ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 61:

  Which of the following is NOT part of the Kerberos authentication protocol?

  A. Symmetric key cryptography
  B. Authentication service (AS)
  C. Principals
  D. Public Key
  D. Public Key

  ---

  There is no such component within kerberos environment. Kerberos uses only symmetric encryption and does not make use of any public key component.

  The other answers are incorrect because :

  Symmetric key cryptography is a part of Kerberos as the KDC holds all the users' and services' secret keys.

  Authentication service (AS) : KDC (Key Distribution Center) provides an authentication service

  Principals : Key Distribution Center provides services to principals , which can be users , applications or network services.

  References: Shon Harris , AIO v3 , Chapter - 4: Access Control , Pages : 152-155.

• Question 62:

  In addition to the accuracy of the biometric systems, there are other factors that must also be considered:

  A. These factors include the enrollment time and the throughput rate, but not acceptability.
  B. These factors do not include the enrollment time, the throughput rate, and acceptability.
  C. These factors include the enrollment time, the throughput rate, and acceptability.
  D. These factors include the enrollment time, but not the throughput rate, neither the acceptability.
  C. These factors include the enrollment time, the throughput rate, and acceptability.

  ---

  In addition to the accuracy of the biometric systems, there are other factors that must also be considered.

  These factors include the enrollment time, the throughput rate, and acceptability.

  Enrollment time is the time it takes to initially "register" with a system by providing samples of the biometric characteristic to be evaluated. An acceptable enrollment time is around two minutes.

  For example, in fingerprint systems, the actual fingerprint is stored and requires approximately 250kb per finger for a high quality image. This level of information is required for one-to-many searches in forensics applications on very large

  databases.

  In finger-scan technology, a full fingerprint is not stored-the features extracted from this fingerprint are stored using a small template that requires approximately 500 to 1000 bytes of storage. The original fingerprint cannot be reconstructed

  from this template. Updates of the enrollment information may be required because some biometric characteristics, such as voice and signature, may change with time.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 37 and 38.

• Question 63:

  Which of the following LAN topologies offers the highest availability?

  A. Bus topology
  B. Tree topology
  C. Full mesh topology
  D. Partial mesh topology
  C. Full mesh topology

  ---

  In a full mesh topology, all network nodes are individually connected with each other, providing the highest availability. A partial mesh topology can sometimes be used to offer some redundancy.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 106).

• Question 64:

  What assesses potential loss that could be caused by a disaster?

  A. The Business Assessment (BA)
  B. The Business Impact Analysis (BIA)
  C. The Risk Assessment (RA)
  D. The Business Continuity Plan (BCP)
  B. The Business Impact Analysis (BIA)

  ---

  The Business Assessment is divided into two components. Risk Assessment (RA) and Business Impact Analysis (BIA). Risk Assessment is designed to evaluate existing exposures from the organization's environment, whereas the BIA

  assesses potential loss that could be caused by a disaster. The Business Continuity Plan's goal is to reduce the risk of financial loss by improving the ability to recover and restore operations efficiently and effectively.

  Source: BARNES, James C. and ROTHSTEIN, Philip J., A Guide to Business Continuity Planning, John Wiley and Sons, 2001 (page 57).

  And: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 8: Business Continuity Planning and Disaster Recovery Planning (page 276).

• Question 65:

  Which protocol is used to send email?

  A. File Transfer Protocol (FTP).
  B. Post Office Protocol (POP).
  C. Network File System (NFS).
  D. Simple Mail Transfer Protocol (SMTP).
  D. Simple Mail Transfer Protocol (SMTP).

  ---

  Simple Mail Transfer Protocol (SMTP) is a protocol for sending e-mail messages between servers. POP is a protocol used to retrieve e-mail from a mail server. NFS is a TCP/IP client/server application developed by Sun that enables different types of file systems to interoperate regardless of operating system or network architecture. FTP is the protocol that is used to facilitate file transfer between two machines.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 88.

• Question 66:

  Which of the following is NOT true of the Kerberos protocol?

  A. Only a single login is required per session.
  B. The initial authentication steps are done using public key algorithm.
  C. The KDC is aware of all systems in the network and is trusted by all of them
  D. It performs mutual authentication
  B. The initial authentication steps are done using public key algorithm.

  ---

  Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/ server applications by using secret-key cryptography. It has the following characteristics:

  It is secure: it never sends a password unless it is encrypted.

  Only a single login is required per session. Credentials defined at login are then passed between resources without the need for additional logins.

  The concept depends on a trusted third party a Key Distribution Center (KDC). The KDC is aware of all systems in the network and is trusted by all of them.

  It performs mutual authentication, where a client proves its identity to a server and a server proves its identity to the client.

  Kerberos introduces the concept of a Ticket-Granting Server/Service (TGS). A client that wishes to use a service has to receive a ticket from the TGS a ticket is a time-limited cryptographic message giving it access to the server. Kerberos

  also requires an Authentication Server (AS) to verify clients. The two servers combined make up a KDC.

  Within the Windows environment, Active Directory performs the functions of the KDC. The following figure shows the sequence of events required for a client to gain access to a service using Kerberos authentication. Each step is shown with

  the Kerberos message associated with it, as defined in RFC 4120 "The Kerberos Network Authorization Service (V5)".

  

  Kerberos Authentication Step by Step

  Step 1: The user logs on to the workstation and requests service on the host. The workstation sends a message to the Authorization Server requesting a ticket granting ticket (TGT). Step 2: The Authorization Server verifies the user's access

  rights in the user database and creates a TGT and session key. The Authorization Sever encrypts the results using a key derived from the user's password and sends a message back to the user workstation.

  The workstation prompts the user for a password and uses the password to decrypt the incoming message. When decryption succeeds, the user will be able to use the TGT to request a service ticket.

  Step 3: When the user wants access to a service, the workstation client application sends a request to the Ticket Granting Service containing the client name, realm name and a timestamp. The user proves his identity by sending an

  authenticator encrypted with the session key received in Step 2.

  Step 4: The TGS decrypts the ticket and authenticator, verifies the request, and creates a ticket for the requested server. The ticket contains the client name and optionally the client IP address. It also contains the realm name and ticket

  lifespan. The TGS returns the ticket to the user workstation. The returned message contains two copies of a server session key one encrypted with the client password, and one encrypted by the service password.

  Step 5: The client application now sends a service request to the server containing the ticket received in Step 4 and an authenticator. The service authenticates the request by decrypting the session key. The server verifies that the ticket and

  authenticator match, and then grants access to the service. This step as described does not include the authorization performed by the Intel AMT device, as described later.

  Step 6: If mutual authentication is required, then the server will reply with a server authentication message.

  The Kerberos server knows "secrets" (encrypted passwords) for all clients and servers under its control, or it is in contact with other secure servers that have this information. These "secrets" are used to encrypt all of the messages shown in

  the figure above. To prevent "replay attacks," Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in synch as much as possible. In other words, both

  computers need to be set to the same time and date. Since the clocks of two computers are often out of synch, administrators can establish a policy to establish the maximum acceptable difference to Kerberos between a client's clock and

  server's clock. If the difference between a client's clock and the server's clock is less than the maximum time difference specified in this policy, any timestamp used in a session between the two computers will be considered authentic. The

  maximum difference is usually set to five minutes.

  Note that if a client application wishes to use a service that is "Kerberized" (the service is configured to perform Kerberos authentication), the client must also be Kerberized so that it expects to support the necessary message responses.

  For more information about Kerberos, see http://web.mit.edu/kerberos/www/.

  References: Introduction to Kerberos Authentication from Intel and http://www.zeroshell.net/eng/kerberos/Kerberos-definitions/#1.3.5.3 and http://www.ietf.org/rfc/rfc4120.txt

• Question 67:

  Whose role is it to assign classification level to information?

  A. Security Administrator
  B. User
  C. Owner
  D. Auditor
  C. Owner

  ---

  The Data/Information Owner is ultimately responsible for the protection of the data. It is the Data/ Information Owner that decides upon the classifications of that data they are responsible for.

  The data owner decides upon the classification of the data he is responsible for and alters that classification if the business need arises.

  The following answers are incorrect:

  Security Administrator. Is incorrect because this individual is responsible for ensuring that the access right granted are correct and support the polices and directives that the Data/Information Owner defines.

  User. Is Incorrect because the user uses/access the data according to how the Data/Information Owner defined their access.

  Auditor. Is incorrect because the Auditor is responsible for ensuring that the access levels are appropriate. The Auditor would verify that the Owner classified the data properly.

  References:

  CISSP All In One Third Edition, Shon Harris, Page 121

• Question 68:

  Which of the following protocols suite does the Internet use?

  A. IP/UDP/TCP
  B. IP/UDP/ICMP/TCP
  C. TCP/IP
  D. IMAP/SMTP/POP3
  C. TCP/IP

  ---

  Transmission Control Protocol/Internet Protocol (TCP/IP) is the common name for the suite of protocols that was developed by the Department of Defense (DoD) in the 1970's to support the construction of the internet. The Internet is based

  on TCP/IP.

  The Internet protocol suite is the networking model and a set of communications protocols used for the Internet and similar networks. It is commonly known as TCP/IP, because its most important protocols, the Transmission Control Protocol

  (TCP) and the Internet Protocol (IP), were the first networking protocols defined in this standard. It is occasionally known as the DoD model, because the development of the networking model was funded by DARPA, an agency of the United

  States Department of Defense.

  TCP/IP provides end-to-end connectivity specifying how data should be formatted, addressed, transmitted, routed and received at the destination. This functionality has been organized into four abstraction layers within the DoD Model which

  are used to sort all related protocols according to the scope of networking involved.

  From lowest to highest, the layers are:

  The link layer, containing communication technologies for a single network segment (link),

  The internet layer, connecting independent networks, thus establishing internetworking,

  The transport layer handling process-to-process communication,

  The application layer, which interfaces to the user and provides support services.

  The TCP/IP model and related protocols are maintained by the Internet Engineering Task Force (IETF).

  The following answers are incorrect:

  IP/UDP/TCP. This is incorrect, all three are popular protocol and they are not considered a suite of protocols.

  IP/UDP/ICMP/TCP. This is incorrect, all 4 are some of the MOST commonly used protocol but they are not called a suite of protocol.

  IMAP/SMTP/POP3 . This is incorrect because they are all email protocol and consist of only a few of the protocol that would be included in the TCP/IP suite of protocol.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 5267-5268). Auerbach Publications. Kindle Edition.

  http://en.wikipedia.org/wiki/Internet_protocol_suite

• Question 69:

  Which of the following answers is described as a random value used in cryptographic algorithms to ensure that patterns are not created during the encryption process?

  A. IV - Initialization Vector
  B. Stream Cipher
  C. OTP - One Time Pad
  D. Ciphertext
  A. IV - Initialization Vector

  ---

  The basic power in cryptography is randomness. This uncertainty is why encrypted data is unusable to someone without the key to decrypt.

  Initialization Vectors are a used with encryption keys to add an extra layer of randomness to encrypted data. If no IV is used the attacker can possibly break the keyspace because of patterns resulting in the encryption process.

  Implementation such as DES in Code Book Mode (CBC) would allow frequency analysis attack to take place.

  In cryptography, an initialization vector (IV) or starting variable (SV)is a fixed-size input to a cryptographic primitive that is typically required to be random or pseudorandom. Randomization is crucial for encryption schemes to achieve semantic

  security, a property whereby repeated usage of the scheme under the same key does not allow an attacker to infer relationships between segments of the encrypted message. For block ciphers, the use of an IV is described by so-called

  modes of operation. Randomization is also required for other primitives, such as universal hash functions and message authentication codes based thereon.

  It is define by TechTarget as:

  An initialization vector (IV) is an arbitrary number that can be used along with a secret key for data encryption. This number, also called a nonce, is employed only one time in any session.

  The use of an IV prevents repetition in data encryption, making it more difficult for a hacker using a dictionary attack to find patterns and break a cipher. For example, a sequence might appear twice or more within the body of a message. If

  there are repeated sequences in encrypted data, an attacker could assume that the corresponding sequences in the message were also identical. The IV prevents the appearance of corresponding duplicate character sequences in the

  ciphertext.

  The following answers are incorrect:

  -

  Stream Cipher: This isn't correct. A stream cipher is a symmetric key cipher where plaintext digits are combined with pseudorandom key stream to product cipher text.

  -

  OTP - One Time Pad: This isn't correct but OTP is made up of random values used as key material. (Encryption key) It is considered by most to be unbreakable but must be changed with a new key after it is used which makes it impractical for common use.

  -

  Ciphertext: Sorry, incorrect answer. Ciphertext is basically text that has been encrypted with key material (Encryption key) The following reference(s) was used to create this question: For more details on this TOPIC and other

• Question 70:

  Which division of the Orange Book deals with discretionary protection (need-to-know)?

  A. D
  B. C
  C. B
  D. A
  B. C

  ---

  C deals with discretionary protection. See matric below:

  

  TCSEC Matric

  The following are incorrect answers:

  D is incorrect. D deals with minimal security.

  B is incorrect. B deals with mandatory protection.

  A is incorrect. A deals with verified protection.

  Reference(s) used for this question:

  CBK, p. 329 330

  and

  Shon Harris, CISSP All In One (AIO), 6th Edition , page 392-393