ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 481:

  What is the role of IKE within the IPsec protocol?

  A. peer authentication and key exchange
  B. data encryption
  C. data signature
  D. enforcing quality of service
  A. peer authentication and key exchange

  ---

  Reference: RFC 2409: The Internet Key Exchange (IKE); DORASWAMY, Naganand and HARKINS, Dan, Ipsec: The New Security Standard for the Internet, Intranets, and Virtual Private Networks, 1999, Prentice Hall PTR; SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.

• Question 482:

  All hosts on an IP network have a logical ID called a(n):

  A. IP address.
  B. MAC address.
  C. TCP address.
  D. Datagram address.
  A. IP address.

  ---

  All hosts on a network have a logical ID that is called an IP address. An IP address is a numeric identifier that is assigned to each machine on an IP network. It designates the location of a device on a network. A MAC address is typically called a hardware address because it is "burned" into the NIC card. TCP address and Datagram address are imposter answers.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 87.

• Question 483:

  Which of the following prevents, detects, and corrects errors so that the integrity, availability, and confidentiality of transactions over networks may be maintained?

  A. Communications security management and techniques
  B. Information security management and techniques
  C. Client security management and techniques
  D. Server security management and techniques
  A. Communications security management and techniques

  ---

  Communications security and techniques are the best area for addressing this objective.

  "Information security management and techniques" is incorrect. While the overall information security program would include this objective, communications security is the more specific and better answer.

  "Client security management and techniques" is incorrect. While client security plays a part in this overall objective, communications security is the more specific and better answer. "Server security management and techniques" is incorrect.

  While server security plays a part in this overall objective, communications security is the more specific and better answer.

  References:

  CBK, p. 408

• Question 484:

  Which authentication technique best protects against hijacking?

  A. Static authentication
  B. Continuous authentication
  C. Robust authentication
  D. Strong authentication
  B. Continuous authentication

  ---

  A continuous authentication provides protection against impostors who can see, alter, and insert information passed between the claimant and verifier even after the claimant/verifier authentication is complete. This is the best protection against hijacking. Static authentication is the type of authentication provided by traditional password schemes and the strength of the authentication is highly dependent on the difficulty of guessing passwords. The robust authentication mechanism relies on dynamic authentication data that changes with each authenticated session between a claimant and a verifier, and it does not protect against hijacking. Strong authentication refers to a two-factor authentication (like something a user knows and something a user is).

  Source: TIPTON, Harold F. and KRAUSE, Micki, Information Security Management Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 3: Secured Connections to External Networks (page 51).

• Question 485:

  What is the difference between Access Control Lists (ACLs) and Capability Tables?

  A. Access control lists are related/attached to a subject whereas capability tables are related/attached to an object.
  B. Access control lists are related/attached to an object whereas capability tables are related/attached to a subject.
  C. Capability tables are used for objects whereas access control lists are used for users.
  D. They are basically the same.
  B. Access control lists are related/attached to an object whereas capability tables are related/attached to a subject.

  ---

  Capability tables are used to track, manage and apply controls based on the object and rights, or capabilities of a subject. For example, a table identifies the object, specifies access rights allowed for a subject, and permits access based on

  the user's posession of a capability (or ticket) for the object. It is a row within the matrix.

  To put it another way, A capabiltiy table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL.

  CLEMENT NOTE:

  If we wish to express this very simply:

  Capabilities are attached to a subject and it describe what access the subject has to each of the objects on the row that matches with the subject within the matrix. It is a row within the matrix.

  ACL's are attached to objects, it describe who has access to the object and what type of access they have.

  It is a column within the matrix.

  The following are incorrect answers:

  "Access control lists are subject-based whereas capability tables are object-based" is incorrect.

  "Capability tables are used for objects whereas access control lists are used for users" is incorrect.

  "They are basically the same" is incorrect.

  References used for this question:

  CBK, pp. 191 - 192

  AIO3 p. 169

• Question 486:

  Which access control model enables the OWNER of the resource to specify what subjects can access specific resources based on their identity?

  A. Discretionary Access Control
  B. Mandatory Access Control
  C. Sensitive Access Control
  D. Role-based Access Control
  A. Discretionary Access Control

  ---

  Data owners decide who has access to resources based only on the identity of the person accessing the resource.

  The following answers are incorrect :

  Mandatory Access Control : users and data owners do not have as much freedom to determine who can access files. The operating system makes the final decision and can override the users' wishes and access decisions are based on

  security labels.

  Sensitive Access Control : There is no such access control in the context of the above question.

  Role-based Access Control : uses a centrally administered set of controls to determine how subjects and objects interact , also called as non discretionary access control.

  In a mandatory access control (MAC) model, users and data owners do not have as much freedom to determine who can access files. The operating system makes the final decision and can override the users' wishes. This model is much more structured and strict and is based on a security label system. Users are given a security clearance (secret, top secret, confidential, and so on), and data is classified in the same way. The clearance and classification data is stored in the security labels, which are bound to the specific subjects and objects. When the system makes a decision about fulfilling a request to access an object, it is based on the clearance of the subject, the classification of the object, and the security policy of the system. The rules for how subjects access objects are made by the security officer, configured by the administrator, enforced by the operating system, and supported by security technologies

  Reference : Shon Harris , AIO v3 , Chapter-4 : Access Control , Page : 163-165

• Question 487:

  Authentication Headers (AH) and Encapsulating Security Payload (ESP) protocols are the driving force of IPSec. Authentication Headers (AH) provides the following service except:

  A. Authentication
  B. Integrity
  C. Replay resistance and non-repudiations
  D. Confidentiality
  D. Confidentiality

  ---

  AH provides integrity, authentication, and non-repudiation. AH does not provide encryption which means that NO confidentiality is in place if only AH is being used. You must make use of the Encasulating Security Payload if you wish to get confidentiality. IPSec uses two basic security protocols: Authentication Header (AH) and Encapsulation Security Payload. AH is the authenticating protocol and the ESP is the authenticating and encrypting protocol that uses cryptographic mechanisms to provide source authentication, confidentiality and message integrity. The modes of IPSEC, the protocols that

  have to be used are all negotiated using Security Association. Security Associations (SAs) can be combined into bundles to provide authentication, confidentialility and layered communication.

  Source:

  TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 2, 2001, CRC Press, NY, page 164.

  also see:

  Shon Harris, CISSP All In One Exam Guide, 5th Edition, Page 758

• Question 488:

  A momentary power outage is a:

  A. spike
  B. blackout
  C. surge
  D. fault
  D. fault

  ---

  A momentary power outage is a fault.

  Power Excess

  Spike --> Too much voltage for a short period of time.

  Surge --> Too much voltage for a long period of time.

  Power Loss

  Fault --> A momentary power outage.

  Blackout --> A long power interruption.

  Power Degradation

  Sag or Dip --> A momentary low voltage.

  Brownout --> A prolonged power supply that is below normal voltage.

  Reference(s) used for this question:

  HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 3rd. Edition McGraw- Hill/Osborne, 2005, page 368.

  and

  https://en.wikipedia.org/wiki/Power_quality

• Question 489:

  Which of the following is NOT a property of the Rijndael block cipher algorithm?

  A. The key sizes must be a multiple of 32 bits
  B. Maximum block size is 256 bits
  C. Maximum key size is 512 bits
  D. The key size does not have to match the block size
  C. Maximum key size is 512 bits

  ---

  The above statement is NOT true and thus the correct answer. The maximum key size on Rijndael is 256 bits.

  There are some differences between Rijndael and the official FIPS-197 specification for AES.

  Rijndael specification per se is specified with block and key sizes that must be a multiple of 32 bits, both with a minimum of 128 and a maximum of 256 bits. Namely, Rijndael allows for both key and block sizes to be chosen independently

  from the set of { 128, 160, 192, 224, 256 } bits. (And the key size does not in fact have to match the block size).

  However, FIPS-197 specifies that the block size must always be 128 bits in AES, and that the key size may be either 128, 192, or 256 bits. Therefore AES-128, AES-192, and AES-256 are actually:

  Key Size (bits) Block Size (bits)

  AES-128 128 128

  AES-192 192 128

  AES-256 256 128

  So in short:

  Rijndael and AES differ only in the range of supported values for the block length and cipher key length.

  For Rijndael, the block length and the key length can be independently specified to any multiple of 32 bits, with a minimum of 128 bits, and a maximum of 256 bits.

  AES fixes the block length to 128 bits, and supports key lengths of 128, 192 or 256 bits only.

  References used for this question:

  http://blogs.msdn.com/b/shawnfa/archive/2006/10/09/the-differences-between-rijndael-and- aes.aspx

  and

  http://csrc.nist.gov/CryptoToolkit/aes/rijndael/Rijndael.pdf

• Question 490:

  What is NOT true with pre shared key authentication within IKE / IPsec protocol?

  A. Pre shared key authentication is normally based on simple passwords
  B. Needs a Public Key Infrastructure (PKI) to work
  C. IKE is used to setup Security Associations
  D. IKE builds upon the Oakley protocol and the ISAKMP protocol.
  B. Needs a Public Key Infrastructure (PKI) to work

  ---

  Internet Key Exchange (IKE or IKEv2) is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP. IKE uses X.509 certificates for authentication which are either preshared or distributed using DNS (preferably with DNSSEC) and a DiffieHellman key exchange to set up a shared session secret from which cryptographic keys are derived.

  Internet Key Exchange (IKE) Internet key exchange allows communicating partners to prove their identity to each other and establish a secure communication channel, and is applied as an authentication component of IPSec.

  IKE uses two phases:

  Phase 1: In this phase, the partners authenticate with each other, using one of the following:

  Shared Secret: A key that is exchanged by humans via telephone, fax, encrypted e-mail, etc.

  Public Key Encryption: Digital certificates are exchanged.

  Revised mode of Public Key Encryption: To reduce the overhead of public key encryption, a nonce (a Cryptographic function that refers to a number or bit string used only once, in security engineering) is encrypted with the communicating

  partner's public key, and the peer's identity is encrypted with symmetric encryption using the nonce as the key. Next, IKE establishes a temporary security association and secure tunnel to protect the rest of the key exchange. Phase 2:

  The peers' security associations are established, using the secure tunnel and temporary SA created at the end of phase 1.

  The following reference(s) were used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 7032-7048). Auerbach Publications. Kindle Edition. and RFC 2409 at http://tools.ietf.org/html/rfc2409 and http://en.wikipedia.org/wiki/Internet_Key_Exchange