ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 901:

  Which of the following is a not a preventative control?

  A. Deny programmer access to production data.
  B. Require change requests to include information about dates, descriptions, cost analysis and anticipated effects.
  C. Run a source comparison program between control and current source periodically.
  D. Establish procedures for emergency changes.
  C. Run a source comparison program between control and current source periodically.

  ---

  Running the source comparison program between control and current source periodically allows detection, not prevention, of unauthorized changes in the production environment. Other options are preventive controls.

  Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 309).

• Question 902:

  What is electronic vaulting?

  A. Information is backed up to tape on a hourly basis and is stored in a on-site vault.
  B. Information is backed up to tape on a daily basis and is stored in a on-site vault.
  C. Transferring electronic journals or transaction logs to an off-site storage facility
  D. A transfer of bulk information to a remote central backup facility.
  D. A transfer of bulk information to a remote central backup facility.

  ---

  Electronic vaulting is defined as "a method of transferring bulk information to off-site facilities for backup purposes". Remote Journaling is the same concept as electronic vaulting, but has to do with journals and transaction logs, not the actual files.

  Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter

  9: Disaster Recovery and Business continuity (page 619).

• Question 903:

  Related to information security, integrity is the opposite of which of the following?

  A. abstraction
  B. alteration
  C. accreditation
  D. application
  B. alteration

  ---

  Integrity is the opposite of "alteration."

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 59.

• Question 904:

  Which of the following statements pertaining to disaster recovery planning is incorrect?

  A. Every organization must have a disaster recovery plan
  B. A disaster recovery plan contains actions to be taken before, during and after a disruptive event.
  C. The major goal of disaster recovery planning is to provide an organized way to make decisions if a disruptive event occurs.
  D. A disaster recovery plan should cover return from alternate facilities to primary facilities.
  A. Every organization must have a disaster recovery plan

  ---

  It is possible that an organization may not need a disaster recovery plan. An organization may not have any critical processing areas or system and they would be able to withstand lengthy interruptions.

  Remember that DRP is related to systems needed to support your most critical business functions.

  The DRP plan covers actions to be taken when a disaster occur but DRP PLANNING which is the keywork in the question would also include steps that happen before you use the plan such as development of the plan, training, drills,

  logistics, and a lot more.

  To be effective, the plan would certainly cover before, during, and after the disaster actions.

  It may take you a couple years to develop a plan for a medium size company, there is a lot that has to happen before the plan would be actually used in a real disaster scenario. Plan for the worst and hope for the best.

  All other statements are true.

  NOTE FROM CLEMENT:

  Below is a great article on who legally needs a plan which is very much in line with this question. Does EVERY company needs a plan? The legal answer is NO. Some companies, industries, will be required according to laws or regulations to have a plan. A blank statement saying: All companies MUST have a plan would not be accurate. The article below is specific to the USA but similar laws will exist in many other countries. Some companies such as utilities, power, etc... might also need plan if they have been defined as Critical Infrastructure by the government. The legal side of IT is always very complex and varies in different countries. Always talk to your lawyer to ensure you follow the law of the land :-)

  Read the details below:

  So Who, Legally, MUST Plan?

  With the caveats above, let's cover a few of the common laws where there is a duty to have a disaster recovery plan. I will try to include the basis for that requirement, where there is an implied mandate to do so, and what the difference is

  between the two

  Banks and Financial Institutions MUST Have a Plan

  The Federal Financial Institutions Examination Council (Council) was established on March 10, 1979, pursuant to Title X of the Financial Institutions Regulatory and Interest Rate Control Act of 1978 (FIRA), Public Law 95-630. In 1989, Title XI

  of the Financial Institutions Reform, Recovery and Enforcement Act of 1989 (FIRREA) established the Examination Council (the Council).

  The Council is a formal interagency body empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions by the Board of Governors of the Federal Reserve System (FRB), the

  Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), and the Office of Thrift Supervision (OTS); and to make recommendations to promote

  uniformity in the supervision of financial institutions. In other words, every bank, savings and loan, credit union, and other financial institution is governed by the principles adopted by the Council.

  In March of 2003, the Council released its Business Continuity Planning handbook designed to provide guidance and examination procedures for examiners in evaluating financial institution and service provider risk-management processes.

  Stockbrokers MUST Have a Plan

  The National Association of Securities Dealers (NASD) has adopted rules that require all its members to have business continuity plans. The NASD oversees the activities of more than 5,100 brokerage firms, approximately 130,800 branch

  offices and more than 658,770 registered securities representatives.

  As of June 14, 2004, the rules apply to all NASD member firms. The requirements, which are specified in Rule 3510, begin with the following:

  3510. Business Continuity Plans. (a) Each member must create and maintain a written business continuity plan identifying procedures relating to an emergency or significant business disruption. Such procedures must be reasonably designed

  to enable the member to meet its existing obligations to customers. In addition, such procedures must address the member's existing relationships with other broker-dealers and counter-parties. The business continuity plan must be made

  available promptly upon request to NASD staff.

  NOTE:

  The rules apply to every company that deals in securities, such as brokers, dealers, and their representatives, it does NOT apply to the listed companies themselves.

  Electric Utilities WILL Need a Plan

  The disaster recovery function relating to the electric utility grid is presently undergoing a change. Prior to 2005, the Federal Energy Regulatory Commission (FERC) could only coordinate volunteer efforts between utilities. This has changed

  with the adoption of Title XII of the Energy Policy Act of 2005 (16 U.S.C. 824o). That new law authorizes the FERC to create an Electric Reliability Organization (ERO).

  The ERO will have the capability to adopt and enforce reliability standards for "all users, owners, and operators of the bulk power system" in the United States. At this time, FERC is in the process of finalizing the rules for the creation of the

  ERO. Once the ERO is created, it will begin the process of establishing reliability standards. It is very safe to assume that the ERO will adopt standards for service restoration and disaster recovery, particularly after such widespread disasters

  as Hurricane Katrina.

  Telecommunications Utilities SHOULD Have Plans, but MIGHT NOT

  Telecommunications utilities are governed on the federal level by the Federal Communications Commission (FCC) for interstate services and by state Public Utility Commissions (PUCs) for services within the state.

  The FCC has created the Network Reliability and Interoperability Council (NRIC). The role of the NRIC is to develop recommendations for the FCC and the telecommunications industry to "insure [sic] optimal reliability, security, interoperability

  and interconnectivity of, and accessibility to, public communications networks and the internet." The NRIC members are senior representatives of providers and users of telecommunications services and products, including

  telecommunications carriers, the satellite, cable television, wireless and computer industries, trade associations, labor and consumer representatives, manufacturers, research organizations, and government-related organizations.

  There is no explicit provision that we could find that says telecommunications carriers must have a Disaster Recovery Plan. As I have stated frequently in this series of articles on disaster recovery, however, telecommunications facilities are

  tempting targets for terrorism. I have not changed my mind in that regard and urge caution.

  You might also want to consider what the liability of a telephone company is if it does have a disaster that causes loss to your organization. In three words: It's not much. The following is the statement used in most telephone company tariffs

  with regard to its liability:

  The Telephone Company's liability, if any, for its gross negligence or willful misconduct is not limited by this tariff. With respect to any other claim or suit, by a customer or any others, for damages arising out of mistakes, omissions,

  interruptions, delays or errors, or defects in transmission occurring in the course of furnishing services hereunder, the Telephone Company's liability, if any, shall not exceed an amount equivalent to the proportionate charge to the customer

  for the period of service during which such mistake, omission, interruption, delay, error or defect in transmission or service occurs and continues. (Source, General Exchange Tariff for major carrier)

  All Health Care Providers WILL Need a Disaster Recovery Plan

  HIPAA is an acronym for the Health Insurance Portability and Accountability Act of 1996, Public Law 104- 191, which amended the Internal Revenue Service Code of 1986. Also known as the Kennedy-Kassebaum Act, the Act includes a

  section, Title II, entitled Administrative Simplification, requiring "Improved efficiency in healthcare delivery by standardizing electronic data interchange, and protection of confidentiality and security of health data through setting and enforcing

  standards."

  The legislation called upon the Department of Health and Human Services (HHS) to publish new rules that will ensure security standards protecting the confidentiality and integrity of "individually identifiable health information," past, present,

  or future.

  The final Security Rule was published by HHS on February 20, 2003 and provides for a uniform level of protection of all health information that is housed or transmitted electronically and that pertains to an individual.

  The Security Rule requires covered entities to ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) that the covered entity creates, receives, maintains, or transmits. It also requires entities to

  protect against any reasonably anticipated threats or hazards to the security or integrity of ePHI, protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required by the Privacy Rule, and

  ensure compliance by their workforce.

  Required safeguards include application of appropriate policies and procedures, safeguarding physical access to ePHI, and ensuring that technical security measures are in place to protect networks, computers and other electronic devices.

  Companies with More than 10 Employees

  The United States Department of Labor has adopted numerous rules and regulations in regard to workplace safety as part of the Occupational Safety and Health Act. For example, 29 USC 654 specifically requires:

  (a)

  Each employer:

  (1)

  shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees;

  (2)

  shall comply with occupational safety and health standards promulgated under this Act.

  (b)

  Each employee shall comply with occupational safety and health standards and all rules, regulations, and orders issued pursuant to this Act which are applicable to his own actions and conduct. Other Considerations or Expensive Research

• Question 905:

  Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?

  A. Statistical Anomaly-Based ID
  B. Signature-Based ID
  C. dynamical anomaly-based ID
  D. inferential anomaly-based ID
  A. Statistical Anomaly-Based ID

  ---

  Statistical Anomaly-Based ID - With this method, an IDS acquires data and defines a "normal" usage profile for the network or host that is being monitored. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 49.

• Question 906:

  Which of the following statements pertaining to biometrics is false?

  A. Increased system sensitivity can cause a higher false rejection rate
  B. The crossover error rate is the point at which false rejection rate equals the false acceptance rate.
  C. False acceptance rate is also known as Type II error.
  D. Biometrics are based on the Type 2 authentication mechanism.
  D. Biometrics are based on the Type 2 authentication mechanism.

  ---

  Authentication is based on three factor types: type 1 is something you know, type 2 is something you have and type 3 is something you are. Biometrics are based on the Type 3 authentication mechanism. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 2: Access control systems (page 37).

• Question 907:

  Which of the following is a token-passing scheme like token ring that also has a second ring that remains dormant until an error condition is detected on the primary ring?

  A. Fiber Distributed Data Interface (FDDI).
  B. Ethernet
  C. Fast Ethernet
  D. Broadband
  A. Fiber Distributed Data Interface (FDDI).

  ---

  FDDI is a token-passing ring scheme like a token ring, yet it also has a second ring that remains dormant until an error condition is detected on the primary ring.

  Fiber Distributed Data Interface (FDDI) provides a 100 Mbit/s optical standard for data transmission in a local area network that can extend in range up to 200 kilometers (124 miles). Although FDDI logical topology is a ring-based token network, it does not use the IEEE 802.5 token ring protocol as its basis; instead, its protocol is derived from the IEEE 802.4 token bus timed token protocol. In addition to covering large geographical areas, FDDI local area networks can support thousands of users. As a standard underlying medium it uses optical fiber, although it can use copper cable, in which case it may be refer to as CDDI (Copper Distributed Data Interface). FDDI offers both a Dual-Attached Station (DAS), counter- rotating token ring topology and a Single-Attached Station (SAS), token bus passing ring topology.

  Ethernet is a family of frame-based computer networking technologies for local area networks (LANs). The name came from the physical concept of the ether. It defines a number of wiring and signaling standards for the Physical Layer of the OSI networking model as well as a common addressing format and Media Access Control at the Data Link Layer.

  In computer networking, Fast Ethernet is a collective term for a number of Ethernet standards that carry traffic at the nominal rate of 100 Mbit/s, against the original Ethernet speed of 10 Mbit/s. Of the fast Ethernet standards 100BASE-TX is by far the most common and is supported by the vast majority of Ethernet hardware currently produced. Fast Ethernet was introduced in 1995 and remained the fastest version of Ethernet for three years before being superseded by gigabit Ethernet.

  Broadband in data can refer to broadband networks or broadband Internet and may have the same meaning as above, so that data transmission over a fiber optic cable would be referred to as broadband as compared to a telephone modem

  operating at 56,000 bits per second. However, a worldwide standard for what level of bandwidth and network speeds actually constitute Broadband have not been determined.[1]

  Broadband in data communications is frequently used in a more technical sense to refer to data transmission where multiple pieces of data are sent simultaneously to increase the effective rate of transmission, regardless of data signaling rate. In network engineering this term is used for methods where two or more signals share a medium.[Broadband Internet access, often shortened to just broadband, is a high data rate Internet access--typically contrasted with dial-up access using a 56k modem.

  Dial-up modems are limited to a bitrate of less than 56 kbit/s (kilobits per second) and require the full use of a telephone line--whereas broadband technologies supply more than double this rate and generally without disrupting telephone use.

  Source:

  KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 72.

  also see:

  http://en.wikipedia.org/

• Question 908:

  In a stateful inspection firewall, data packets are captured by an inspection engine that is operating at the:

  A. Network or Transport Layer.
  B. Application Layer.
  C. Inspection Layer.
  D. Data Link Layer.
  A. Network or Transport Layer.

  ---

  Most stateful packet inspection firewalls work at the network or transport layers. For the TCP/IP protcol, this allows the firewall to make decisions both on IP addresses, protocols and TCP/UDP port numbers

  Application layer is incorrect. This is too high in the OSI stack for this type of firewall.

  Inspection layer is incorrect. There is no such layer in the OSI stack.

  "Data link layer" is incorrect. This is too low in the OSI stack for this type of firewall.

  References:

  CBK, p. 466

  AIO3, pp. 485 - 486

• Question 909:

  Which of the following is NOT an advantage that TACACS+ has over TACACS?

  A. Event logging
  B. Use of two-factor password authentication
  C. User has the ability to change his password
  D. Ability for security tokens to be resynchronized
  A. Event logging

  ---

  Although TACACS+ provides better audit trails, event logging is a service that is provided with TACACS. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 121).

• Question 910:

  An Intrusion Detection System (IDS) is what type of control?

  A. A preventive control.
  B. A detective control.
  C. A recovery control.
  D. A directive control.
  D. A directive control.

  ---

  These controls can be used to investigate what happen after the fact. Your IDS may collect information on where the attack came from, what port was use, and other details that could be used in the investigation steps.

  "Preventative control" is incorrect. Preventative controls preclude events or actions that might compromise a system or cause a policy violation. An intrusion prevention system would be an example of a preventative control.

  "Recovery control" is incorrect. Recover controls include processes used to return the system to a secure state after the occurrence of a security incident. Backups and redundant components are examples of recovery controls.

  "Directive controls" is incorrect. Directive controls are administrative instruments such as policies, procedures, guidelines, and aggreements. An acceptable use policy is an example of a directive control.

  References:

  CBK, pp. 646 - 647