ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 661:

  Which of the following is NOT a correct notation for an IPv6 address?

  A. 2001:0db8:0:0:0:0:1428:57ab
  B. ABCD:EF01:2345:6789:ABCD:EF01:2345:6789
  C. ::1
  D. 2001:DB8::8:800::417A
  D. 2001:DB8::8:800::417A

  ---

  This is not a correct notation for an IPv6 address because the the "::" can only appear once in an address. The use of "::" is a shortcut notation that indicates one or more groups of 16 bits of zeros. ::1 is the loopback address using the special notation Reference: IP Version 6 Addressing Architecture http://tools.ietf.org/html/rfc4291#section-2.1

• Question 662:

  Remote Procedure Call (RPC) is a protocol that one program can use to request a service from a program located in another computer in a network. Within which OSI/ISO layer is RPC implemented?

  A. Session layer
  B. Transport layer
  C. Data link layer
  D. Network layer
  A. Session layer

  ---

  The Answer: Session layer, which establishes, maintains and manages sessions and synchronization of data flow. Session layer protocols control application-to-application communications, which is what an RPC call is.

  The following answers are incorrect:

  Transport layer: The Transport layer handles computer-to computer communications, rather than application-to-application communications like RPC.

  Data link Layer: The Data Link layer protocols can be divided into either Logical Link Control (LLC) or Media Access Control (MAC) sublayers. Protocols like SLIP, PPP, RARP and L2TP are at this layer. An application-to-application protocol

  like RPC would not be addressed at this layer.

  Network layer: The Network Layer is mostly concerned with routing and addressing of information, not application-to-application communication calls such as an RPC call. The following reference(s) were/was used to create this question:

  The Remote Procedure Call (RPC) protocol is implemented at the Session layer, which establishes, maintains and manages sessions as well as synchronization of the data flow.

  Source: Jason Robinett's CISSP Cram Sheet: domain2.

  Source: Shon Harris AIO v3 pg. 423

• Question 663:

  What prevents a process from accessing another process' data?

  A. Memory segmentation
  B. Process isolation
  C. The reference monitor
  D. Data hiding
  B. Process isolation

  ---

  Process isolation is where each process has its own distinct address space for its application code and data. In this way, it is possible to prevent each process from accessing another process' data. This prevents data leakage, or modification to the data while it is in memory. Memory segmentation is a virtual memory management mechanism. The reference monitor is an abstract machine that mediates all accesses to objects by subjects. Data hiding, also known as information hiding, is a mechanism that makes information available at one processing level is not available at another level.

  Source: HARE, Chris, Security Architecture and Models, Area 6 CISSP Open Study Guide, January 2002.

• Question 664:

  When a biometric system is used, which error type deals with the possibility of GRANTING access to impostors who should be REJECTED?

  A. Type I error
  B. Type II error
  C. Type III error
  D. Crossover error
  B. Type II error

  ---

  When the biometric system accepts impostors who should have been rejected , it is called a Type II error or False Acceptance Rate or False Accept Rate.

  Biometrics verifies an individual's identity by analyzing a unique personal attribute or behavior, which is one of the most effective and accurate methods of verifying identification.

  Biometrics is a very sophisticated technology; thus, it is much more expensive and complex than the other types of identity verification processes. A biometric system can make authentication decisions based on an individual's behavior, as in

  signature dynamics, but these can change over time and possibly be forged.

  Biometric systems that base authentication decisions on physical attributes (iris, retina, fingerprint) provide more accuracy, because physical attributes typically don't change much, absent some disfiguring injury, and are harder to

  impersonate. When a biometric system rejects an authorized individual, it is called a Type I error (False Rejection Rate (FRR) or False Reject Rate (FRR)).

  When the system accepts impostors who should be rejected, it is called a Type II error (False Acceptance Rate (FAR) or False Accept Rate (FAR)). Type II errors are the most dangerous and thus the most important to avoid.

  The goal is to obtain low numbers for each type of error, but When comparing different biometric systems, many different variables are used, but one of the most important metrics is the crossover error rate (CER).

  The accuracy of any biometric method is measured in terms of Failed Acceptance Rate (FAR) and Failed Rejection Rate (FRR). Both are expressed as percentages. The FAR is the rate at which attempts by unauthorized users are incorrectly

  accepted as valid. The FRR is just the opposite. It measures the rate at which authorized users are denied access.

  The relationship between FRR (Type I) and FAR (Type II) is depicted in the graphic below . As one rate increases, the other decreases. The Cross-over Error Rate (CER) is sometimes considered a good indicator of the overall accuracy of a

  biometric system. This is the point at which the FRR and the FAR have the same value. Solutions with a lower CER are typically more accurate.

  See graphic below from Biometria showing this relationship. The Cross-over Error Rate (CER) is also called the Equal Error Rate (EER), the two are synonymous.

  

  Cross Over Error Rate

  The other answers are incorrect:

  Type I error is also called as False Rejection Rate where a valid user is rejected by the system.

  Type III error : there is no such error type in biometric system.

  Crossover error rate stated in percentage , represents the point at which false rejection equals the false acceptance rate.

  Reference(s) used for this question:

  http://www.biometria.sk/en/principles-of-biometrics.html

  and

  Shon Harris, CISSP All In One (AIO), 6th Edition , Chapter 3, Access Control, Page 188-189

  and

  Tech Republic, Reduce Multi_Factor Authentication Cost

• Question 665:

  Which of the following is NOT a defined ISO basic task related to network management?

  A. Fault management
  B. Accounting resources
  C. Security management
  D. Communications management
  D. Communications management

  ---

  ISO has defined five basic tasks related to network management :

  Fault management: Detects the devices that present some kind of fault. Configuration management:

  Allows users to know, define and change remotely the configuration of any device. Accounting resources: Holds the records of the resource usage in the WAN. Performance management:

  Monitors usage levels and sets alarms when a threshold has been surpassed. Security management: Detects suspicious traffic or users and generates alarms accordingly. Source:

  Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 137).

• Question 666:

  Which of the following Kerberos components holds all users' and services' cryptographic keys?

  A. The Key Distribution Service
  B. The Authentication Service
  C. The Key Distribution Center
  D. The Key Granting Service
  C. The Key Distribution Center

  ---

  The Key Distribution Center (KDC) holds all users' and services' cryptographic keys. It provides authentication services, as well as key distribution functionality. The Authentication Service is the part of the KDC that authenticates a principal. The Key Distribution Service and Key Granting Service are distracters and are not defined Kerberos components.

  Source: WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#1 Access Control System and Methodology (page 3)

• Question 667:

  What is defined as the rules for communicating between computers on a Local Area Network (LAN)?

  A. LAN Media Access methods
  B. LAN topologies
  C. LAN transmission methods
  D. Contention Access Control
  A. LAN Media Access methods

  ---

  Media contention occurs when two or more network devices have data to send at the same time. Because multiple devices cannot talk on the network simultaneously, some type of method must be used to allow one device access to the network media at a time.

  This is done in two main ways: carrier sense multiple access collision detect (CSMA/CD) and token passing.

  In networks using CSMA/CD technology such as Ethernet, network devices contend for the network media. When a device has data to send, it first listens to see if any other device is currently using the network. If not, it starts sending its data. After finishing its transmission, it listens again to see if a collision occurred. A collision occurs when two devices send data simultaneously. When a collision happens, each device waits a random length of time before resending its data. In most cases, a collision will not occur again between the two devices. Because of this type of network contention, the busier a network becomes, the more collisions occur. This is why performance of Ethernet degrades rapidly as the number of devices on a single network increases.

  In token-passing networks such as Token Ring and FDDI, a special network frame called a token is passed around the network from device to device. When a device has data to send, it must wait until it has the token and then sends its data. When the data transmission is complete, the token is released so that other devices may use the network media. The main advantage of token-passing networks is that they are deterministic. In other words, it is easy to calculate the maximum time that will pass before a device has the opportunity to send data. This explains the popularity of token-passing networks in some real-time environments such as factories, where machinery must be capable of communicating at a determinable interval.

  For CSMA/CD networks, switches segment the network into multiple collision domains. This reduces the number of devices per network segment that must contend for the media. By creating smaller collision domains, the performance of a network can be increased significantly without requiring addressing changes.

  The following are incorrect answers:

  LAN topologies: Think of a topology as a network's virtual shape or structure. This shape does not necessarily correspond to the actual physical layout of the devices on the network. For example, the computers on a home LAN may be arranged in a circle in a family room, but it would be highly unlikely to find a ring topology there. Common topologies are: bus, ring, star or meshed. See THIS LINK for more information.

  LAN transmission methods: refer to the way packets are sent on the network and are either unicast, multicast or broadcast. See THIS LINK for more information. Contention Access Control: This is a bogus detractor.

  Contention is a real term but Contention Access Control is just made up. Contention methods is very closely related to Media Access Control methods. In communication networks, contention is a media access method that is used to share a broadcast medium. In contention, any computer in the network can transmit data at any time (first come-first served). This system breaks down when two computers attempt to transmit at the same time. This is a case of collision. To avoid collision, carrier sensing mechanism is used. Here each computer listens to the network before attempting to transmit. If the network is busy, it waits until network quiets down. In carrier detection, computers continue to listen to the network as they transmit. If computer detects another signal that interferes with the signal it is sending, it stops transmitting. Both computers then wait for random amount of time and attempt to transmit. Contention methods are most popular media access control method on LANs.

  Reference(s) used for this question:

  http://docwiki.cisco.com/wiki/Introduction_to_LAN_Protocols#LAN_Media-Access_Methods

  http://en.wikipedia.org/wiki/Contention_%28telecommunications%29

• Question 668:

  Which of the following would be MOST important to guarantee that the computer evidence will be admissible in court?

  A. It must prove a fact that is immaterial to the case.
  B. Its reliability must be proven.
  C. The process for producing it must be documented and repeatable.
  D. The chain of custody of the evidence must show who collected, secured, controlled, handled, transported the evidence, and that it was not tampered with.
  D. The chain of custody of the evidence must show who collected, secured, controlled, handled, transported the evidence, and that it was not tampered with.

  ---

  It has to be material, relevant and reliable, and the chain of custody must be maintained, it is unlikely that it will be admissible in court if it has been tampered with.

  The following answers are incorrect:

  It must prove a fact that is immaterial to the case. Is incorrect because evidence must be relevant.

  If it is immaterial then it is not relevant.

  Its reliability must be proven. Is incorrect because it is not the best answer. While evidence must be relevant if the chain of custody cannot be verified, then the evidence could lose it's credibility because there is no proof that the evidence was not tampered with. So, the correct answer above is the BEST answer. The process for producing it must be documented and repeatable. Is incorrect because just because the process is documented and repeatable does not mean that it will be the same. This amounts to Corroborative Evidence that may help to

  support a case.

• Question 669:

  Which cable technology refers to the CAT3 and CAT5 categories?

  A. Coaxial cables
  B. Fiber Optic cables
  C. Axial cables
  D. Twisted Pair cables
  D. Twisted Pair cables

  ---

  Twisted Pair cables currently have two categories in common usage. CAT3 and CAT5.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 72.

• Question 670:

  What is the 802.11 standard related to?

  A. Public Key Infrastructure (PKI)
  B. Wireless network communications
  C. Packet-switching technology
  D. The OSI/ISO model
  B. Wireless network communications

  ---

  The 802.11 standard outlines how wireless clients and APs communicate, lays out the specifications of their interfaces, dictates how signal transmission should take place, and describes how authentication, association, and security should

  be implemeted.

  The following answers are incorrect:

  Public Key Infrastructure (PKI) Public Key Infrastructure is a supporting infrastructure to manage public keys. It is not part of the IEEE 802 Working Group standard. Packet-switching technology A packet- switching technology is not included

  in the IEEE 802 Working Group standard. It is a technology where-in messages are broken up into packets, which then travel along different routes to the destination.

  The OSI/ISO model The Open System Interconnect model is a sevel-layer model defined as an international standard describing network communications.

  The following reference(s) were/was used to create this question:

  Source: Shon Harris - "All-in-One CISSP Exam Guide" Fourth Edition; Chapter 7 - Telecommunications and Network Security: pg. 624.

  802.11 refers to a family of specifications developed by the IEEE for Wireless LAN technology. 802.11 specifies an over-the-air interface between a wireless client and a base station or between two wireless clients. The IEEE accepted the specification in 1997. There are several specifications in the 802.11 family:

  802.11 # applies to wireless LANs and provides 1 or 2 Mbps transmission in the 2.4 GHz band using either frequency hopping spread spectrum (FHSS) or direct sequence spread spectrum (DSSS).

  802.11a # an extension to 802.11 that applies to wireless LANs and provides up to 54 Mbps in the 5GHz band. 802.11a uses an orthogonal frequency division multiplexing encoding scheme rather than FHSS or DSSS.

  802.11b (also referred to as 802.11 High Rate or Wi-Fi) # an extension to 802.11 that applies to wireless LANS and provides 11 Mbps transmission (with a fallback to 5.5, 2 and 1 Mbps) in the 2.4 GHz band. 802.11b uses only DSSS. 802.11b

  was a 1999 ratification to the original 802.11 standard, allowing wireless functionality comparable to Ethernet.

  802.11g # applies to wireless LANs and provides 20+ Mbps in the 2.4 GHz band.

  Source: 802.11 Planet's web site.