ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 611:

  Which type of control is concerned with restoring controls?

  A. Compensating controls
  B. Corrective controls
  C. Detective controls
  D. Preventive controls
  B. Corrective controls

  ---

  Corrective controls are concerned with remedying circumstances and restoring controls.

  Detective controls are concerned with investigating what happen after the fact such as logs and video surveillance tapes for example.

  Compensating controls are alternative controls, used to compensate weaknesses in other controls.

  Preventive controls are concerned with avoiding occurrences of risks.

  Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 612:

  Which of the following describes the major disadvantage of many Single Sign-On (SSO) implementations?

  A. Once an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.
  B. The initial logon process is cumbersome to discourage potential intruders.
  C. Once a user obtains access to the system through the initial log-on, they only need to logon to some applications.
  D. Once a user obtains access to the system through the initial log-on, he has to logout from all other systems
  A. Once an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.

  ---

  Single Sign-On is a distrubuted Access Control methodology where an individual only has to authenticate once and would have access to all primary and secondary network domains. The individual would not be required to re-authenticate

  when they needed additional resources. The security issue that this creates is if a fraudster is able to compromise those credential they too would have access to all the resources that account has access to.

  All the other answers are incorrect as they are distractors.

• Question 613:

  What can be defined as a value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity?

  A. A digital envelope
  B. A cryptographic hash
  C. A Message Authentication Code
  D. A digital signature
  D. A digital signature

  ---

  RFC 2828 (Internet Security Glossary) defines a digital signature as a value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity.

  The steps to create a Digital Signature are very simple:

  1.

  You create a Message Digest of the message you wish to send

  2.

  You encrypt the message digest using your Private Key which is the action of Signing

  3.

  You send the Message along with the Digital Signature to the recipient

  To validate the Digital Signature the recipient will make use of the sender Public Key. Here are the steps:

  1.

  The receiver will decrypt the Digital Signature using the sender Publick Key producing a clear text message digest.

  2.

  The receiver will produce his own message digest of the message received.

  3.

  At this point the receiver will compare the two message digest (the one sent and the one produce by the receiver), if the two matches, it proves the authenticity of the message and it confirms that the message was not modified in transit validating the integrity as well. Digital Signatures provides for Authenticity and Integrity only. There is no confidentiality in place, if you wish to get confidentiality it would be needed for the sender to encrypt everything with the receiver public key as a last step before sending the message.

  A Digital Envelope is a combination of encrypted data and its encryption key in an encrypted form that has been prepared for use of the recipient. In simple term it is a type of security that uses two layers of encryption to protect a message. First, the message itself is encoded using symmetric encryption, and then the key to decode the message is encrypted using public-key encryption. This technique overcomes one of the problems of public-key encryption, which is that it is slower than symmetric encryption. Because only the key is protected with public-key encryption, there is very little overhead. A cryptographic hash is the result of a cryptographic hash function such as MD5, SHA-1, or SHA-2. A hash value also called a Message Digest is like a fingerprint of a message. It is used to proves integrity and ensure the message was not changed either in transit or in storage.

  A Message Authentication Code (MAC) refers to an ANSI standard for a checksum that is computed with a keyed hash that is based on DES or it can also be produced without using DES by concataning the Secret Key at the end of the message (simply adding it at the end of the message) being sent and then producing a Message digest of the Message+Secret Key together. The MAC is then attached and sent along with the message but the Secret Key is NEVER sent in clear text over the network.

  In cryptography, HMAC (Hash-based Message Authentication Code), is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret key. As with any MAC, it may be used to simultaneously verify both the data integrity and the authenticity of a message. Any cryptographic hash function, such as MD5 or SHA-1, may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA1 accordingly. The cryptographic strength of the HMAC depends upon the cryptographic strength of the underlying hash function, the size of its hash output length in bits and on the size and quality of the cryptographic key.

  There is more than one type of MAC: Meet CBC-MAC In cryptography, a Cipher Block Chaining Message Authentication Code, abbreviated CBC- MAC, is a technique for constructing a message authentication code from a block cipher. The message is encrypted with some block cipher algorithm in CBC mode to create a chain of blocks such that each block depends on the proper encryption of the previous block. This interdependence ensures that a change to any of the plaintext bits will cause the final encrypted block to change in a way that cannot be predicted or counteracted without knowing the key to the block cipher.

  References:

  SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

  and http://www.webopedia.com/TERM/D/digital_envelope.html

  and

  http://en.wikipedia.org/wiki/CBC-MAC

• Question 614:

  Which of the following is an issue with signature-based intrusion detection systems?

  A. Only previously identified attack signatures are detected.
  B. Signature databases must be augmented with inferential elements.
  C. It runs only on the windows operating system
  D. Hackers can circumvent signature evaluations.
  A. Only previously identified attack signatures are detected.

  ---

  An issue with signature-based ID is that only attack signatures that are stored in their database are detected.

  New attacks without a signature would not be reported. They do require constant updates in order to maintain their effectiveness.

  Reference used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 49.

• Question 615:

  Each data packet is assigned the IP address of the sender and the IP address of the:

  A. recipient.
  B. host.
  C. node.
  D. network.
  A. recipient.

  ---

  Each data packet is assigned the IP address of the sender and the IP address of the recipient. The term network refers to the part of the IP address that identifies each network. The terms host and node refer to the parts of the IP address that identify a specific machine on a network.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 87.

• Question 616:

  A channel within a computer system or network that is designed for the authorized transfer of information is identified as a(n)?

  A. Covert channel
  B. Overt channel
  C. Opened channel
  D. Closed channel
  B. Overt channel

  ---

  An overt channel is a path within a computer system or network that is designed for the authorized transfer of data. The opposite would be a covert channel which is an unauthorized path.

  A covert channel is a way for an entity to receive information in an unauthorized manner. It is an information flow that is not controlled by a security mechanism. This type of information path was not developed for communication; thus, the

  system does not properly protect this path, because the developers never envisioned information being passed in this way. Receiving information in this manner clearly violates the system's security policy.

  All of the other choices are bogus detractors.

  Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 219.

  and

  Shon Harris, CISSP All In One (AIO), 6th Edition , page 380 and

  Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 378). McGraw-Hill.

  Kindle Edition.

• Question 617:

  Which of the following is the MOST important aspect relating to employee termination?

  A. The details of employee have been removed from active payroll files.
  B. Company property provided to the employee has been returned.
  C. User ID and passwords of the employee have been deleted.
  D. The appropriate company staff are notified about the termination.
  D. The appropriate company staff are notified about the termination.

  ---

  Even though Logical access to information by a terminated employee is possible if the ID and password of the terminated employee has not been deleted this is only one part of the termination procedures. If user ID is not disabled or deleted, it could be possible for the employee without physical access to visit the companies networks remotely and gain access to the information.

  Please note that this can also be seen in a different way: the most important thing to do could also be to inform others of the person's termination, because even if user ID's and passwords are deleted, a terminated individual could simply socially engineer their way back in by calling an individual he/she used to work with and ask them for access. He could intrude on the facility or use other weaknesses to gain access to information after he has been terminated.

  By notifying the appropriate company staff about the termination, they would in turn intitiate account termination, ask the employee to return company property, and all credentials would be withdrawn for the individual concerned. This answer is more complete than simply disabling account.

  It seems harsh and cold when this actually takes place , but too many companies have been hurt by vengeful employees who have lashed out at the company when their positions were revoked for one reason or another. If an employee is disgruntled in any way, or the termination is unfriendly, that employee's accounts should be disabled right away, and all passwords on all systems changed.

  For your exam you should know the information below: Employee Termination Processes

  Employees join and leave organizations every day. The reasons vary widely, due to retirement,reduction in force, layoffs, termination with or without cause, relocation to another city, careeropportunities with other employers, or involuntary transfers. Terminations may be friendly or unfriendly and will need different levels of care as a result.

  Friendly Terminations

  Regular termination is when there is little or no evidence or reason to believe that the termination is not agreeable to both the company and the employee. A standard set of procedures, typically maintained by the human resources department, governs the dismissal of the terminated employee to ensure that company property is returned, and all access is removed. These procedures may include exit interviews and return of keys, identification cards, badges, tokens, and cryptographic keys. Other property, such as laptops, cable locks, credit cards, and phone cards, are also collected. The user manager notifies the security department of the termination to ensure that access is revoked for all platforms and facilities. Some facilities choose to immediately delete the accounts, while others choose to disable the accounts for a policy defined period, for example, 30 days, to account for changes or extensions in the final termination date. The termination process should include a conversation with the departing associate about their continued responsibility for confidentiality of information.

  Unfriendly Terminations

  Unfriendly terminations may occur when the individual is fired, involuntarily transferred, laid off,or when the organization has reason to believe that the individual has the means and intention to potentially cause harm to the system. Individuals with technical skills and higher levels of access, such as the systems administrators, computer programmers, database administrators, or any individual with elevated privileges, may present higher risk to the environment. These individuals could alter files, plant logic bombs to create system file damage at a future date, or remove sensitive information. Other disgruntled users could enter erroneous data into the system that may not be discovered for several months. In these situations, immediate termination of systems access is warranted at the time of termination or prior to notifying the employee of the termination. Managing the people aspect of security, from pre-employment to postemployment, is critical to ensure that trustworthy, competent resources are employed to further the business objectives that will protect company information. Each of these actions contributes to preventive, detective, or corrective personnel controls. The following answers are incorrect:

  The other options are less important.

  Following reference(s) were/was used to create this question:

  CISA review manual 2014 Page number 99

  Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 129). McGraw-Hill. Kindle Edition.

• Question 618:

  What does the directive of the European Union on Electronic Signatures deal with?

  A. Encryption of classified data
  B. Encryption of secret data
  C. Non repudiation
  D. Authentication of web servers
  C. Non repudiation

  ---

  Reference: FORD, Warwick and BAUM, Michael S., Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption (2nd Edition), 2000, Prentice Hall PTR, Page 589; Directive 1999/93/ EC of 13 December 1999 on a Community framework for electronic signatures.

• Question 619:

  Which of the following is the most reliable authentication method for remote access?

  A. Variable callback system
  B. Synchronous token
  C. Fixed callback system
  D. Combination of callback and caller ID
  B. Synchronous token

  ---

  A Synchronous token generates a one-time password that is only valid for a short period of time. Once the password is used it is no longer valid, and it expires if not entered in the acceptable time frame.

  The following answers are incorrect:

  Variable callback system. Although variable callback systems are more flexible than fixed callback systems, the system assumes the identity of the individual unless two-factor authentication is also implemented. By itself, this method might

  allow an attacker access as a trusted user.

  Fixed callback system. Authentication provides assurance that someone or something is who or what he/it is supposed to be. Callback systems authenticate a person, but anyone can pretend to be that person. They are tied to a specific place

  and phone number, which can be spoofed by implementing call- forwarding.

  Combination of callback and Caller ID. The caller ID and callback functionality provides greater confidence and auditability of the caller's identity. By disconnecting and calling back only authorized phone numbers, the system has a greater

  confidence in the location of the call. However, unless combined with strong authentication, any individual at the location could obtain access.

  The following reference(s) were/was used to create this question:

  Shon Harris AIO v3 p. 140, 548

  ISC2 OIG 2007 p. 152-153, 126-127

• Question 620:

  Who can best decide what are the adequate technical security controls in a computer-based application system in regards to the protection of the data being used, the criticality of the data, and it's sensitivity level ?

  A. System Auditor
  B. Data or Information Owner
  C. System Manager
  D. Data or Information user
  B. Data or Information Owner

  ---

  The data or information owner also referred to as "Data Owner" would be the best person. That is the individual or officer who is ultimately responsible for the protection of the information and can therefore decide what are the adequate

  security controls according to the data sensitivity and data criticality. The auditor would be the best person to determine the adequacy of controls and whether or not they are working as expected by the owner.

  The function of the auditor is to come around periodically and make sure you are doing what you are supposed to be doing. They ensure the correct controls are in place and are being maintained securely. The goal of the auditor is to make

  sure the organization complies with its own policies and the applicable laws and regulations.

  Organizations can have internal auditors and/ or external auditors. The external auditors commonly work on behalf of a regulatory body to make sure compliance is being met. For example CobiT, which is a model that most information

  security auditors follow when evaluating a security program. While many security professionals fear and dread auditors, they can be valuable tools in ensuring the overall security of the organization. Their goal is to find the things you have

  missed and help you understand how to fix the problem.

  The Official ISC2 Guide (OIG) says:

  IT auditors determine whether users, owners, custodians, systems, and networks are in compliance with the security policies, procedures, standards, baselines, designs, architectures, management direction, and other requirements placed on

  systems. The auditors provide independent assurance to the management on the appropriateness of the security controls. The auditor examines the information systems and determines whether they are designed, configured, implemented,

  operated, and managed in a way ensuring that the organizational objectives are being achieved. The auditors provide top company management with an independent view of the controls and their effectiveness.

  Example:

  Bob is the head of payroll. He is therefore the individual with primary responsibility over the payroll database, and is therefore the information/data owner of the payroll database. In Bob's department, he has Sally and Richard working for him.

  Sally is responsible for making changes to the payroll database, for example if someone is hired or gets a raise. Richard is only responsible for printing paychecks. Given those roles, Sally requires both read and write access to the payroll

  database, but Richard requires only read access to it. Bob communicates these requirements to the system administrators (the "information/ data custodians") and they set the file permissions for Sally's and Richard's user accounts so that

  Sally has read/write access, while Richard has only read access.

  So in short Bob will determine what controls are required, what is the sensitivily and criticality of the Data. Bob will communicate this to the custodians who will implement the requirements on the systems/DB. The auditor would assess if the

  controls are in fact providing the level of security the Data Owner expects within the systems/DB. The auditor does not determine the sensitivity of the data or the crititicality of the data.

  The other answers are not correct because:

  A "system auditor" is never responsible for anything but auditing... not actually making control decisions but the auditor would be the best person to determine the adequacy of controls and then make recommendations.

  A "system manager" is really just another name for a system administrator, which is actually an information custodian as explained above.

  A "Data or information user" is responsible for implementing security controls on a day-to-day basis as they utilize the information, but not for determining what the controls should be or if they are adequate.

  References:

  Official ISC2 Guide to the CISSP CBK, Third Edition , Page 477

  Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :

  Information Security Governance and Risk Management ((ISC)2 Press) (Kindle Locations 294- 298).

  Auerbach Publications. Kindle Edition.

  Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 3108- 3114).

  Information Security Glossary

  Responsibility for use of information resources