ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 471:

  When backing up an applications system's data, which of the following is a key question to be answered first?

  A. When to make backups
  B. Where to keep backups
  C. What records to backup
  D. How to store backups
  C. What records to backup

  ---

  It is critical that a determination be made of WHAT data is important and should be retained and protected. Without determining the data to be backed up, the potential for error increases. A record or file could be vital and yet not included in a

  backup routine. Alternatively, temporary or insignificant files could be included in a backup routine unnecessarily.

  The following answers were incorrect:

  When to make backups Although it is important to consider schedules for backups, this is done after the decisions are made of what should be included in the backup routine. Where to keep backups The location of storing backup copies of

  data (Such as tapes, on-line backups, etc) should be made after determining what should be included in the backup routine and the method to store the backup.

  How to store backups The backup methodology should be considered after determining what data should be included in the backup routine.

• Question 472:

  Which of the following is not a DES mode of operation?

  A. Cipher block chaining
  B. Electronic code book
  C. Input feedback
  D. Cipher feedback
  C. Input feedback

  ---

  Output feedback (OFB) is a DES mode of operation, not input feedback.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 4: Cryptography (page 149).

• Question 473:

  Which one of the following represents an ALE calculation?

  A. single loss expectancy x annualized rate of occurrence.
  B. gross loss expectancy x loss frequency.
  C. actual replacement cost - proceeds of salvage.
  D. asset value x loss expectancy.
  A. single loss expectancy x annualized rate of occurrence.

  ---

  Single Loss Expectancy (SLE) is the dollar amount that would be lost if there was a loss of an asset. Annualized Rate of Occurrence (ARO) is an estimated possibility of a threat to an asset taking place in one year (for example if there is a

  change of a flood occuring once in 10 years the ARO would be .1, and if there was a chance of a flood occuring once in 100 years then the ARO would be .01).

  The following answers are incorrect:

  gross loss expectancy x loss frequency. Is incorrect because this is a distractor.

  actual replacement cost - proceeds of salvage. Is incorrect because this is a distractor.

  asset value x loss expectancy. Is incorrect because this is a distractor.

• Question 474:

  Public Key Infrastructure (PKI) uses asymmetric key encryption between parties. The originator encrypts information using the intended recipient's "public" key in order to get confidentiality of the data being sent. The recipients use their own "private" key to decrypt the information. The "Infrastructure" of this methodology ensures that:

  A. The sender and recipient have reached a mutual agreement on the encryption key exchange that they will use.
  B. The channels through which the information flows are secure.
  C. The recipient's identity can be positively verified by the sender.
  D. The sender of the message is the only other person with access to the recipient's private key.
  C. The recipient's identity can be positively verified by the sender.

  ---

  Through the use of Public Key Infrastructure (PKI) the recipient's identity can be positively verified by the sender.

  The sender of the message knows he is using a Public Key that belongs to a specific user. He can validate through the Certification Authority (CA) that a public key is in fact the valid public key of the receiver and the receiver is really who he

  claims to be. By using the public key of the recipient, only the recipient using the matching private key will be able to decrypt the message. When you wish to achieve confidentiality, you encrypt the message with the recipient public key.

  If the sender would wish to prove to the recipient that he is really who he claims to be then the sender would apply a digital signature on the message before encrypting it with the public key of the receiver. This would provide Confidentiality

  and Authenticity of the message.

  A PKI (Public Key Infrastructure) enables users of an insecure public network, such as the Internet, to securely and privately exchange data through the use of public key-pairs that are obtained and shared through a trusted authority, usually

  referred to as a Certificate Authority.

  The PKI provides for digital certificates that can vouch for the identity of individuals or organizations, and for directory services that can store, and when necessary, revoke those digital certificates. A PKI is the underlying technology that

  addresses the issue of trust in a normally untrusted environment.

  The following answers are incorrect:

  The sender and recipient have reached a mutual agreement on the encryption key exchange that they will use. Is incorrect because through the use of Public Key Infrastructure (PKI), the parties do not have to have a mutual agreement. They

  have a trusted 3rd party Certificate Authority to perform the verification of the sender.

  The channels through which the information flows are secure. Is incorrect because the use of Public Key Infrastructure (PKI) does nothing to secure the channels.

  The sender of the message is the only other person with access to the recipient's private key. Is incorrect because the sender does not have access to the recipient's private key though Public Key Infrastructure (PKI).

  Reference(s) used for this question:

  OIG CBK Cryptography (pages 253 - 254)

• Question 475:

  Which of the following is a cryptographic protocol and infrastructure developed to send encrypted credit card numbers over the Internet?

  A. Secure Electronic Transaction (SET)
  B. MONDEX
  C. Secure Shell (SSH-2)
  D. Secure Hypertext Transfer Protocol (S-HTTP)
  A. Secure Electronic Transaction (SET)

  ---

  SET was developed by a consortium including Visa and MasterCard.

  Source: Harris, Shon, CISSP All In One Exam Guide, pages 668-669.

  Mondex is a smart card electronic cash system owned by MasterCard.

  SSH-2 is a secure, efficient, and portable version of SSH (Secure Shell) which is a secure replacement for telnet.

  Secure HTTP is a secure message-oriented communications protocol designed for use in conjunction with HTTP. It is designed to coexist with HTTP's messaging model and to be easily integrated with HTTP applications.

• Question 476:

  The viewing of recorded events after the fact using a closed-circuit TV camera is considered a

  A. Preventative control.
  B. Detective control
  C. Compensating control
  D. Corrective control
  B. Detective control

  ---

  Detective security controls are like a burglar alarm. They detect and report an unauthorized or undesired event (or an attempted undesired event). Detective security controls are invoked after the undesirable event has occurred. Example

  detective security controls are log monitoring and review, system audit, file integrity checkers, and motion detection.

  Visual surveillance or recording devices such as closed circuit television are used in conjunction with guards in order to enhance their surveillance ability and to record events for future analysis or prosecution.

  When events are monitored, it is considered preventative whereas recording of events is considered detective in nature.

  Below you have s of other types of security controls from a nice guide produce by James Purcell (see reference below):

  Preventive security controls are put into place to prevent intentional or unintentional disclosure, alteration, or destruction (D.A.D.) of sensitive information. Some example preventive controls follow:

  Policy Unauthorized network connections are prohibited.

  Firewall Blocks unauthorized network connections.

  Locked wiring closet Prevents unauthorized equipment from being physically plugged into a network switch.

  Notice in the preceding examples that preventive controls crossed administrative, technical, and physical categories discussed previously. The same is true for any of the controls discussed in this section. Corrective security controls are used

  to respond to and fix a security incident. Corrective security controls also limit or reduce further damage from an attack. Examples follow:

  Procedure to clean a virus from an infected system

  A guard checking and locking a door left unlocked by a careless employee

  Updating firewall rules to block an attacking IP address

  Note that in many cases the corrective security control is triggered by a detective security control.

  Recovery security controls are those controls that put a system back into production after an incident. Most Disaster Recovery activities fall into this category. For example, after a disk failure, data is restored from a backup tape.

  Directive security controls are the equivalent of administrative controls. Directive controls direct that some action be taken to protect sensitive organizational information. The directive can be in the form of a policy, procedure, or guideline.

  Deterrent security controls are controls that discourage security violations. For instance, "Unauthorized Access Prohibited" signage may deter a trespasser from entering an area. The presence of security cameras might deter an employee

  from stealing equipment. A policy that states access to servers is monitored could deter unauthorized access.

  Compensating security controls are controls that provide an alternative to normal controls that cannot be used for some reason. For instance, a certain server cannot have antivirus software installed because it interferes with a critical

  application. A compensating control would be to increase monitoring of that server or isolate that server on its own network segment.

  Note that there is a third popular taxonomy developed by NIST and described in NIST Special Publication 800-53, "Recommended Security Controls for Federal Information Systems." NIST categorizes security controls into 3 classes and then

  further categorizes the controls within the classes into 17 families. Within each security control family are dozens of specific controls. The NIST taxonomy is not covered on the CISSP exam but is one the CISSP should be aware of if you are

  employed within the US federal workforce.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 10: Physical security (page 340).

  and

  CISSP Study Guide By Eric Conrad, Seth Misenar, Joshua Feldman, page 50-52

  and

  Security Control Types and Operational Security, James E. Purcell, http://www.giac.org/cissp- papers/207.pdf

• Question 477:

  Which of the following does NOT concern itself with key management?

  A. Internet Security Association Key Management Protocol (ISAKMP)
  B. Diffie-Hellman (DH)
  C. Cryptology (CRYPTO)
  D. Key Exchange Algorithm (KEA)
  C. Cryptology (CRYPTO)

  ---

  Cryptology is the science that includes both cryptography and cryptanalysis and is not directly concerned with key management. Cryptology is the mathematics, such as number theory, and the application of formulas and algorithms, that underpin cryptography and cryptanalysis.

  The following are all concerned with Key Management which makes them the wrong choices:

  Internet Security Association Key Management Protocol (ISAKMP) is a key management protocol used by IPSec. ISAKMP (Internet Security Association and Key Management Protocol) is a protocol defined by RFC 2408 for establishing Security Associations (SA) and cryptographic keys in an Internet environment. ISAKMP only provides a framework for authentication and key exchange. The actual key exchange is done by the Oakley Key Determination Protocol which is a key-agreement protocol that allows authenticated parties to exchange keying material across an insecure connection using the Diffie-Hellman key exchange algorithm.

  Diffie-Hellman and one variation of the Diffie-Hellman algorithm called the Key Exchange Algorithm (KEA) are also key exchange protocols. Key exchange (also known as "key establishment") is any method in cryptography by which cryptographic keys are exchanged between users, allowing use of a cryptographic algorithm. DiffieHellman key exchange (DH) is a specific method of exchanging keys. It is one of the earliest practical examples of key exchange implemented within the field of cryptography. The Diffie- Hellman key exchange method allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure communications channel. This key can then be used to encrypt subsequent communications using a symmetric key cipher.

  Reference(s) used for this question:

  Mike Meyers CISSP Certification Passport, by Shon Harris and Mike Meyers, page 228.

  It is highlighted as an EXAM TIP. Which tells you that it is a must know for the purpose of the exam. HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, Fifth Edition, Chapter

  8: Cryptography (page 713-715). and https://en.wikipedia.org/wiki/ISAKMP and http://searchsecurity.techtarget.com/definition/cryptology

• Question 478:

  Which of the following best defines a Computer Security Incident Response Team (CSIRT)?

  A. An organization that provides a secure channel for receiving reports about suspected security incidents.
  B. An organization that ensures that security incidents are reported to the authorities.
  C. An organization that coordinates and supports the response to security incidents.
  D. An organization that disseminates incident-related information to its constituency and other involved parties.
  C. An organization that coordinates and supports the response to security incidents.

  ---

  RFC 2828 (Internet Security Glossary) defines a Computer Security Incident Response Team (CSIRT) as an organization that coordinates and supports the response to security incidents that involves sites within a defined constituency. This is the proper definition for the CSIRT. To be considered a CSIRT, an organization must provide a secure channel for receiving reports about suspected security incidents, provide assistance to members of its constituency in handling the incidents and disseminate incident- related information to its constituency and other involved parties. Security-related incidents do not necessarily have to be reported to the authorities.

  Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

• Question 479:

  Smart cards are an example of which type of control?

  A. Detective control
  B. Administrative control
  C. Technical control
  D. Physical control
  C. Technical control

  ---

  Logical or technical controls involve the restriction of access to systems and the protection of information. Smart cards and encryption are examples of these types of control.

  Controls are put into place to reduce the risk an organization faces, and they come in three main flavors:

  administrative, technical, and physical. Administrative controls are commonly referred to as "soft controls" because they are more management-oriented. Examples of administrative controls are security documentation, risk management,

  personnel security, and training. Technical controls (also called logical controls) are software or hardware components, as in firewalls, IDS, encryption, identification and authentication mechanisms. And physical controls are items put into

  place to protect facility, personnel, and resources. Examples of physical controls are security guards, locks, fencing, and lighting.

  Many types of technical controls enable a user to access a system and the resources within that system. A technical control may be a username and password combination, a Kerberos implementation, biometrics, public key infrastructure

  (PKI), RADIUS, TACACS +, or authentication using a smart card through a reader connected to a system. These technologies verify the user is who he says he is by using different types of authentication methods. Once a user is properly

  authenticated, he can be authorized and allowed access to network resources.

  Reference(s) used for this question:

  Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 245). McGraw-Hill.

  Kindle Edition.

  and

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 2: Access control systems (page 32).

• Question 480:

  Which of the following service is a distributed database that translate host name to IP address to IP address to host name?

  A. DNS
  B. FTP
  C. SSH
  D. SMTP
  A. DNS

  ---

  The Domain Name System (DNS) is a hierarchical distributed naming system for computers, services, or any resource connected to the Internet or a private network. It associates information from domain names with each of the assigned entities. Most prominently, it translates easily memorized domain names to the numerical IP addresses needed for locating computer services and devices worldwide. The Domain Name System is an essential component of the functionality of the Internet. This article presents a functional description of the Domain Name System. For your exam you should know below information general Internet terminology: Network access point - Internet service providers access internet using net access point.A Network Access Point (NAP) was a public network exchange facility where Internet service providers (ISPs) connected with one another in peering arrangements. The NAPs were a key component in the transition from the 1990s NSFNET era (when many networks were government sponsored and commercial traffic was prohibited) to the commercial Internet providers of today. They were often points of considerable Internet congestion. Internet Service Provider (ISP) - An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. Internet service providers may be organized in various forms, such as commercial, community-owned, non-profit, or otherwise privately owned. Internet services typically provided by ISPs include Internet access, Internet transit, domain name registration, web hosting, co-location. Telnet or Remote Terminal Control Protocol -A terminal emulation program for TCP/IP networks such as the Internet. The Telnet program runs on your computer and connects your PC to a server on the network. You can then enter commands through the Telnet program and they will be executed as if you were entering them directly on the server console. This enables you to control the server and communicate with other servers on the network. To start a Telnet session, you must log in to a server by entering a valid username and password. Telnet is a common way to remotely control Web servers. Internet Link- Internet link is a connection between Internet users and the Internet service provider. Secure Shell or Secure Socket Shell (SSH) - Secure Shell (SSH), sometimes known as Secure Socket Shell, is a UNIX-based command interface and protocol for securely getting access to a remote computer. It is widely used by network administrators to control Web and other kinds of servers remotely. SSH is actually a suite of three utilities - slogin, ssh, and scp - that are secure versions of the earlier UNIX utilities, rlogin, rsh, and rcp. SSH commands are encrypted and secure in several ways. Both ends of the client/ server connection are authenticated using a digital certificate, and passwords are protected by being encrypted. Domain Name System (DNS) - The Domain Name System (DNS) is a hierarchical distributed naming system for computers, services, or any resource connected to the Internet or a private network. It associates information from domain names with each of the assigned entities. Most prominently, it translates easily memorized domain names to the numerical IP addresses needed for locating computer services and devices worldwide. The Domain Name System is an essential component of the functionality of the Internet. This article presents a functional description of the Domain Name System. File Transfer Protocol (FTP) - The File Transfer Protocol or FTP is a client/server application that is used to move files from one system to another. The client connects to the FTP server, authenticates and is given access that the server is configured to permit. FTP servers can also be configured to allow anonymous access by logging in with an email address but no password. Once connected, the client may move around between directories with commands available Simple Mail Transport Protocol (SMTP) - SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server. In other words, users typically use a program that uses SMTP for sending e-mail and either POP3 or IMAP for receiving e-mail. On Unix-based systems, send mail is the most widely-used SMTP server for e-mail. A commercial package, Send mail, includes a POP3 server. Microsoft Exchange includes an SMTP server and can also be set up to include POP3 support. The following answers are incorrect: SMTP - Simple Mail Transport Protocol (SMTP) - SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server. In other words, users typically use a program that uses SMTP for sending e-mail and either POP3 or IMAP for receiving e-mail. On Unix-based systems, send mail is the most widely-used SMTP server for e-mail. A commercial package, Send mail, includes a POP3 server. Microsoft Exchange includes an SMTP server and can also be set up to include POP3 support. FTP - The File Transfer Protocol or FTP is a client/server application that is used to move files from one system to another. The client connects to the FTP server, authenticates and is given access that the server is configured to permit. FTP servers can also be configured to allow anonymous access by logging in with an email address but no password. Once connected, the client may move around between directories with commands available SSH - Secure Shell (SSH), sometimes known as Secure Socket Shell, is a UNIX-based command interface and protocol for securely getting access to a remote computer. It is widely used by network administrators to control Web and other kinds of servers remotely. SSH is actually a suite of three utilities - slogin, ssh, and scp - that are secure versions of the earlier UNIX utilities, rlogin, rsh, and rcp. SSH commands are encrypted and secure in several ways. Both ends of the client/server connection are authenticated using a digital certificate, and passwords are protected by being encrypted. The following reference(s) were/was used to create this question: CISA review manual 2014 page number 273 and 274