ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 871:

  Which type of algorithm is considered to have the highest strength per bit of key length of any of the asymmetric algorithms?

  A. Rivest, Shamir, Adleman (RSA)
  B. El Gamal
  C. Elliptic Curve Cryptography (ECC)
  D. Advanced Encryption Standard (AES)
  C. Elliptic Curve Cryptography (ECC)

  ---

  The other answers are not correct because:

  "Rivest, Shamir, Adleman (RSA)" is incorrect because RSA is a "traditional" asymmetric algorithm. While it is reasonably strong, it is not considered to be as strong as ECC based systems.

  "El Gamal" is incorrect because it is also a "traditional" asymmetric algorithm and not considered as strong as ECC based systems.

  "Advanced Encryption Standard (AES)" is incorrect because the question asks specifically about asymmetric algorithms and AES is a symmetric algorithm.

  References:

  Official ISC2 Guide page: 258

  All in One Third Edition page: 638

  The RSA Crypto FAQ: http://www.rsa.com/rsalabs/node.asp?id=2241

• Question 872:

  Which of the following statements pertaining to link encryption is false?

  A. It encrypts all the data along a specific communication path.
  B. It provides protection against packet sniffers and eavesdroppers.
  C. Information stays encrypted from one end of its journey to the other.
  D. User information, header, trailers, addresses and routing data that are part of the packets are encrypted.
  C. Information stays encrypted from one end of its journey to the other.

  ---

  When using link encryption, packets have to be decrypted at each hop and encrypted again.

  Information staying encrypted from one end of its journey to the other is a characteristic of end- to-end encryption, not link encryption.

  Link Encryption vs. End-to-End Encryption

  Link encryption encrypts the entire packet, including headers and trailers, and has to be decrypted at each hop.

  End-to-end encryption does not encrypt the IP Protocol headers, and therefore does not need to be decrypted at each hop.

  Reference: All in one, Page 735 and Glossary

  and

  Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 6).

• Question 873:

  What is a packet sniffer?

  A. It tracks network connections to off-site locations.
  B. It monitors network traffic for illegal packets.
  C. It scans network segments for cabling faults.
  D. It captures network traffic for later analysis.
  D. It captures network traffic for later analysis.

  ---

  Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 874:

  In response to Access-request from a client such as a Network Access Server (NAS), which of the following is not one of the response from a RADIUS Server?

  A. Access-Accept
  B. Access-Reject
  C. Access-Granted
  D. Access-Challenge
  C. Access-Granted

  ---

  In response to an access-request from a client, a RADIUS server returns one of three authentication responses: access-accept, access-reject, or access-challenge, the latter being a request for additional authentication information such as a one-time password from a token or a callback identifier.

  Source: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 2, 2001, CRC Press, NY, page 36.

• Question 875:

  Which of the following would be used to detect and correct errors so that integrity and confidentiality of transactions over networks may be maintained while preventing unauthorize interception of the traffic?

  A. Information security
  B. Server security
  C. Client security
  D. Communications security
  D. Communications security

  ---

  Communications security is the discipline of preventing unauthorized interceptors from accessing telecommunications in an intelligible form, while still delivering content to the intended recipients. In the United States Department of Defense

  culture, it is often referred to by the abbreviation COMSEC. The field includes cryptosecurity, transmission security, emission security, traffic-flow security and physical security of COMSEC equipment.

  All of the other answers are incorrect answers:

  Information security

  Information security would be the overall program but communications security is the more specific and better answer. Information security means protecting information and information systems from unauthorized access, use, disclosure,

  disruption, modification, perusal, inspection, recording or destruction.

  The terms information security, computer security and information assurance are frequently incorrectly used interchangeably. These fields are interrelated often and share the common goals of protecting the confidentiality, integrity and

  availability of information; however, there are some subtle differences between them.

  These differences lie primarily in the approach to the subject, the methodologies used, and the areas of concentration. Information security is concerned with the confidentiality, integrity and availability of data regardless of the form the data

  may take: electronic, print, or other forms. Computer security can focus on ensuring the availability and correct operation of a computer system without concern for the information stored or processed by the computer.

  Server security

  While server security plays a part in the overall information security program, communications security is a better answer when talking about data over the network and preventing interception. See publication 800- 123 listed in the reference

  below to learn more.

  Client security

  While client security plays a part in the overall information security program, communications security is a better answer. Securing the client would not prevent interception of data or capture of data over the network. Today people referred to

  this as endpoint security.

  References:

  http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf

  and

  https://en.wikipedia.org/wiki/Information_security

  and

  https://en.wikipedia.org/wiki/Communications_security

• Question 876:

  Secure Sockets Layer (SSL) uses a Message Authentication Code (MAC) for what purpose?

  A. message non-repudiation.
  B. message confidentiality.
  C. message interleave checking.
  D. message integrity.
  D. message integrity.

  ---

  A keyed hash also called a MAC (message authentication code) is used for integrity protection and authenticity.

  In cryptography, a message authentication code (MAC) is a generated value used to authenticate a message. A MAC can be generated by HMAC or CBC-MAC methods. The MAC protects both a message's integrity (by ensuring that a different MAC will be produced if the message has changed) as well as its authenticity, because only someone who knows the secret key could have modified the message. MACs differ from digital signatures as MAC values are both generated and verified using the same secret key. This implies that the sender and receiver of a message must agree on the same key before initiating communications, as is the

  case with symmetric encryption. For the same reason, MACs do not provide the property of non-repudiation offered by signatures specifically in the case of a network-wide shared secret key: any user who can verify a MAC is also capable of generating MACs for other messages.

  HMAC

  When using HMAC the symmetric key of the sender would be concatenated (added at the end) with the message. The result of this process (message + secret key) would be put through a hashing algorithm, and the result would be a MAC

  value. This MAC value is then appended to the message being sent. If an enemy were to intercept this message and modify it, he would not have the necessary symmetric key to create a valid MAC value. The receiver would detect the

  tampering because the MAC value would not be valid on the receiving side.

  CBC-MAC

  If a CBC-MAC is being used, the message is encrypted with a symmetric block cipher in CBC mode, and the output of the final block of ciphertext is used as the MAC. The sender does not send the encrypted version of the message, but

  instead sends the plaintext version and the MAC attached to the message. The receiver receives the plaintext message and encrypts it with the same symmetric block cipher in CBC mode and calculates an independent MAC value. The

  receiver compares the new MAC value with the MAC value sent with the message. This method does not use a hashing algorithm as does HMAC.

  Cipher-Based Message Authentication Code (CMAC)

  Some security issues with CBC-MAC were found and they created Cipher-Based Message Authentication Code (CMAC) as a replacement. CMAC provides the same type of data origin authentication and integrity as CBC-MAC, but is more

  secure mathematically. CMAC is a variation of CBC-MAC. It is approved to work with AES and Triple DES. HMAC, CBC-MAC, and CMAC work higher in the network stack and can identify not only transmission errors (accidental), but also

  more nefarious modifications, as in an attacker messing with a message for her own benefit. This means all of these technologies can identify intentional, unauthorized modifications and accidental changes-- three in one.

  The following are all incorrect answers:

  "Message non-repudiation" is incorrect.

  Nonrepudiation is the assurance that someone cannot deny something. Typically, nonrepudiation refers to the ability to ensure that a party to a contract or a communication cannot deny the authenticity of their signature on a document or the

  sending of a message that they originated.

  To repudiate means to deny. For many years, authorities have sought to make repudiation impossible in some situations. You might send registered mail, for example, so the recipient cannot deny that a letter was delivered. Similarly, a legal

  document typically requires witnesses to signing so that the person who signs cannot deny having done so.

  On the Internet, a digital signature is used not only to ensure that a message or document has been electronically signed by the person that purported to sign the document, but also, since a digital signature can only be created by one

  person, to ensure that a person cannot later deny that they furnished the signature.

  "Message confidentiality" is incorrect. The Message confidentiality is protected by encryption not by hashing algorithms.

  "Message interleave checking" is incorrect. This is a nonsense term included as a distractor.

  Reference(s) used for this question:

  Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 1384). McGraw-Hill.

  Kindle Edition.

  and

  http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf and

  http://searchsecurity.techtarget.com/definition/nonrepudiation

  and

  https://en.wikipedia.org/wiki/Message_authentication_code

• Question 877:

  Which backup method copies only files that have changed since the last full backup, but does not clear the archive bit?

  A. Differential backup method.
  B. Full backup method.
  C. Incremental backup method.
  D. Tape backup method.
  A. Differential backup method.

  ---

  One of the key item to understand regarding backup is the archive bit. The archive bit is used to determine what files have been backuped already. The archive bit is set if a file is modified or a new file is created, this indicates to the backup program that it has to be saved on the next backup. When a full backup is performed the archive bit will be cleared indicating that the files were backup. This allows backup programs to do an incremental or differential backup that only backs up the changes to the filesystem since the last time the bit was cleared

  Full Backup (or Reference Backup)

  A Full backup will backup all the files and folders on the drive every time you run the full backup. The archive bit is cleared on all files indicating they were all backuped. Advantages:

  All files from the selected drives and folders are backed up to one backup set.

  In the event you need to restore files, they are easily restored from the single backup set.

  Disadvantages:

  A full backup is more time consuming than other backup options.

  Full backups require more disk, tape, or network drive space.

  Incremental Backup

  An incremental backup provides a backup of files that have changed or are new since the last incremental backup.

  For the first incremental backup, all files in the file set are backed up (just as in a full backup). If you use the same file set to perform a incremental backup later, only the files that have changed are backed up. If you use the same file set for a

  third backup, only the files that have changed since the second backup are backed up, and so on.

  Incremental backup will clear the archive bit.

  Advantages:

  Backup time is faster than full backups.

  Incremental backups require less disk, tape, or network drive space.

  You can keep several versions of the same files on different backup sets.

  Disadvantages:

  In order to restore all the files, you must have all of the incremental backups available.

  It may take longer to restore a specific file since you must search more than one backup set to find the latest version of a file.

  Differential Backup

  A differential backup provides a backup of files that have changed since a full backup was performed. A differential backup typically saves only the files that are different or new since the last full backup. Together, a full backup and a

  differential backup include all the files on your computer, changed and unchanged.

  Differential backup do not clear the archive bits.

  Advantages:

  Differential backups require even less disk, tape, or network drive space than incremental backups.

  Backup time is faster than full or incremental backups.

  Disadvantages:

  Restoring all your files may take considerably longer since you may have to restore both the last differential and full backup.

  Restoring an individual file may take longer since you have to locate the file on either the differential or full backup.

  For more info see: http://support.microsoft.com/kb/136621

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 69.

• Question 878:

  What layer of the OSI/ISO model does Point-to-point tunnelling protocol (PPTP) work at?

  A. Data link layer
  B. Transport layer
  C. Session layer
  D. Network layer
  A. Data link layer

  ---

  PPTP operates at the data link layer (layer 2) of the OSI model and uses native PPP authentication and encryption services. Designed for individual client to server connections, it enables only a single point-to- point connection per session.

  PPTP - Point-to-Point Tunneling Protocol - extends the Point to Point Protocol (PPP) standard for traditional dial-up networking. PPTP is best suited for the remote access applications of VPNs, but it also supports LAN internetworking.

  PPTP operates at Layer 2 of the OSI model.

  Using PPTP

  PPTP packages data within PPP packets, then encapsulates the PPP packets within IP packets (datagrams) for transmission through an Internet-based VPN tunnel. PPTP supports data encryption and compression of these packets. PPTP

  also uses a form of General Routing Encapsulation (GRE) to get data to and from its final destination.

  Reference(s) used for this question:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 95).

  and

  http://compnetworking.about.com/od/vpn/l/aa030103a.htm

  and

  http://technet.microsoft.com/en-us/library/cc768084.aspx

• Question 879:

  In order to be able to successfully prosecute an intruder:

  A. A point of contact should be designated to be responsible for communicating with law enforcement and other external agencies.
  B. A proper chain of custody of evidence has to be preserved.
  C. Collection of evidence has to be done following predefined procedures.
  D. Whenever possible, analyze a replica of the compromised resource, not the original, thereby avoiding inadvertently tamping with evidence.
  B. A proper chain of custody of evidence has to be preserved.

  ---

  If you intend on prosecuting an intruder, evidence has to be collected in a lawful manner and, most importantly, protected through a secure chain-of-custody procedure that tracks who has been involved in handling the evidence and where it has been stored. All other choices are all important points, but not the best answer, since no prosecution is possible without a proper, provable chain of custody of evidence.

  Source: ALLEN, Julia H., The CERT Guide to System and Network Security Practices, Addison- Wesley, 2001, Chapter 7: Responding to Intrusions (pages 282-285).

• Question 880:

  What does it mean to say that sensitivity labels are "incomparable"?

  A. The number of classification in the two labels is different.
  B. Neither label contains all the classifications of the other.
  C. the number of categories in the two labels are different.
  D. Neither label contains all the categories of the other.
  D. Neither label contains all the categories of the other.

  ---

  If a category does not exist then you cannot compare it. Incomparable is when you have two disjointed sensitivity labels, that is a category in one of the labels is not in the other label. "Because neither label contains all the categories of the

  other, the labels can't be compared.

  They're said to be incomparable"

  COMPARABILITY:

  The label:

  TOP SECRET [VENUS ALPHA]

  is "higher" than either of the labels:

  SECRET [VENUS ALPHA] TOP SECRET [VENUS]

  But you can't really say that the label:

  TOP SECRET [VENUS]

  is higher than the label:

  SECRET [ALPHA]

  Because neither label contains all the categories of the other, the labels can't be compared. They're said to be incomparable. In a mandatory access control system, you won't be allowed access to a file whose label is incomparable to your

  clearance.

  The Multilevel Security policy uses an ordering relationship between labels known as the dominance relationship. Intuitively, we think of a label that dominates another as being "higher" than the other. Similarly, we think of a label that is

  dominated by another as being "lower" than the other. The dominance relationship is used to determine permitted operations and information flows.

  DOMINANCE

  The dominance relationship is determined by the ordering of the Sensitivity/Clearance component of the label and the intersection of the set of Compartments.

  Sample Sensitivity/Clearance ordering are:

  Top Secret > Secret > Confidential > Unclassified

  s3 > s2 > s1 > s0

  Formally, for label one to dominate label 2 both of the following must be true:

  The sensitivity/clearance of label one must be greater than or equal to the sensitivity/clearance of label two.

  The intersection of the compartments of label one and label two must equal the compartments of label two.

  Additionally:

  Two labels are said to be equal if their sensitivity/clearance and set of compartments are exactly equal. Note that dominance includes equality. One label is said to strictly dominate the other if it dominates the other but is not equal to the

  other.

  Two labels are said to be incomparable if each label has at least one compartment that is not included in the other's set of compartments.

  The dominance relationship will produce a partial ordering over all possible MLS labels, resulting in what is known as the MLS Security Lattice.

  The following answers are incorrect:

  The number of classification in the two labels is different. Is incorrect because the categories are what is being compared, not the classifications.

  Neither label contains all the classifications of the other. Is incorrect because the categories are what is being compared, not the classifications.

  the number of categories in the two labels is different. Is incorrect because it is possibe a category exists more than once in one sensitivity label and does exist in the other so they would be comparable.

  Reference(s) used for this question:

  OReilly - Computer Systems and Access Control (Chapter 3) http://www.oreilly.com/catalog/csb/chapter/ ch03.html and

  http://rubix.com/cms/mls_dom