ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 821:

  Which of the following is used to monitor network traffic or to monitor host audit logs in real time to determine violations of system security policy that have taken place?

  A. Intrusion Detection System
  B. Compliance Validation System
  C. Intrusion Management System (IMS)
  D. Compliance Monitoring System
  A. Intrusion Detection System

  ---

  An Intrusion Detection System (IDS) is a system that is used to monitor network traffic or to monitor host audit logs in order to determine if any violations of an organization's system security policy have taken place. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 48.

• Question 822:

  Which of the following best ensures accountability of users for the actions taken within a system or domain?

  A. Identification
  B. Authentication
  C. Authorization
  D. Credentials
  B. Authentication

  ---

  Details:

  The only way to ensure accountability is if the subject is uniquely identified and authenticated. Identification alone does not provide proof the user is who they claim to be. After showing proper credentials, a user is authorized access to

  resources.

  References:

  HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 4:

  Access Control (page 126).

• Question 823:

  Which of the following questions is less likely to help in assessing physical and environmental protection?

  A. Are entry codes changed periodically?
  B. Are appropriate fire suppression and prevention devices installed and working?
  C. Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or steal printed or electronic information?
  D. Is physical access to data transmission lines controlled?
  C. Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or steal printed or electronic information?

  ---

  Physical security and environmental security are part of operational controls, and are measures taken to protect systems, buildings, and related supporting infrastructures against threats associated with their physical environment. All the questions above are useful in assessing physical and environmental protection except for the one regarding processes that ensuring that unauthorized individuals cannot access information, which is more a production control.

  Source: SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-21 to A-24).

• Question 824:

  Domain Name Service is a distributed database system that is used to map:

  A. Domain Name to IP addresses.
  B. MAC addresses to domain names.
  C. MAC Address to IP addresses.
  D. IP addresses to MAC Addresses.
  A. Domain Name to IP addresses.

  ---

  The Domain Name Service is a distributed database system that is used to map domain names to IP addresses and IP addresses to domain names.

  The Domain Name System is maintained by a distributed database system, which uses the client- server model. The nodes of this database are the name servers. Each domain has at least one authoritative DNS server that publishes

  information about that domain and the name servers of any domains subordinate to it. The top of the hierarchy is served by the root nameservers, the servers to query when looking up (resolving) a TLD.

  Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 100.

  and

  https://en.wikipedia.org/wiki/Domain_Name_System

• Question 825:

  Which of the following forms of authentication would most likely apply a digital signature algorithm to every bit of data that is sent from the claimant to the verifier?

  A. Dynamic authentication
  B. Continuous authentication
  C. Encrypted authentication
  D. Robust authentication
  B. Continuous authentication

  ---

  Continuous authentication is a type of authentication that provides protection against impostors who can see, alter, and insert information passed between the claimant and verifier even after the claimant/verifier authentication is complete. These are typically referred to as active attacks, since they assume that the imposter can actively influence the connection between claimant and verifier. One way to provide this form of authentication is to apply a digital signature algorithm to every bit of data that is sent from the claimant to the verifier. There are other combinations of cryptography that can provide this form of authentication but current strategies rely on applying some type of cryptography to every bit of data sent. Otherwise, any unprotected bit would be suspect. Robust authentication relies on dynamic authentication data that changes with each authenticated session between a claimant and a verifier, but does not provide protection against active attacks. Encrypted authentication is a distracter.

  Source: GUTTMAN, Barbara and BAGWILL, Robert, NIST Special Publication 800-xx, Internet Security Policy: A Technical Guide, Draft Version, May 25, 2000 (page 34).

• Question 826:

  Which of the following is required in order to provide accountability?

  A. Authentication
  B. Integrity
  C. Confidentiality
  D. Audit trails
  D. Audit trails

  ---

  Accountability can actually be seen in two different ways:

  1) Although audit trails are also needed for accountability, no user can be accountable for their actions unless properly authenticated.

  2) Accountability is another facet of access control. Individuals on a system are responsible for their actions. This accountability property enables system activities to be traced to the proper individuals. Accountability is supported by audit trails that record events on the system and network. Audit trails can be used for intrusion detection and for the reconstruction of past events. Monitoring individual activities, such as keystroke monitoring, should be accomplished in accordance with the company policy and appropriate laws. Banners at the log-on time should notify the user of any monitoring that is being conducted.

  The point is that unless you employ an appropriate auditing mechanism, you don't have accountability. Authorization only gives a user certain permissions on the network. Accountability is far more complex because it also includes intrusion detection, unauthorized actions by both unauthorized users and authorized users, and system faults. The audit trail provides the proof that unauthorized modifications by both authorized and unauthorized users took place. No proof, No accountability.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Page 50.

  The Shon Harris AIO book, 4th Edition, on Page 243 also states:

  Auditing Capabilities ensures users are accountable for their actions, verify that the secutiy policies are enforced,

  and can be used as investigation tools. Accountability is tracked by recording user, system, and application activities. This recording is done through auditing functions and mechanisms within an operating sytem or application.

  Audit trail contain information about operating System activities, application events, and user actions.

• Question 827:

  Which of the following statements pertaining to PPTP (Point-to-Point Tunneling Protocol) is incorrect?

  A. PPTP allow the tunnelling of any protocols that can be carried within PPP.
  B. PPTP does not provide strong encryption.
  C. PPTP does not support any token-based authentication method for users.
  D. PPTP is derived from L2TP.
  D. PPTP is derived from L2TP.

  ---

  PPTP is an encapsulation protocol based on PPP that works at OSI layer 2 (Data Link) and that enables a single point-to-point connection, usually between a client and a server. While PPTP depends on IP to establish its connection. As

  currently implemented, PPTP encapsulates PPP packets using a modified version of the generic routing encapsulation (GRE) protocol, which gives PPTP to the flexibility of handling protocols other than IP, such as IPX and NETBEUI over IP

  networks.

  PPTP does have some limitations:

  It does not provide strong encryption for protecting data, nor does it support any token-based methods for authenticating users.

  L2TP is derived from L2F and PPTP, not the opposite.

• Question 828:

  The Reference Validation Mechanism that ensures the authorized access relationships between subjects and objects is implementing which of the following concept:

  A. The reference monitor.
  B. Discretionary Access Control.
  C. The Security Kernel.
  D. Mandatory Access Control.
  A. The reference monitor.

  ---

  The reference monitor concept is an abstract machine that ensures that all subjects have the necessary access rights before accessing objects. Therefore, the kernel will mediates all accesses to objects by subjects and will do so by

  validating through the reference monitor concept.

  The kernel does not decide whether or not the access will be granted, it will be the Reference Monitor which is a subset of the kernel that will say YES or NO.

  All access requests will be intercepted by the Kernel, validated through the reference monitor, and then access will either be denied or granted according to the request and the subject privileges within the system.

  1.

  The reference monitor must be small enough to be full tested and valided

  2.

  The Kernel must MEDIATE all access request from subjects to objects

  3.

  The processes implementing the reference monitor must be protected

  4.

  The reference monitor must be tamperproof The following answers are incorrect: The security kernel is the mechanism that actually enforces the rules of the reference monitor concept. The other answers are distractors. Shon Harris, All In One, 5th Edition, Security Architecture and Design, Page 330 also see http://en.wikipedia.org/wiki/Reference_monitor

• Question 829:

  Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplished:

  A. through access control mechanisms that require identification and authentication and through the audit function.
  B. through logical or technical controls involving the restriction of access to systems and the protection of information.
  C. through logical or technical controls but not involving the restriction of access to systems and the protection of information.
  D. through access control mechanisms that do not require identification and authentication and do not operate through the audit function.
  A. through access control mechanisms that require identification and authentication and through the audit function.

  ---

  Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplished through access control mechanisms that require identification and authentication and through the audit function. These controls must be in accordance with and accurately represent the organization's security policy. Assurance procedures ensure that the control mechanisms correctly implement the security policy for the entire life cycle of an information system.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 33.

• Question 830:

  The following is NOT a security characteristic we need to consider while choosing a biometric identification systems:

  A. data acquisition process
  B. cost
  C. enrollment process
  D. speed and user interface
  B. cost

  ---

  Cost is a factor when considering Biometrics but it is not a security characteristic.

  All the other answers are incorrect because they are security characteristics related to Biometrics.

  data acquisition process can cause a security concern because if the process is not fast and efficient it can discourage individuals from using the process.

  enrollment process can cause a security concern because the enrollment process has to be quick and efficient. This process captures data for authentication.

  speed and user interface can cause a security concern because this also impacts the users acceptance rate of biometrics. If they are not comfortable with the interface and speed they might sabotage the devices or otherwise attempt to

  circumvent them.

  References:

  OIG Access Control (Biometrics) (pgs 165-167)

  From: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 1, Pages 5-6.

  in process of correction