ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 731:

  What can be defined as a batch process dumping backup data through communications lines to a server at an alternate location?

  A. Remote journaling
  B. Electronic vaulting
  C. Data clustering
  D. Database shadowing
  B. Electronic vaulting

  ---

  Electronic vaulting refers to the transfer of backup data to an off-site location. This is primarily a batch process of dumping backup data through communications lines to a server at an alternate location.

  Electronic vaulting is accomplished by backing up system data over a network. The backup location is usually at a separate geographical location known as the vault site. Vaulting can be used as a mirror or a backup mechanism using the standard incremental or differential backup cycle. Changes to the host system are sent to the vault server in real-time when the backup method is implemented as a mirror. If vaulting updates are recorded in real-time, then it will be necessary to perform regular backups at the off- site location to provide recovery services due to inadvertent or malicious alterations to user or system data.

  The following are incorrect answers:

  Remote journaling refers to the parallel processing of transactions to an alternate site (as opposed to a batch dump process). Journaling is a technique used by database management systems to provide redundancy for their transactions. When a transaction is completed, the database management system duplicates the journal entry at a remote location. The journal provides sufficient detail for the transaction to be replayed on the remote system. This provides for database recovery in the event that the database becomes corrupted or unavailable.

  Database shadowing uses the live processing of remote journaling, but creates even more redundancy by duplicating the database sets to multiple servers. There are also additional redundancy options available within application and database software platforms. For example, database shadowing may be used where a database management system updates records in multiple locations. This technique updates an entire copy of the database at a remote location.

  Data clustering refers to the classification of data into groups (clusters). Clustering may also be used, although it should not be confused with redundancy. In clustering, two or more "partners" are joined into the cluster and may all provide service at the same time. For example, in an activeactive pair, both systems may provide services at any time. In the case of a failure, the remaining partners may continue to provide service but at a decreased capacity.

  The following resource(s) were used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 20403-20407 and 20411-20414 and 20375-20377 and 20280- 20283). Auerbach Publications. Kindle Edition.

• Question 732:

  Which layer of the DoD TCP/IP model controls the communication flow between hosts?

  A. Internet layer
  B. Host-to-host transport layer
  C. Application layer
  D. Network access layer
  B. Host-to-host transport layer

  ---

  Whereas the host-to-host layer (equivalent to the OSI's transport layer) provides end-to-end data delivery service, flow control, to the application layer.

  The four layers in the DoD model, from top to bottom, are:

  The Application Layer contains protocols that implement user-level functions, such as mail delivery, file transfer and remote login.

  The Host-to-Host Layer handles connection rendez vous, flow control, retransmission of lost data, and other generic data flow management between hosts. The mutually exclusive TCP and UDP protocols are this layer's most important

  members.

  The Internet Layer is responsible for delivering data across a series of different physical networks that interconnect a source and destination machine. Routing protocols are most closely associated with this layer, as is the IP Protocol, the

  Internet's fundamental protocol.

  The Network Access Layer is responsible for delivering data over the particular hardware media in use. Different protocols are selected from this layer, depending on the type of physical network The OSI model organizes communication

  services into seven groups called layers. The layers are as follows:

  Layer 7, The Application Layer: The application layer serves as a window for users and application processes to access network services. It handles issues such as network transparency, resource allocation, etc. This layer is not an

  application in itself, although some applications may perform application layer functions.

  Layer 6, The Presentation Layer: The presentation layer serves as the data translator for a network. It is usually a part of an operating system and converts incoming and outgoing data from one presentation format to another. This layer is

  also known as syntax layer.

  Layer 5, The Session Layer: The session layer establishes a communication session between processes running on different communication entities in a network and can support a message- mode data transfer.

  It deals with session and connection coordination.

  Layer 4, The Transport Layer: The transport layer ensures that messages are delivered in the order in which they are sent and that there is no loss or duplication. It ensures complete data transfer. This layer provides an additional connection

  below the Session layer and assists with managing some data flow control between hosts. Data is divided into packets on the sending node, and the receiving node's Transport layer reassembles the message from packets. This layer is also

  responsible for error checking to guarantee error-free data delivery, and requests a retransmission if necessary. It is also responsible for sending acknowledgments of successful transmissions back to the sending host. A number of protocols

  run at the Transport layer, including TCP, UDP, Sequenced Packet Exchange (SPX), and NWLink. Layer 3, The Network Layer: The network layer controls the operation of the subnet. It determines the physical path that data takes on the

  basis of network conditions, priority of service, and other factors. The network layer is responsible for routing and forwarding data packets.

  Layer 2, The Data-Link Layer: The data-link layer is responsible for error free transfer of data frames. This layer provides synchronization for the physical layer. ARP and RARP would be found at this layer.

  Layer 1, The Physical Layer: The physical layer is responsible for packaging and transmitting data on the physical media. This layer conveys the bit stream through a network at the electrical and mechanical level.

  See a great flash animation on the subject at:

  http://www.maris.com/content/applets/flash/comp/fa0301.swf

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page

  85).

  Also: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 7:

  Telecommunications and Network Security (page 344).

• Question 733:

  What is the primary role of smartcards in a PKI?

  A. Transparent renewal of user keys
  B. Easy distribution of the certificates between the users
  C. Fast hardware encryption of the raw data
  D. Tamper resistant, mobile storage and application of private keys of the users
  D. Tamper resistant, mobile storage and application of private keys of the users

  ---

  Reference: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw- Hill/Osborne, page 139;

  SNYDER, J., What is a SMART CARD?.

  Wikipedia has a nice definition at: http://en.wikipedia.org/wiki/Tamper_resistance

  Security

  Tamper-resistant microprocessors are used to store and process private or sensitive information, such as private keys or electronic money credit. To prevent an attacker from retrieving or modifying the information, the chips are designed so

  that the information is not accessible through external means and can be accessed only by the embedded software, which should contain the appropriate security measures. Examples of tamper-resistant chips include all secure

  cryptoprocessors, such as the IBM 4758 and chips used in smartcards, as well as the Clipper chip.

  It has been argued that it is very difficult to make simple electronic devices secure against tampering, because numerous attacks are possible, including:

  physical attack of various forms (microprobing, drills, files, solvents, etc.)

  freezing the device

  applying out-of-spec voltages or power surges

  applying unusual clock signals

  inducing software errors using radiation

  measuring the precise time and power requirements of certain operations (see power analysis)

  Tamper-resistant chips may be designed to zeroise their sensitive data (especially cryptographic keys) if they detect penetration of their security encapsulation or out-of-specification environmental parameters. A chip may even be rated for

  "cold zeroisation", the ability to zeroise itself even after its power supply has been crippled.

  Nevertheless, the fact that an attacker may have the device in his possession for as long as he likes, and perhaps obtain numerous other samples for testing and practice, means that it is practically impossible to totally eliminate tampering by

  a sufficiently motivated opponent. Because of this, one of the most important elements in protecting a system is overall system design. In particular, tamper-resistant systems should "fail gracefully" by ensuring that compromise of one device does not compromise the entire system. In this manner, the attacker can be practically restricted to attacks that cost less than the expected return from compromising a single device (plus, perhaps, a little more for kudos). Since the most sophisticated attacks have been estimated to cost several hundred thousand dollars to carry out, carefully designed systems may be invulnerable in practice.

• Question 734:

  What is the Maximum Tolerable Downtime (MTD)?

  A. Maximum elapsed time required to complete recovery of application data
  B. Minimum elapsed time required to complete recovery of application data
  C. Maximum elapsed time required to move back to primary site after a major disruption
  D. It is maximum delay businesses can tolerate and still remain viable
  D. It is maximum delay businesses can tolerate and still remain viable

  ---

  The Maximum Tolerable Downtime (MTD) is the maximum length of time a BUSINESS FUNCTION can endure without being restored, beyond which the BUSINESS is no longer viable

  NIST SAYS:

  The ISCP Coordinator should analyze the supported mission/business processes and with the process owners, leadership and business managers determine the acceptable downtime if a given process or specific system data were disrupted

  or otherwise unavailable. Downtime can be identified in several ways.

  Maximum Tolerable Downtime (MTD). The MTD represents the total amount of time the system owner/ authorizing official is willing to accept for a mission/business process outage or disruption and includes all impact considerations.

  Determining MTD is important because it could leave contingency planners with imprecise direction on selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures,

  including their scope and content.

  Other BCP and DRP terms you must be familiar with are:

  Recovery Time Objective (RTO). RTO defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/ business processes, and the

  MTD. Determining the information system resource RTO is important for selecting appropriate technologies that are best suited for meeting the MTD. When it is not feasible to immediately meet the RTO and the MTD is inflexible, a Plan of

  Action and Milestone should be initiated to document the situation and plan for its mitigation.

  Recovery Point Objective (RPO). The RPO represents the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered (given the most recent backup copy of the data) after an outage. Unlike RTO, RPO is not considered as part of MTD. Rather, it is a factor of how much data loss the mission/business process can tolerate during the recovery process. Because the RTO must ensure that the MTD is not exceeded, the RTO must normally be shorter than the MTD. For example, a system outage may prevent a particular process from being completed, and because it takes time to reprocess the data, that additional processing time must be added to the RTO to stay within the time limit established by the MTD.

  References used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Page 276.

  and

  http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf

• Question 735:

  Within the context of the CBK, which of the following provides a MINIMUM level of security ACCEPTABLE for an environment ?

  A. A baseline
  B. A standard
  C. A procedure
  D. A guideline
  A. A baseline

  ---

  Baselines provide the minimum level of security necessary throughout the organization. Standards specify how hardware and software products should be used throughout the organization.

  Procedures are detailed step-by-step instruction on how to achieve certain tasks.

  Guidelines are recommendation actions and operational guides to personnel when a specific standard does not apply.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  3: Security Management Practices (page 94).

• Question 736:

  Which of the following items is NOT a benefit of cold sites?

  A. No resource contention with other organisation
  B. Quick Recovery
  C. A secondary location is available to reconstruct the environment
  D. Low Cost
  B. Quick Recovery

  ---

  A cold site is a permanent location that provide you with your own space that you can move into in case of a disaster or catastrophe. It is one of the cheapest solution available as a rental place but it is also the one that would take the most

  time to recover. A cold site usually takes one to two weeks for recoverey.

  Although major disruptions with long-term effects may be rare, they should be accounted for in the contingency plan. The plan should include a trategy to recover and perform system operations at an alternate facility for an extended period. In

  general, three types of alternate sites are available:

  Dedicated site owned or operated by the organization. Also called redundant or alternate sites;

  Reciprocal agreement or memorandum of agreement with an internal or external entity; and

  Commercially leased facility.

  Regardless of the type of alternate site chosen, the facility must be able to support system operations as defined in the contingency plan. The three alternate site types commonly categorized in terms of their operational readiness are cold

  sites, warm sites, or hot sites. Other variations or combinations of these can be found, but generally all variations retain similar core features found in one of these three site types.

  Progressing from basic to advanced, the sites are described below:

  Cold Sites are typically facilities with adequate space and infrastructure (electric power, telecommunications connections, and environmental controls) to support information system recovery activities.

  Warm Sites are partially equipped office spaces that contain some or all of the system hardware, software, telecommunications, and power sources.

  Hot Sites are facilities appropriately sized to support system requirements and configured with the necessary system hardware, supporting infrastructure, and support personnel.

  As discussed above, these three alternate site types are the most common. There are also variations, and hybrid mixtures of features from any one of the three. Each organization should evaluate its core requirements in order to establish the

  most effective solution.

  Two examples of variations to the site types are:

  Mobile Sites are self-contained, transportable shells custom-fitted with specific telecommunications and system equipment necessary to meet system requirements.

  Mirrored Sites are fully redundant facilities with automated real-time information mirroring. Mirrored sites are identical to the primary site in all technical respects.

  There are obvious cost and ready-time differences among the options. In these examples, the mirrored site is the most expensive choice, but it ensures virtually 100 percent availability. Cold sites are the least expensive to maintain, although

  they may require substantial time to acquire and install necessary equipment. Partially equipped sites, such as warm sites, fall in the middle of the spectrum. In many cases, mobile sites may be delivered to the desired location within 24

  hours, but the time necessary for equipment installation and setup can increase this response time. The selection of fixed-site locations should account for the time and mode of transportation necessary to move personnel and/or equipment

  there. In addition, the fixed site should be in a geographic area that is unlikely to be negatively affected by the same hazard as the organization's primary site.

  The following reference(s) were used for this question:

  http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf

• Question 737:

  Which of the following exemplifies proper separation of duties?

  A. Operators are not permitted modify the system time.
  B. Programmers are permitted to use the system console.
  C. Console operators are permitted to mount tapes and disks.
  D. Tape operators are permitted to use the system console.
  A. Operators are not permitted modify the system time.

  ---

  This is an example of Separation of Duties because operators are prevented from modifying the system time which could lead to fraud. Tasks of this nature should be performed by they system administrators.

  AIO defines Separation of Duties as a security principle that splits up a critical task among two or more individuals to ensure that one person cannot complete a risky task by himself.

  The following answers are incorrect:

  Programmers are permitted to use the system console. Is incorrect because programmers should not be permitted to use the system console, this task should be performed by operators. Allowing programmers access to the system console

  could allow fraud to occur so this is not an example of Separation of Duties..

  Console operators are permitted to mount tapes and disks. Is incorrect because operators should be able to mount tapes and disks so this is not an example of Separation of Duties.

  Tape operators are permitted to use the system console. Is incorrect because operators should be able to use the system console so this is not an example of Separation of Duties.

  References:

  OIG CBK Access Control (page 98 - 101)

  AIOv3 Access Control (page 182)

• Question 738:

  What is malware that can spread itself over open network connections?

  A. Worm
  B. Rootkit
  C. Adware
  D. Logic Bomb
  A. Worm

  ---

  Computer worms are also known as Network Mobile Code, or a virus-like bit of code that can replicate itself over a network, infecting adjacent computers. A computer worm is a standalone malware computer program that replicates itself in

  order to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Unlike a computer virus, it does not need to attach itself to an existing program. Worms

  almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

  A notable example is the SQL Slammer computer worm that spread globally in ten minutes on January 25, 2003. I myself came to work that day as a software tester and found all my SQL servers infected and actively trying to infect other

  computers on the test network. A patch had been released a year prior by Microsoft and if systems were not patched and exposed to a 376 byte UDP packet from an infected host then system would become compromised.

  Ordinarily, infected computers are not to be trusted and must be rebuilt from scratch but the vulnerability could be mitigated by replacing a single vulnerable dll called sqlsort.dll. Replacing that with the patched version completely disabled the

  worm which really illustrates to us the importance of actively patching our systems against such network mobile code.

  The following answers are incorrect:

  -

  Rootkit: Sorry, this isn't correct because a rootkit isn't ordinarily classified as network mobile code like a worm is. This isn't to say that a rootkit couldn't be included in a worm, just that a rootkit isn't usually classified like a worm. A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer. The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool). The term "rootkit" has negative connotations through its association with malware.

  -

  Adware: Incorrect answer. Sorry but adware isn't usually classified as a worm. Adware, or advertising- supported software, is any software package which automatically renders advertisements in order to generate revenue for its author. The advertisements may be in the user interface of the software or on a screen presented to the user during the installation process. The functions may be designed to analyze which Internet sites the user visits and to present advertising pertinent to the types of goods or services featured there. The term is sometimes used to refer to software that displays unwanted advertisements.

  -

  Logic Bomb: Logic bombs like adware or rootkits could be spread by worms if they exploit the right service and gain root or admin access on a computer. The following reference(s) was used to create this question: The CCCure CompTIA Holistic Security+ Tutorial and CBT and http://en.wikipedia.org/wiki/Rootkit and http://en.wikipedia.org/wiki/Computer_worm and http://en.wikipedia.org/wiki/Adware

• Question 739:

  Which of the following was developed in order to protect against fraud in electronic fund transfers (EFT) by ensuring the message comes from its claimed originator and that it has not been altered in transmission?

  A. Secure Electronic Transaction (SET)
  B. Message Authentication Code (MAC)
  C. Cyclic Redundancy Check (CRC)
  D. Secure Hash Standard (SHS)
  B. Message Authentication Code (MAC)

  ---

  In order to protect against fraud in electronic fund transfers (EFT), the Message Authentication Code (MAC), ANSI X9.9, was developed. The MAC is a check value, which is derived from the contents of the message itself, that is sensitive to

  the bit changes in a message. It is similar to a Cyclic Redundancy Check (CRC).

  The aim of message authentication in computer and communication systems is to verify that he message comes from its claimed originator and that it has not been altered in transmission. It is particularly needed for EFT Electronic Funds

  Transfer). The protection mechanism is generation of a Message Authentication Code (MAC), attached to the message, which can be recalculated by the receiver and will reveal any alteration in transit. One standard method is described in

  (ANSI, X9.9). Message authentication mechanisms an also be used to achieve non-repudiation of messages.

  The Secure Electronic Transaction (SET) was developed by a consortium including MasterCard and VISA as a means of preventing fraud from occurring during electronic payment.

  The Secure Hash Standard (SHS), NIST FIPS 180, available at http://www.itl.nist.gov/fipspubs/fip180- 1.htm, specifies the Secure Hash Algorithm (SHA-1).

  Source:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 4: Cryptography (page 170)

  also see:

  http://luizfirmino.blogspot.com/2011/04/message-authentication-code-mac.html and http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.22.2312andrep=rep1andtype=pdf

• Question 740:

  Related to information security, the prevention of the intentional or unintentional unauthorized disclosure of contents is which of the following?

  A. Confidentiality
  B. Integrity
  C. Availability
  D. capability
  A. Confidentiality

  ---

  Confidentiality is the prevention of the intentional or unintentional unauthorized disclosure of contents.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 60.