ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 451:

  Which property ensures that only the intended recipient can access the data and nobody else?

  A. Confidentiality
  B. Capability
  C. Integrity
  D. Availability
  A. Confidentiality

  ---

  Confidentiality is defined as the property that ensures that only the intended recipient can access the data and nobody else. It is usually achieve using cryptogrphic methods, tools, and protocols.

  Confidentiality supports the principle of "least privilege" by providing that only authorized individuals, processes, or systems should have access to information on a need-to-know basis. The level of access that an authorized individual should

  have is at the level necessary for them to do their job. In recent years, much press has been dedicated to the privacy of information and the need to protect it from individuals, who may be able to commit crimes by viewing the information.

  Identity theft is the act of assuming one's identity through knowledge of confidential information obtained from various sources.

  The following are incorrect answers:

  Capability is incorrect. Capability is relevant to access control. Capability-based security is a concept in the design of secure computing systems, one of the existing security models. A capability (known in some systems as a key) is a

  communicable, unforgeable token of authority. It refers to a value that references an object along with an associated set of access rights. A user program on a capability-based operating system must use a capability to access an object. Capability-based security refers to the principle of designing user programs such that they directly share capabilities with each other according to the principle of least privilege, and to the operating system infrastructure necessary to make such transactions efficient and secure.

  Integrity is incorrect. Integrity protects information from unauthorized modification or loss.

  Availability is incorrect. Availability assures that information and services are available for use by authorized entities according to the service level objective.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 9345-9349). Auerbach Publications. Kindle Edition.

  http://en.wikipedia.org/wiki/Capability-based_security

• Question 452:

  Which of the following offers security to wireless communications?

  A. S-WAP
  B. WTLS
  C. WSP
  D. WDP
  B. WTLS

  ---

  Wireless Transport Layer Security (WTLS) is a communication protocol that allows wireless devices to send and receive encrypted information over the Internet. S-WAP is not defined. WSP (Wireless Session Protocol) and WDP (Wireless Datagram Protocol) are part of Wireless Access Protocol (WAP).

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 4: Cryptography (page 173).

• Question 453:

  A network-based vulnerability assessment is a type of test also referred to as:

  A. An active vulnerability assessment.
  B. A routing vulnerability assessment.
  C. A host-based vulnerability assessment.
  D. A passive vulnerability assessment.
  A. An active vulnerability assessment.

  ---

  A network-based vulnerability assessment tool/system either re-enacts system attacks, noting and recording responses to the attacks, or probes different targets to infer weaknesses from their responses.

  Since the assessment is actively attacking or scanning targeted systems, network-based vulnerability assessment systems are also called active vulnerability systems.

  There are mostly two main types of test:

  PASSIVE: You don't send any packet or interact with the remote target. You make use of public database and other techniques to gather information about your target.

  ACTIVE: You do send packets to your target, you attempt to stimulate response which will help you in gathering information about hosts that are alive, services runnings, port state, and more.

  See example below of both types of attacks:

  Eavesdropping and sniffing data as it passes over a network are considered passive attacks because the attacker is not affecting the protocol, algorithm, key, message, or any parts of the encryption system. Passive attacks are hard to

  detect, so in most cases methods are put in place to try to prevent them rather than to detect and stop them.

  Altering messages , modifying system files, and masquerading as another individual are acts that are considered active attacks because the attacker is actually doing something instead of sitting back and gathering data. Passive attacks are

  usually used to gain information prior to carrying out an active attack.

  IMPORTANT NOTE:

  On the commercial vendors will sometimes use different names for different types of scans. However, the exam is product agnostic. They do not use vendor terms but general terms. Experience could trick you into selecting the wrong choice

  sometimes. See feedback from Jason below:

  "I am a system security analyst. It is my daily duty to perform system vulnerability analysis. We use Nessus and Retina (among other tools) to perform our network based vulnerability scanning. Both commercially available tools refer to a

  network based vulnerability scan as a "credentialed" scan. Without credentials, the scan tool cannot login to the system being scanned, and as such will only receive a port scan to see what ports are open and exploitable"

  Reference(s) used for this question:

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 865). McGraw-Hill.

  Kindle Edition.

  and

  DUPUIS, Clement, Access Control Systems and Methodology CISSP Open Study Guide, version 1.0, march 2002 (page 97).

• Question 454:

  An area of the Telecommunications and Network Security domain that directly affects the Information Systems Security tenet of Availability can be defined as:

  A. Netware availability
  B. Network availability
  C. Network acceptability
  D. Network accountability
  B. Network availability

  ---

  Network availability can be defined as an area of the Telecommunications and Network Security domain that directly affects the Information Systems Security tenet of Availability. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 64.

• Question 455:

  Which of the following rules pertaining to a Business Continuity Plan/Disaster Recovery Plan is incorrect?

  A. In order to facilitate recovery, a single plan should cover all locations.
  B. There should be requirements to form a committee to decide a course of action. These decisions should be made ahead of time and incorporated into the plan.
  C. In its procedures and tasks, the plan should refer to functions, not specific individuals.
  D. Critical vendors should be contacted ahead of time to validate equipment can be obtained in a timely manner.
  A. In order to facilitate recovery, a single plan should cover all locations.

  ---

  The first documentation rule when it comes to a BCP/DRP is "one plan, one building". Much of the plan revolves around reconstructing a facility and replenishing it with production contents. If more than one facility is involved, then the reader of the plan will find it difficult to identify quantities and specifications of replacement resource items. It is possible to have multiple plans for a single building, but those plans must be linked so that the identification and ordering of resource items is centralized. All other statements are correct.

  Source: BARNES, James C. and ROTHSTEIN, Philip J., A Guide to Business Continuity Planning, John Wiley and Sons, 2001 (page 162).

• Question 456:

  A one-way hash provides which of the following?

  A. Confidentiality
  B. Availability
  C. Integrity
  D. Authentication
  C. Integrity

  ---

  A one-way hash is a function that takes a variable-length string a message, and compresses and transforms it into a fixed length value referred to as a hash value. It provides integrity, but no confidentiality, availability or authentication. Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 5).

• Question 457:

  Application Layer Firewalls operate at the:

  A. OSI protocol Layer seven, the Application Layer.
  B. OSI protocol Layer six, the Presentation Layer.
  C. OSI protocol Layer five, the Session Layer.
  D. OSI protocol Layer four, the Transport Layer.
  A. OSI protocol Layer seven, the Application Layer.

  ---

  Since the application layer firewall makes decisions based on application-layer information in the packet, it operates at the application layer of the OSI stack.

  "OSI protocol layer 6, the presentation layer" is incorrect. The application layer firewall must have access to the application layer information in the packet and therefore operates at the application layer. "OSI protocol layer 5, the session layer"

  is incorrect. The application layer firewall must have access to the application layer information in the packet and therefore operates at the application layer.

  "OSI protocol layer 4, the transport layer" is incorrect. The application layer firewall must have access to the application layer information in the packet and therefore operates at the application layer.

  References:

  CBK, p. 467

  AIO3, pp.488 - 490

• Question 458:

  What is an IP routing table?

  A. A list of IP addresses and corresponding MAC addresses.
  B. A list of station and network addresses with corresponding gateway IP address.
  C. A list of host names and corresponding IP addresses.
  D. A list of current network interfaces on which IP routing is enabled.
  B. A list of station and network addresses with corresponding gateway IP address.

  ---

  A routing table is used when a destination IP address is not located on the current LAN segment. It consists of a list of station and network addresses and a corresponding gateway IP address further along to which a routing equipment should

  send packets that match that station or network address. A list of IP addresses and corresponding MAC addresses is an ARP table. A DNS is used to match host names and corresponding IP addresses. The last choice is a distracter.

  Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 3:

  TCP/IP from a Security Viewpoint.

• Question 459:

  The type of discretionary access control (DAC) that is based on an individual's identity is also called:

  A. Identity-based Access control
  B. Rule-based Access control
  C. Non-Discretionary Access Control
  D. Lattice-based Access control
  A. Identity-based Access control

  ---

  An identity-based access control is a type of Discretionary Access Control (DAC) that is based on an individual's identity.

  DAC is good for low level security environment. The owner of the file decides who has access to the file.

  If a user creates a file, he is the owner of that file. An identifier for this user is placed in the file header and/ or in an access control matrix within the operating system.

  Ownership might also be granted to a specific individual. For example, a manager for a certain department might be made the owner of the files and resources within her department. A system that uses discretionary access control (DAC)

  enables the owner of the resource to specify which subjects can access specific resources.

  This model is called discretionary because the control of access is based on the discretion of the owner. Many times department managers, or business unit managers , are the owners of the data within their specific department. Being the

  owner, they can specify who should have access and who should not.

  Reference(s) used for this question:

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 220). McGraw-Hill .

  Kindle Edition.

• Question 460:

  When referring to a computer crime investigation, which of the following would be the MOST important step required in order to preserve and maintain a proper chain of custody of evidence:

  A. Evidence has to be collected in accordance with all laws and all legal regulations.
  B. Law enforcement officials should be contacted for advice on how and when to collect critical information.
  C. Verifiable documentation indicating the who, what, when, where, and how the evidence was handled should be available.
  D. Log files containing information regarding an intrusion are retained for at least as long as normal business records, and longer in the case of an ongoing investigation.
  C. Verifiable documentation indicating the who, what, when, where, and how the evidence was handled should be available.

  ---

  Two concepts that are at the heart of dealing effectively with digital/electronic evidence, or any evidence for that matter, are the chain of custody and authenticity/integrity.

  The chain of custody refers to the who, what, when, where, and how the evidence was handled-- from its identification through its entire life cycle, which ends with destruction or permanent archiving.

  Any break in this chain can cast doubt on the integrity of the evidence and on the professionalism of those directly involved in either the investigation or the collection and handling of the evidence. The chain of custody requires following a

  formal process that is well documented and forms part of a standard operating procedure that is used in all cases, no exceptions.

  The following are incorrect answers:

  Evidence has to be collected in accordance with all laws and legal regulations. Evidence would have to be collected in accordance with applicable laws and regulations but not necessarily with ALL laws and regulations. Only laws and

  regulations that applies would be followed.

  Law enforcement officials should be contacted for advice on how and when to collect critical information. It seems you failed to do your homework, once you have an incident it is a bit late to do this. Proper crime investigation as well as

  incident response is all about being prepared ahead of time. Obviously, you are improvising if you need to call law enforcement to find out what to do. It is a great way of contaminating your evidence by mistake if you don't have a well

  documented processs with clear procedures that needs to be followed.

  Log files containing information regarding an intrusion are retained for at least as long as normal business records, and longer in the case of an ongoing investigation. Specific legal requirements exists for log retention and they are not the

  same as normal business records. Laws such as Basel, HIPPAA, SOX, and others has specific requirements.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 23465-23470). Auerbach Publications. Kindle Edition.

  and

  ALLEN, Julia H., The CERT Guide to System and Network Security Practices, Addison-Wesley, 2001, Chapter 7: Responding to Intrusions (pages 282-285).