ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 501:

  Which of the following is NOT a factor related to Access Control?

  A. integrity
  B. authenticity
  C. confidentiality
  D. availability
  B. authenticity

  ---

  These factors cover the integrity, confidentiality, and availability components of information system security.

  Integrity is important in access control as it relates to ensuring only authorized subjects can make changes to objects.

  Authenticity is different from authentication. Authenticity pertains to something being authentic, not necessarily having a direct correlation to access control.

  Confidentiality is pertinent to access control in that the access to sensitive information is controlled to protect confidentiality.

  vailability is protected by access controls in that if an attacket attempts to disrupt availability they would first need access.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 49.

• Question 502:

  What does "System Integrity" mean?

  A. The software of the system has been implemented as designed.
  B. Users can't tamper with processes they do not own.
  C. Hardware and firmware have undergone periodic testing to verify that they are functioning properly.
  D. Design specifications have been verified against the formal top-level specification.
  C. Hardware and firmware have undergone periodic testing to verify that they are functioning properly.

  ---

  System Integrity means that all components of the system cannot be tampered with by unauthorized personnel and can be verified that they work properly.

  The following answers are incorrect:

  The software of the system has been implemented as designed. Is incorrect because this would fall under Trusted system distribution.

  Users can't tamper with processes they do not own. Is incorrect because this would fall under Configuration Management.

  Design specifications have been verified against the formal top-level specification. Is incorrect because this would fall under Specification and verification.

  References:

  AIOv3 Security Models and Architecture (pages 302 - 306)

  DOD TCSEC - http://www.cerberussystems.com/INFOSEC/stds/d520028.htm

• Question 503:

  Which of the following networking devices allows the connection of two or more homogeneous LANs in a simple way where they forward the traffic based on the MAC address ?

  A. Gateways
  B. Routers
  C. Bridges
  D. Firewalls
  C. Bridges

  ---

  Bridges are simple, protocol-dependent networking devices that are used to connect two or more homogeneous LANs to form an extended LAN.

  A bridge does not change the contents of the frame being transmitted but acts as a relay.

  A gateway is designed to reduce the problems of interfacing any combination of local networks that employ different level protocols or local and long-haul networks.

  A router connects two networks or network segments and may use IP to route messages.

  Firewalls are methods of protecting a network against security threats from other systems or networks by centralizing and controlling access to the protected network segment.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  7: Telecommunications and Network Security (page 397).

• Question 504:

  Unshielded Twisted Pair (UTP) cables comes in several categories. The categories are based on:

  A. The level of performance
  B. How thick the shielding is.
  C. The length of the cable
  D. The diameter of the copper.
  A. The level of performance

  ---

  TIA/EIA-568 is a set of telecommunications standards from the Telecommunications Industry Association, an offshoot of the EIA. The standards address commercial building cabling for telecom products and services.

  The standard is currently (2009) at revision C, replacing the 2001 revision B, the 1995 revision A, and the initial issue of 1991, which are now obsolete.

  Perhaps the best known features of TIA/EIA-568 are the pin/pair assignments for eight- conductor 100- ohm balanced twisted pair cabling. These assignments are named T568A and T568B, and are frequently referred to (erroneously) as TIA/ EIA-568A and TIA/EIA-568B. An IEC standard ISO/IEC 11801 provides similar standards for network cables.

  The standard defines categories of unshielded twisted pair cable systems, with different levels of performance in signal bandwidth, attenuation, and cross-talk. Generally increasing category numbers correspond with a cable system suitable for higher rates of data transmission. Category 3 cable was suitable for telephone circuits and data rates up to 16 million bits per second. Category 5 cable, with more restrictions on attenuation and cross talk, has a bandwidth of 100 MHz. The 1995 edition of the standard defined categories 3, 4, and 5. Categories 1 and 2 were excluded from the standard since these categories were only used for voice circuits, not for data.

  Twisted pair cabling is a type of wiring in which two conductors of a single circuit are twisted together for the purposes of canceling out electromagnetic interference (EMI) from external sources; for instance, electromagnetic radiation from unshielded twisted pair (UTP) cables, and crosstalk between neighboring pairs. It was invented by Alexander Graham Bell.

  SOME OF THE LIMITATION OF UTP UTP has several drawbacks. Because it does not have shielding like shielded twisted-pair cables, UTP is susceptible to interference from external electrical sources, which could reduce the integrity of the signal. Also, to intercept transmitted data, an intruder can install a tap on the cable or monitor the radiation from the wire. Thus, UTP may not be a good choice when transmitting very sensitive data or when installed in an environment with much electromagnetic interference (EMI) or radio frequency interference (RFI). Despite its drawbacks, UTP is the most common cable type. UTP is inexpensive, can be easily bent during installation, and, in most cases, the risk from the above drawbacks is not enough to justify more expensive cables.

  Resource(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 6507-6511). Auerbach Publications. Kindle Edition.

  http://en.wikipedia.org/wiki/TIA/EIA-568#cite_note-7

  http://en.wikipedia.org/wiki/Twisted_pair

  AIOv3 Telecommunication and Networking Security (page 455)

• Question 505:

  Which of the following is the most critical item from a disaster recovery point of view?

  A. Data
  B. Hardware/Software
  C. Communication Links
  D. Software Applications
  A. Data

  ---

  The most important point is ALWAYS the data. Everything else can be replaced or repaired.

  Data MUST be backed up, backups must be regularly tested, because once it is truly lost, it is lost forever.

  The goal of disaster recovery is to minimize the effects of a disaster or disruption. It means taking the necessary steps to ensure that the resources, personnel, and business processes are able to resume operation in a timely manner . This is

  different from continuity planning, which provides methods and procedures for dealing with longer-term outages and disasters.

  The goal of a disaster recovery plan is to handle the disaster and its ramifications right after the disaster hits; the disaster recovery plan is usually very information technology (IT) focused. A disaster recovery plan (DRP) is carried out when

  everything is still in emergency mode, and everyone is scrambling to get all critical systems back online.

  Reference(s) used for this question:

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 887). McGraw-Hill.

  Kindle Edition.

  and

  Veritas eLearning CD - Introducing Disaster Recovery Planning, Chapter 1.

• Question 506:

  Which of the following is an example of a connectionless communication protocol?

  A. UDP
  B. X.25
  C. Packet switching
  D. TCP
  A. UDP

  ---

  UDP is an example of connectionless communication protocol, wherein no connection needs to be established before data can be exchanged.

  In telecommunications, connectionless describes communication between two network end points in which a message can be sent from one end point to another without prior arrangement. The device at one end of the communication

  transmits data addressed to the other, without first ensuring that the recipient is available and ready to receive the data. Some protocols allow for error correction by requested retransmission. Internet Protocol (IP) and User Datagram Protocol

  (UDP) are connectionless protocols.

  Connectionless protocols are also described as stateless because the endpoints have no protocol- defined way to remember where they are in a "conversation" of message exchanges.

  List of connectionless protocols

  Hypertext Transfer Protocol

  IP

  UDP

  ICMP

  IPX

  TIPC

  NetBEUI

  References:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 86).

  and

  https://secure.wikimedia.org/wikipedia/en/wiki/Connectionless_protocol

• Question 507:

  What can be defined as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire?

  A. Certificate revocation list
  B. Certificate revocation tree
  C. Authority revocation list
  D. Untrusted certificate list
  C. Authority revocation list

  ---

  The Internet Security Glossary (RFC2828) defines the Authority Revocation List (ARL) as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire. Do not to confuse with an ARL with a Certificate Revocation List (CRL). A certificate revocation list is a mechanism for distributing notices of certificate revocations. The question specifically mentions "issued to CAs" which makes ARL a better answer than CRL.

  http://rfclibrary.hosting.com/rfc/rfc2828/rfc2828-29.asp

  $ certificate revocation list (CRL)

  (I)

  A data structure that enumerates digital certificates that have been invalidated by their issuer prior to when they were

  scheduled to expire. (See: certificate expiration, X.509 certificate revocation list.)

  http://rfclibrary.hosting.com/rfc/rfc2828/rfc2828-17.asp

  $ authority revocation list (ARL)

  (I)

  A data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire. (See: certificate expiration, X.509 authority revocation list.)

  In a few words: We use CRL's for end-user cert revocation and ARL's for CA cert revocation - both can be placed in distribution points.

• Question 508:

  When a station communicates on the network for the first time, which of the following protocol would search for and find the Internet Protocol (IP) address that matches with a known Ethernet address?

  A. Address Resolution Protocol (ARP).
  B. Reverse Address Resolution Protocol (RARP).
  C. Internet Control Message protocol (ICMP).
  D. User Datagram Protocol (UDP).
  B. Reverse Address Resolution Protocol (RARP).

  ---

  The RARP protocol sends out a packet, which includes its MAC address and a request to be informed of the IP address that should be assigned to that MAC address.

  ARP does the opposite by broadcasting a request to find the Ethernet address that matches a known IP address.

  ICMP supports packets containing error, control, and informational messages (e.g. PING).

  UDP runs over IP and is used primarily for broadcasting messages over a network.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 87.

• Question 509:

  Which of the following embodies all the detailed actions that personnel are required to follow?

  A. Standards
  B. Guidelines
  C. Procedures
  D. Baselines
  C. Procedures

  ---

  Procedures are step-by-step instructions in support of of the policies, standards, guidelines and baselines. The procedure indicates how the policy will be implemented and who does what to accomplish the tasks."

  Standards is incorrect. Standards are a "Mandatory statement of minimum requirements that support some part of a policy, the standards in this case is your own company standards and not standards such as the ISO standards"

  Guidelines is incorrect. "Guidelines are discretionary or optional controls used to enable individuals to make judgments with respect to security actions."

  Baselines is incorrect. Baselines "are a minimum acceptable level of security. This minimum is implemented using specific rules necessary to implement the security controls in support of the policy and standards." For example, requiring a

  password of at leat 8 character would be an example. Requiring all users to have a minimun of an antivirus, a personal firewall, and an anti spyware tool could be another example.

  References:

  CBK, pp. 12 - 16. Note especially the discussion of the "hammer policy" on pp. 16-17 for the differences between policy, standard, guideline and procedure.

  AIO3, pp. 88-93.

• Question 510:

  What can be defined as secret communications where the very existence of the message is hidden?

  A. Clustering
  B. Steganography
  C. Cryptology
  D. Vernam cipher
  B. Steganography

  ---

  Steganography is a secret communication where the very existence of the message is hidden. For example, in a digital image, the least significant bit of each word can be used to comprise a message without causing any significant change in the image. Key clustering is a situation in which a plaintext message generates identical ciphertext messages using the same transformation algorithm but with different keys. Cryptology encompasses cryptography and cryptanalysis. The Vernam Cipher, also called a one-time pad, is an encryption scheme using a random key of the same size as the message and is used only once. It is said to be unbreakable, even with infinite resources.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 4: Cryptography (page 134).