ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 591:

  Why should batch files and scripts be stored in a protected area?

  A. Because of the least privilege concept.
  B. Because they cannot be accessed by operators.
  C. Because they may contain credentials.
  D. Because of the need-to-know concept.
  C. Because they may contain credentials.

  ---

  Because scripts contain credentials, they must be stored in a protected area and the transmission of the scripts must be dealt with carefully. Operators might need access to batch files and scripts. The least privilege concept requires that each subject in a system be granted the most restrictive set of privileges needed for the performance of authorized tasks. The need-to-know principle requires a user having necessity for access to, knowledge of, or possession of specific information required to perform official tasks or services.

  Source: WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#1 Access Control System and Methodology (page 3)

• Question 592:

  What is the name for a substitution cipher that shifts the alphabet by 13 places?

  A. Caesar cipher
  B. Polyalphabetic cipher
  C. ROT13 cipher
  D. Transposition cipher
  C. ROT13 cipher

  ---

  An extremely simple example of conventional cryptography is a substitution cipher.

  A substitution cipher substitutes one piece of information for another. This is most frequently done by offsetting letters of the alphabet. Two examples are Captain Midnight's Secret Decoder Ring, which you may have owned when you were a kid, and Julius Caesar's cipher. In both cases, the algorithm is to offset the alphabet and the key is the number of characters to offset it. So the offset could be one, two, or any number you wish. ROT-13 is an example where it is shifted 13 spaces. The Ceaser Cipher is another example where it is shifted 3 letters to the left.

  ROT13 ("rotate by 13 places", sometimes hyphenated ROT-13) is a simple letter substitution cipher that replaces a letter with the letter 13 letters after it in the alphabet. ROT13 is an example of the Caesar cipher, developed in ancient Rome.

  In the basic Latin alphabet, ROT13 is its own inverse; that is, to undo ROT13, the same algorithm is applied, so the same action can be used for encoding and decoding. The algorithm provides virtually no cryptographic security, and is often cited as a canonical example of weak encryption.

  ROT13 is used in online forums as a means of hiding spoilers, puzzle solutions, and offensive materials from the casual glance. ROT13 has been described as the "Usenet equivalent of a magazine printing the answer to a quiz upside down". ROT13 has inspired a variety of letter and word games on-line, and is frequently mentioned in newsgroup conversations. See diagram Below:

  

  Rot 13 Cipher

  The following are incorrect:

  The Caesar cipher is a simple substitution cipher that involves shifting the alphabet three positions to the right. In cryptography, a Caesar cipher, also known as Caesar's cipher, the shift cipher, Caesar's code or Caesar shift, is one of the simplest and most widely known encryption techniques. It is a type of substitution cipher in which each letter in the plaintext is replaced by a letter some fixed number of positions down the alphabet. For example, with a left shift of 3, D would be replaced by A, E would become B, and so on. The method is named after Julius Caesar, who used it in his private correspondence.

  

  Caesar Cipher Polyalphabetic cipher refers to using multiple alphabets at a time. A polyalphabetic cipher is any cipher known example of a polyalphabetic cipher, though it is a simplified special case.

  

  Viginere Cipher

  Transposition cipher is a different type of cipher. In cryptography, a transposition cipher is a method of encryption by which the positions held by units of plaintext (which are commonly characters or groups of characters) are shifted according to a regular system, so that the ciphertext constitutes a permutation of the plaintext. That is, the order of the units is changed. See the reference below for multiple examples of Transpositio Ciphers.

  An exemple of Transposition cipher could be columnar transposition, the message is written out in rows of a fixed length, and then read out again column by column, and the columns are chosen in some scrambled order. Both the width of the rows and the permutation of the columns are usually defined by a keyword. For example, the word ZEBRAS is of length 6 (so the rows are of length 6), and the permutation is defined by the alphabetical order of the letters in the keyword. In this case, the order would be "6 3 2 4 1 5".

  In a regular columnar transposition cipher, any spare spaces are filled with nulls; in an irregular columnar transposition cipher, the spaces are left blank. Finally, the message is read off in columns, in the order specified by the keyword. For example, suppose we use the keyword ZEBRAS and the message WE ARE DISCOVERED. FLEE AT ONCE. In a regular columnar transposition, we write this into the grid as Follows:

  

  Transposition Cipher Providing five nulls (QKJEU) at the end. The ciphertext is then read off as: EVLNE ACDTK ESEAQ ROFOJ DEECU WIREE

  Reference(s) used for this question: http://en.wikipedia.org/wiki/ROT13 http://en.wikipedia.org/wiki/Caesar_cipher http://en.wikipedia.org/wiki/Polyalphabetic_cipher http://en.wikipedia.org/wiki/Transposition_cipher

• Question 593:

  Telnet and rlogin use which protocol?

  A. UDP.
  B. SNMP.
  C. TCP.
  D. IGP.
  C. TCP.

  ---

  TCP allows for reliabilty in connections which would be required for terminal emulation.

  The following answers are incorrect:

  UDP. Is incorrect because with User Datagram Protocol (UDP) you don't have a reliable transmission, datagrams could arrive out of sequence.

  SNMP. Is incorrect because it is a network management protocol, Simple Network Management Protocol (SNMP).

  IGP. Is incorrect because Interior Gateway Protocol (IGP) is used interally on a network.

• Question 594:

  Who of the following is responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of IT systems and data?

  A. Business and functional managers
  B. IT Security practitioners
  C. System and information owners
  D. Chief information officer
  C. System and information owners

  ---

  The system and information owners are responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of the IT systems and data they own. IT security practitioners are responsible for proper implementation of security requirements in their IT systems.

  Source: STONEBURNER, Gary et al., NIST Special publication 800-30, Risk management Guide for Information Technology Systems, 2001 (page 6).

• Question 595:

  Which of the following is biggest factor that makes Computer Crimes possible?

  A. The fraudster obtaining advanced training and special knowledge.
  B. Victim carelessness.
  C. Collusion with others in information processing.
  D. System design flaws.
  B. Victim carelessness.

  ---

  The biggest factor that makes Computer Crimes possible is Victim Carelessness. Awareness and education can reduce the chance of someone becomming a victim.

  The types and frequency of Computer Crimes are increasing at a rapid rate. Computer Crime was once mainly the result of insiders or disgruntled employees. Now just about everybody has access to the internet, professional criminals are

  taking advantage of this.

  Specialized skills are no longer needed and a search on the internet can provide a fraudster with a plethora of tools that can be used to perpetuate fraud.

  All too often carelessness leads to someone being a victim. People often use simple passwords or write them down in plain sight where they can be found by fraudsters. People throwing away papers loaded with account numbers, social

  security numbers, or other types of non-public personal information. There are phishing e-mail attempts where the fraudster tries to redirect a potential victim to a bogus site that resembles a legitimate site in an attempt to get the users' login

  ID and password, or other credentials. There is also social engineering. Awareness and training can help reduce the chance of someone becoming a victim.

  The following answers are incorrect:

  The fraudster obtaining advanced training and special knowledge. Is incorrect because training and special knowledge is not required. There are many tools widely available to fraudsters.

  Collusion with others in information processing. Is incorrect because as more and more people use computers in their daily lives, it is no longer necessary to have someone on the inside be a party to fraud attempts.

  System design flaws. Is incorrect because while System design flaws are sometimes a factor in Computer Crimes more often then not it is victim carelessness that leads to Computer Crimes.

  References:

  OIG CBK Legal, Regulations, Compliance and Investigations (pages 695 - 697)

• Question 596:

  Another name for a VPN is a:

  A. tunnel
  B. one-time password
  C. pipeline
  D. bypass
  A. tunnel

  ---

  Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 597:

  Which of the following is defined as the most recent point in time to which data must be synchronized without adversely affecting the organization (financial or operational impacts)?

  A. Recovery Point Objective
  B. Recovery Time Objective
  C. Point of Time Objective
  D. Critical Time Objective
  A. Recovery Point Objective

  ---

  The recovery point objective (RPO) is the maximum acceptable level of data loss following an unplanned "event", like a disaster (natural or man-made), act of crime or terrorism, or any other business or technical disruption that could cause such data loss. The RPO represents the point in time, prior to such an event or incident, to which lost data can be recovered (given the most recent backup copy of the data).

  The recovery time objective (RTO) is a period of time within which business and / or technology capabilities must be restored following an unplanned event or disaster. The RTO is a function of the extent to which the interruption disrupts normal operations and the amount of revenue lost per unit of time as a result of the disaster.

  These factors in turn depend on the affected equipment and application(s). Both of these numbers represent key targets that are set by key businesses during business continuity and disaster recovery planning; these targets in turn drive the technology and implementation choices for business resumption services, backup / recovery / archival services, and recovery facilities and procedures.

  Many organizations put the cart before the horse in selecting and deploying technologies before understanding the business needs as expressed in RPO and RTO; IT departments later bear the brunt of user complaints that their service expectations are not being met. Defining the RPO and RTO can avoid that pitfall, and in doing so can also make for a compelling business case for recovery technology spending and staffing.

  For the CISSP candidate studying for the exam, there are no such objectives for "point of time," and "critical time." Those two answers are simply detracters. Reference: http://www.wikibon.org/Recovery_point_objective_/_recovery_time_objective_strategy

• Question 598:

  Which of the following are REGISTERED PORTS as defined by IANA ?

  A. Ports 128 to 255
  B. Ports 1024 to 49151
  C. Ports 1025 to 65535
  D. Ports 1024 to 32767
  B. Ports 1024 to 49151

  ---

  Ports 1024 to 49151 has been defined as REGISTERED PORTS by IANA.

  A registered port is a network port (a sub-address defined within the Internet Protocol, in the range 1- 65535) assigned by the Internet Assigned Numbers Authority (IANA) (or by Internet Corporation for Assigned Names and Numbers

  (ICANN) before March 21, 2001) for use with a certain protocol or application.

  Ports with numbers lower than those of the registered ports are called well known ports; ports with numbers greater than those of the registered ports are called dynamic and/or private ports.

  Ports 0-1023 - well known ports

  Ports 1024-49151 - Registered port: vendors use for applications

  Ports >49151 - dynamic / private ports

  The other answers are not correct

  Reference(s) used for this question:

  http://en.wikipedia.org/wiki/Registered_port

• Question 599:

  A public key algorithm that does both encryption and digital signature is which of the following?

  A. RSA
  B. DES
  C. IDEA
  D. Diffie-Hellman
  A. RSA

  ---

  RSA can be used for encryption, key exchange, and digital signatures.

  Key Exchange versus key Agreement

  KEY EXCHANGE

  Key exchange (also known as "key establishment") is any method in cryptography by which cryptographic keys are exchanged between users, allowing use of a cryptographic algorithm.

  If sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. The nature of the equipping they require depends on the encryption technique they might

  use. If they use a code, both will require a copy of the same codebook. If they use a cipher, they will need appropriate keys. If the cipher is a symmetric key cipher, both will need a copy of the same key. If an asymmetric key cipher with the

  public/private key property, both will need the other's public key.

  KEY AGREEMENT

  Diffie-Hellman is a key agreement algorithm used by two parties to agree on a shared secret. The Diffie Hellman (DH) key agreement algorithm describes a means for two parties to agree upon a shared secret over a public network in such a

  way that the secret will be unavailable to eavesdroppers. The DH algorithm converts the shared secret into an arbitrary amount of keying material. The resulting keying material is used as a symmetric encryption key.

  The other answers are not correct because:

  DES and IDEA are both symmetric algorithms.

  Diffie-Hellman is a common asymmetric algorithm, but is used only for key agreement. It is not typically used for data encryption and does not have digital signature capability.

  References:

  http://tools.ietf.org/html/rfc2631

  For Diffie-Hellman information: http://www.netip.com/articles/keith/diffie-helman.htm

• Question 600:

  Which of the following is NOT an asymmetric key algorithm?

  A. RSA
  B. Elliptic Curve Cryptosystem (ECC)
  C. El Gamal
  D. Data Encryption System (DES)
  D. Data Encryption System (DES)

  ---

  Data Encryption Standard (DES) is a symmetric key algorithm. Originally developed by IBM, under project name Lucifer, this 128-bit algorithm was accepted by the NIST in 1974, but the key size was reduced to 56 bits, plus 8 bits for parity. It somehow became a national cryptographic standard in 1977, and an American National Standard Institute (ANSI) standard in 1978. DES was later replaced by the Advanced Encryption Standard (AES) by the NIST. All other options are asymmetric algorithms.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  8: Cryptography (page 525).

  Reference: DES: http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf