ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 51:

  Which of the following determines that the product developed meets the projects goals?

  A. verification
  B. validation
  C. concurrence
  D. accuracy
  B. validation

  ---

  Software Development Verification vs. Validation:

  Verification determines if the product accurately represents and meets the design specifications given to the developers. A product can be developed that does not match the original specifications. This step ensures that the specifications are properly met and closely followed by the development team. Validation determines if the product provides the necessary solution intended real-world problem. It validates whether or not the final product is what the user expected in the first place and whether or not it solve the problem it intended to

  solve. In large projects, it is easy to lose sight of overall goal. This exercise ensures that the main goal of the project is met. From DITSCAP:

  6.3.2. Phase 2, Verification. The Verification phase shall include activities to verify compliance of the system with previously agreed security requirements. For each life-cycle development activity, DoD Directive 5000.1 (reference (i)), there is a corresponding set of security activities, enclosure 3, that shall verify compliance with the security requirements and evaluate vulnerabilities.

  6.3.3. Phase 3, Validation. The Validation phase shall include activities to evaluate the fully integrated system to validate system operation in a specified computing environment with an acceptable level of residual risk. Validation shall

  culminate in an approval to operate.

  NOTE:

  DIACAP has replace DITSCAP but the definition above are still valid and applicable for the purpose of the exam.

  Reference(s) used for this question:

  Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 1106). McGraw-Hill.

  Kindle Edition.

  and http://iase.disa.mil/ditscap/DITSCAP.html

• Question 52:

  The scope and focus of the Business continuity plan development depends most on:

  A. Directives of Senior Management
  B. Business Impact Analysis (BIA)
  C. Scope and Plan Initiation
  D. Skills of BCP committee
  B. Business Impact Analysis (BIA)

  ---

  SearchStorage.com Definitions mentions "As part of a disaster recovery plan, BIA is likely to identify costs linked to failures, such as loss of cash flow, replacement of equipment, salaries paid to catch up with a backlog of work, loss of profits, and so on.

  A BIA report quantifies the importance of business components and suggests appropriate fund allocation for measures to protect them. The possibilities of failures are likely to be assessed in terms of their impacts on safety, finances, marketing, legal compliance, and quality assurance.

  Where possible, impact is expressed monetarily for purposes of comparison. For example, a business may spend three times as much on marketing in the wake of a disaster to rebuild customer confidence." Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Page 278.

• Question 53:

  Single Sign-on (SSO) is characterized by which of the following advantages?

  A. Convenience
  B. Convenience and centralized administration
  C. Convenience and centralized data administration
  D. Convenience and centralized network administration
  B. Convenience and centralized administration

  ---

  Convenience -Using single sign-on users have to type their passwords only once when they first log in to access all the network resources; and Centralized Administration as some single sign-on systems are built around a unified server administration system. This allows a single administrator to add and delete accounts across the entire network from one user interface.

  The following answers are incorrect:

  Convenience - alone this is not the correct answer.

  Centralized Data or Network Administration - these are thrown in to mislead the student. Neither are a benefit to SSO, as these specifically should not be allowed with just an SSO.

  References: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 1, page 35.

  TIPTON, Harold F. and HENRY, Kevin, Official (ISC)2 Guide to the CISSP CBK, 2007, page 180.

• Question 54:

  A prolonged complete loss of electric power is a:

  A. brownout
  B. blackout
  C. surge
  D. fault
  B. blackout

  ---

  A prolonged power outage is a blackout.

  From: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 3rd. Edition McGraw- Hill/Osborne, 2005, page 368.

• Question 55:

  Address Resolution Protocol (ARP) interrogates the network by sending out a?

  A. broadcast.
  B. multicast.
  C. unicast.
  D. semicast.
  A. broadcast.

  ---

  ARP interrogates the network by sending out a broadcast seeking a network node that has a specific IP address, and asks it to reply with its hardware address. A broadcast message is sent to everyone whether or not the message was requested. A traditional unicast is a "one-to-one" or "narrowcast" message. A multicast is a "one-to-many" message that is traditionally only sent to those machine that requested the information. Semicast is an imposter answer.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 87.

• Question 56:

  A code, as is pertains to cryptography:

  A. Is a generic term for encryption.
  B. Is specific to substitution ciphers.
  C. Deals with linguistic units.
  D. Is specific to transposition ciphers.
  C. Deals with linguistic units.

  ---

  Historically, a code refers to a cryptosystem that deals with linguistic units: words, phrases, sentences, and so forth. Codes are only useful for specialized circumstances where the message to transmit has an already defined equivalent ciphertext word.

  Source: DUPUIS, Cl?ment, CISSP Open Study Guide on domain 5, cryptography, April 1999.

• Question 57:

  Which of the following is best defined as a circumstance in which a collection of information items is required to be classified at a higher security level than any of the individual items that comprise it?

  A. Aggregation
  B. Inference
  C. Clustering
  D. Collision
  A. Aggregation

  ---

  The Internet Security Glossary (RFC2828) defines aggregation as a circumstance in which a collection of information items is required to be classified at a higher security level than any of the individual items that comprise it. Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

• Question 58:

  What ensures that the control mechanisms correctly implement the security policy for the entire life cycle of an information system?

  A. Accountability controls
  B. Mandatory access controls
  C. Assurance procedures
  D. Administrative controls
  C. Assurance procedures

  ---

  Controls provide accountability for individuals accessing information. Assurance procedures ensure that access control mechanisms correctly implement the security policy for the entire life cycle of an information system. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 2: Access control systems (page 33).

• Question 59:

  Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?

  A. 172.12.42.5
  B. 172.140.42.5
  C. 172.31.42.5
  D. 172.15.42.5
  C. 172.31.42.5

  ---

  This is a valid Class B reserved address. For Class B networks, the reserved addresses are 172.16.0.0 - 172.31.255.255.

  The private IP address ranges are defined within RFC 1918:

  RFC 1918 private ip address range

  

  The following answers are incorrect:

  172.12.42.5 Is incorrect because it is not a Class B reserved address.

  172.140.42.5 Is incorrect because it is not a Class B reserved address.

  172.15.42.5 Is incorrect because it is not a Class B reserved address.

• Question 60:

  What can be defined as an event that could cause harm to the information systems?

  A. A risk
  B. A threat
  C. A vulnerability
  D. A weakness
  B. A threat

  ---

  A threat is an event or activity that has the potential to cause harm to the information systems. A risk is the probability that a threat will materialize. A vulnerability, or weakness, is a lack of a safeguard, which may be exploited by a threat, causing harm to the information systems.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 1: Access Control Systems (page 32).