ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 741:

  What is one disadvantage of content-dependent protection of information?

  A. It increases processing overhead.
  B. It requires additional password entry.
  C. It exposes the system to data locking.
  D. It limits the user's individual address space.
  A. It increases processing overhead.

  ---

  Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 742:

  Which of the following Intrusion Detection Systems (IDS) uses a database of attacks, known system vulnerabilities, monitoring current attempts to exploit those vulnerabilities, and then triggers an alarm if an attempt is found?

  A. Knowledge-Based ID System
  B. Application-Based ID System
  C. Host-Based ID System
  D. Network-Based ID System
  A. Knowledge-Based ID System

  ---

  Knowledge-based Intrusion Detection Systems use a database of previous attacks and known system vulnerabilities to look for current attempts to exploit their vulnerabilities, and trigger an alarm if an attempt is found.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 87.

  Application-Based ID System - "a subset of HIDS that analyze what's going on in an application using the transaction log files of the application." Source: Official ISC2 CISSP CBK Review Seminar Student Manual Version 7.0 p. 87

  Host-Based ID System - "an implementation of IDS capabilities at the host level. Its most significant difference from NIDS is intrusion detection analysis, and related processes are limited to the boundaries of the host." Source: Official ISC2

  Guide to the CISSP CBK - p. 197

  Network-Based ID System - "a network device, or dedicated system attached to teh network, that monitors traffic traversing teh network segment for which it is integrated." Source: Official ISC2 Guide to the CISSP CBK - p. 196

• Question 743:

  Which one of the following statements about the advantages and disadvantages of network-based Intrusion detection systems is true

  A. Network-based IDSs are not vulnerable to attacks.
  B. Network-based IDSs are well suited for modern switch-based networks.
  C. Most network-based IDSs can automatically indicate whether or not an attack was successful.
  D. The deployment of network-based IDSs has little impact upon an existing network.
  D. The deployment of network-based IDSs has little impact upon an existing network.

  ---

  Network-based IDSs are usually passive devices that listen on a network wire without interfering with the normal operation of a network. Thus, it is usually easy to retrofit a network to include network-based IDSs with minimal effort.

  Network-based IDSs are not vulnerable to attacks is not true, even thou network-based IDSs can be made very secure against attack and even made invisible to many attackers they still have to read the packets and sometimes a well crafted packet might exploit or kill your capture engine. Network-based IDSs are well suited for modern switch-based networks is not true as most switches do not provide universal monitoring ports and this limits the monitoring range of a network-based IDS sensor to a single host. Even when

  switches provide such monitoring ports, often the single port cannot mirror all traffic traversing the switch.

  Most network-based IDSs can automatically indicate whether or not an attack was successful is not true as most network-based IDSs cannot tell whether or not an attack was successful; they can only discern that an attack was initiated. This means that after a network-based IDS detects an attack, administrators must manually investigate each attacked host to determine whether it was indeed penetrated. Reference: NIST special publication 800-31 Intrusion Detection System pages 15-16 Official guide to the CISSP CBK. Pages 196 to 197

• Question 744:

  What is the greatest danger from DHCP?

  A. An intruder on the network impersonating a DHCP server and thereby misconfiguring the DHCP clients.
  B. Having multiple clients on the same LAN having the same IP address.
  C. Having the wrong router used as the default gateway.
  D. Having the organization's mail server unreachable.
  A. An intruder on the network impersonating a DHCP server and thereby misconfiguring the DHCP clients.

  ---

  The greatest danger from BootP or DHCP (Dynamic Host Control Protocol) is from an intruder on the network impersonating a DHCP server and thereby misconfiguring the DHCP clients. Other choices are possible consequences of DHCP

  impersonation. Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 4:

  Sockets and Services from a Security Viewpoint.

• Question 745:

  Ensuring least privilege does not require:

  A. Identifying what the user's job is.
  B. Ensuring that the user alone does not have sufficient rights to subvert an important process.
  C. Determining the minimum set of privileges required for a user to perform their duties.
  D. Restricting the user to required privileges and nothing more.
  B. Ensuring that the user alone does not have sufficient rights to subvert an important process.

  ---

  Ensuring that the user alone does not have sufficient rights to subvert an important process is a concern of the separation of duties principle and it does not concern the least privilege principle. Source: DUPUIS, Cl閙ent, Access Control Systems and Methodology CISSP Open Study Guide, version 1.0, march 2002 (page 33).

• Question 746:

  Which of the following would be LESS likely to prevent an employee from reporting an incident?

  A. They are afraid of being pulled into something they don't want to be involved with.
  B. The process of reporting incidents is centralized.
  C. They are afraid of being accused of something they didn't do.
  D. They are unaware of the company's security policies and procedures.
  B. The process of reporting incidents is centralized.

  ---

  The reporting process should be centralized else employees won't bother.

  The other answers are incorrect because :

  They are afraid of being pulled into something they don't want to be involved with is incorrect as most of the employees fear of this and this would prevent them to report an incident. They are afraid of being accused of something they didn't do

  is also incorrect as this also prevents them to report an incident.

  They are unaware of the company's security policies and procedures is also incorrect as mentioned above.

  Reference : Shon Harris AIO v3 , Ch-10 : Laws , Investigatio and Ethics , Page : 675.

• Question 747:

  Which of the following type of traffic can easily be filtered with a stateful packet filter by enforcing the context or state of the request?

  A. ICMP
  B. TCP
  C. UDP
  D. IP
  B. TCP

  ---

  The question is explict in asking *easily*. With TCP connection establishment there is a distinct state or sequence that can be expected. Consult the references for further details.

  ICMP, IP and UDP don't have any concept of a session; i.e. each packet or datagram is handled individually, with no reference to the contents of the previous one. With no sessions, these protocols usually cannot be filtered on the state of the

  session.

  Some newer firewalls, however, simulate the concept of state for these protocols, and filter out unexpected packets based upon normal usage. Although these are commonly treated like normal stateful filters, they are more complex to

  program, and hence more prone to errors. A stateful packet filter or stateful inspection inspects each packet and only allows known connection states through. So, if a SYN/ACK packet was recieved and there was not a prior SYN packet sent

  it would filter that packet and not let it in. The correct sequence of steps are known and if the sequence or state is incorrect then it is dropped.

  The incorrect answers are:

  ICMP. ICMP is basically stateless so you could not easily filter them based on the state or sequence.

  UDP. UDP has no real state so you could only partially filter them based on the state or sequence. The question was explicit in asking easily. While it is possible, UDP is not the best answer.

  IP. IP would refer to the Internet Protocol and as such is stateless so you would not be able to filter it out easily.

  The following reference(s) were used for this question:

  http://www.nwo.net/ipf/ipf-howto.pdf

• Question 748:

  Which of the following is commonly used for retrofitting multilevel security to a database management system?

  A. trusted front-end.
  B. trusted back-end.
  C. controller.
  D. kernel.
  A. trusted front-end.

  ---

  If you are "retrofitting" that means you are adding to an existing database management system (DBMS). You could go back and redesign the entire DBMS but the cost of that could be expensive and there is no telling what the effect will be on

  existing applications, but that is redesigning and the question states retrofitting. The most cost effective way with the least effect on existing applications while adding a layer of security on top is through a trusted front-end.

  Clark-Wilson is a synonym of that model as well. It was used to add more granular control or control to database that did not provide appropriate controls or no controls at all. It is one of the most popular model today. Any dynamic website

  with a back-end database is an example of this today.

  Such a model would also introduce separation of duties by allowing the subject only specific rights on the objects they need to access.

  The following answers are incorrect:

  trusted back-end. Is incorrect because a trusted back-end would be the database management system (DBMS). Since the question stated "retrofitting" that eliminates this answer.

  controller. Is incorrect because this is a distractor and has nothing to do with "retrofitting".

  kernel. Is incorrect because this is a distractor and has nothing to do with "retrofitting". A security kernel would provide protection to devices and processes but would be inefficient in protecting rows or columns in a table.

• Question 749:

  Which backup method usually resets the archive bit on the files after they have been backed up?

  A. Incremental backup method.
  B. Differential backup method.
  C. Partial backup method.
  D. Tape backup method.
  A. Incremental backup method.

  ---

  The incremental backup method usually resets the archive bit on the files after they have been backed up.

  An Incremental Backup will backup all the files that have changed since the last Full Backup (the first time it is run after a full backup was previously completed) or after an Incremental Backup (for the second backup and subsequent backups)

  and sets the archive bit to 0. This type of backup take less time during the backup phase but it will take more time to restore.

  The other answers are all incorrect choices.

  The following backup types also exists:

  Full Backup - All data are backed up. The archive bit is cleared, which means that it is set to 0.

  Differential Backup - Backup the files that have been modified since the last Full Backup. The archive bit does not change. Take more time while the backup phase is performed and take less time to restore.

  Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 69.

• Question 750:

  What is called the type of access control where there are pairs of elements that have the least upper bound of values and greatest lower bound of values?

  A. Mandatory model
  B. Discretionary model
  C. Lattice model
  D. Rule model
  C. Lattice model

  ---

  In a lattice model, there are pairs of elements that have the least upper bound of values and greatest lower bound of values. Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 34.