing Base.

  ---

  All of these are components of Configuration Management.

  The following answers are incorrect:

  Auditing of changes to the Trusted Computing Base. Is incorrect because it refers only to auditing the changes, but nothing about controlling them.

  Control of changes to the Trusted Computing Base. Is incorrect because it refers only to controlling the changes, but nothing about ensuring the changes will not lead to a weakness or fault in the system.

  Changes in the configuration access to the Trusted Computing Base. Is incorrect because this does not refer to controlling the changes or ensuring the changes will not lead to a weakness or fault in the system.

• Question 445:

  Which of the following does NOT use token-passing?

  A. ARCnet
  B. FDDI
  C. Token-ring
  D. IEEE 802.3
  D. IEEE 802.3

  ---

  IEEE 802.3 specifies the standard for Ethernet and uses CSMA/CD, not token-passing.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 104).

• Question 446:

  What is called an event or activity that has the potential to cause harm to the information systems or networks?

  A. Vulnerability
  B. Threat agent
  C. Weakness
  D. Threat
  D. Threat

  ---

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Pages 16, 32.

• Question 447:

  How can an individual/person best be identified or authenticated to prevent local masquarading attacks?

  A. UserId and password
  B. Smart card and PIN code
  C. Two-factor authentication
  D. Biometrics
  D. Biometrics

  ---

  The only way to be truly positive in authenticating identity for access is to base the authentication on the physical attributes of the persons themselves (i.e., biometric identification). Physical attributes cannot be shared, borrowed, or

  duplicated. They ensure that you do identify the person, however they are not perfect and they would have to be supplemented by another factor.

  Some people are getting thrown off by the term Masquarade. In general, a masquerade is a disguise. In terms of communications security issues, a masquerade is a type of attack where the attacker pretends to be an authorized user of a

  system in order to gain access to it or to gain greater privileges than they are authorized for. A masquerade may be attempted through the use of stolen logon IDs and passwords, through finding security gaps in programs, or through

  bypassing the authentication mechanism. Spoofing is another term used to describe this type of attack as well.

  A UserId only provides for identification.

  A password is a weak authentication mechanism since passwords can be disclosed, shared, written down, and more.

  A smart card can be stolen and its corresponding PIN code can be guessed by an intruder. A smartcard can be borrowed by a friend of yours and you would have no clue as to who is really logging in using that smart card.

  Any form of two-factor authentication not involving biometrics cannot be as reliable as a biometric system to identify the person.

  Biometric identifying verification systems control people. If the person with the correct hand, eye, face, signature, or voice is not present, the identification and verification cannot take place and the desired action (i.e., portal passage, data, or

  resource access) does not occur.

  As has been demonstrated many times, adversaries and criminals obtain and successfully use access cards, even those that require the addition of a PIN. This is because these systems control only pieces of plastic (and sometimes

  information), rather than people. Real asset and resource protection can only be accomplished by people, not cards and information, because unauthorized persons can (and do) obtain the cards and information.

  Further, life-cycle costs are significantly reduced because no card or PIN administration system or personnel are required. The authorized person does not lose physical characteristics (i.e., hands, face, eyes, signature, or voice), but cards

  and PINs are continuously lost, stolen, or forgotten. This is why card access systems require systems and people to administer, control, record, and issue (new) cards and PINs. Moreover, the cards are an expensive and recurring cost.

  NOTE FROM CLEMENT:

  This question has been generating lots of interest. The keyword in the question is: Individual (the person) and also the authenticated portion as well.

  I totally agree with you that Two Factors or Strong Authentication would be the strongest means of authentication. However the question is not asking what is the strongest mean of authentication, it is asking what is the best way to identify the

  user (individual) behind the technology. When answering questions do not make assumptions to facts not presented in the question or answers.

  Nothing can beat Biometrics in such case. You cannot lend your fingerprint and pin to someone else, you cannot borrow one of my eye balls to defeat the Iris or Retina scan. This is why it is the best method to authenticate the user.

  I think the reference is playing with semantics and that makes it a bit confusing. I have improved the question to make it a lot clearer and I have also improve the s attached with the question.

  The reference mentioned above refers to authenticating the identity for access. So the distinction is being made that there is identity and there is authentication. In the case of physical security the enrollment process is where the identity of the

  user would be validated and then the biometrics features provided by the user would authenticate the user on a one to one matching basis (for authentication) with the reference contained in the database of biometrics templates. In the case

  of system access, the user might have to provide a username, a pin, a passphrase, a smart card, and then provide his biometric attributes.

  Biometric can also be used for Identification purpose where you do a one to many match. You take a facial scan of someone within an airport and you attempt to match it with a large database of known criminal and terrorists. This is how you

  could use biometric for Identification.

  There are always THREE means of authentication, they are:

  Something you know (Type 1)

  Something you have (Type 2)

  Something you are (Type 3)

  Reference(s) used for this question:

  TIPTON, Harold F. and KRAUSE, Micki, Information Security Management Handbook, 4th edition (volume 1) , 2000, CRC Press, Chapter 1, Biometric Identification (page 7).

  and

  Search Security at http://searchsecurity.techtarget.com/definition/masquerade

• Question 448:

  Which disaster recovery plan test involves functional representatives meeting to review the plan in detail?

  A. Simulation test
  B. Checklist test
  C. Parallel test
  D. Structured walk-through test
  D. Structured walk-through test

  ---

  The structured walk-through test occurs when the functional representatives meet to review the plan in detail. This involves a thorough look at each of the plan steps, and the procedures that are invoked at that point in the plan. This ensures that the actual planned activities are accurately described in the plan. The checklist test is a method of testing the plan by distributing copies to each of the functional areas. The simulation test plays out different scenarios. The parallel test is essentially an operational test that is performed without interrupting current processing.

  Source: HARE, Chris, CISSP Study Guide: Business Continuity Planning Domain,

• Question 449:

  Which of the following concerning the Rijndael block cipher algorithm is false?

  A. The design of Rijndael was strongly influenced by the design of the block cipher Square.
  B. A total of 25 combinations of key length and block length are possible
  C. Both block size and key length can be extended to multiples of 64 bits.
  D. The cipher has a variable block length and key length.
  C. Both block size and key length can be extended to multiples of 64 bits.

  ---

  The answer above is the correct answer because it is FALSE. Rijndael does not support multiples of 64 bits but multiples of 32 bits in the range of 128 bits to 256 bits. Key length could be 128, 160, 192, 224, and 256.

  Both block length and key length can be extended very easily to multiples of 32 bits. For a total combination of 25 different block and key size that are possible.

  The Rijndael Cipher

  Rijndael is a block cipher, designed by Joan Daemen and Vincent Rijmen as a candidate algorithm for the Advanced Encryption Standard (AES) in the United States of America. The cipher has a variable block length and key length.

  Rijndael can be implemented very efficiently on a wide range of processors and in hardware.

  The design of Rijndael was strongly influenced by the design of the block cipher Square.

  The Advanced Encryption Standard (AES)

  The Advanced Encryption Standard (AES) keys are defined to be either 128, 192, or 256 bits in accordance with the requirements of the AES.

  The number of rounds, or iterations of the main algorithm, can vary from 10 to 14 within the Advanced Encryption Standard (AES) and is dependent on the block size and key length. 128 bits keys uses 10 rounds or encryptions, 192 bits keys

  uses 12 rounds of encryption, and 256 bits keys uses 14 rounds of encryption.

  The low number of rounds has been one of the main criticisms of Rijndael, but if this ever becomes a problem the number of rounds can easily be increased at little extra cost performance wise by increasing the block size and key length.

  Range of key and block lengths in Rijndael and AES

  Rijndael and AES differ only in the range of supported values for the block length and cipher key length. For Rijndael, the block length and the key length can be independently specified to any multiple of 32 bits, with a minimum of 128 bits,

  and a maximum of 256 bits. The support for block and key lengths 160 and 224 bits was introduced in Joan Daemen and Vincent Rijmen, AES submission document on Rijndael, Version 2, September 1999 available at http://csrc.nist.gov/

  archive/aes/rijndael/Rijndael-ammended.pdf

  AES fixes the block length to 128 bits, and supports key lengths of 128, 192 or 256 bits only.

  Reference used for this question:

  The Rijndael Page

  and

  http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf

  and

  FIPS PUB 197, Advanced Encryption Standard (AES), National Institute of Standards and Technology, U.S. Department of Commerce, November 2001.

• Question 450:

  How do you distinguish between a bridge and a router?

  A. A bridge simply connects multiple networks, a router examines each packet to determine which network to forward it to.
  B. "Bridge" and "router" are synonyms for equipment used to join two networks.
  C. The bridge is a specific type of router used to connect a LAN to the global Internet.
  D. The bridge connects multiple networks at the data link layer, while router connects multiple networks at the network layer.
  D. The bridge connects multiple networks at the data link layer, while router connects multiple networks at the network layer.

  ---

  A bridge operates at the Data Link Layer and a router operates at the Network Layer.

  The following answers are incorrect:

  A bridge simply connects multiple networks, a router examines each packet to determine which network to forward it to. Is incorrect because both forward packets this is not distinctive enough.

  "Bridge" and "router" are synonyms for equipment used to join two networks. Is incorrect because the two are unique and operate at different layers of the OSI model.

  The bridge is a specific type of router used to connect a LAN to the global Internet. Is incorrect because a bridge does not connect a LAN to the global internet, but connects networks together creating a LAN.