ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 961:

  Which of the following are suitable protocols for securing VPN connections at the lower layers of the OSI model?

  A. S/MIME and SSH
  B. TLS and SSL
  C. IPsec and L2TP
  D. PKCS#10 and X.509
  C. IPsec and L2TP

  ---

  Reference: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw- Hill/Osborne, page 467; SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.

• Question 962:

  Which of the following is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length?

  A. Fiber Optic cable
  B. Coaxial cable
  C. Twisted Pair cable
  D. Axial cable
  A. Fiber Optic cable

  ---

  Fiber Optic cable is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length (up to two kilometers in some cases). Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 72.

• Question 963:

  What enables a workstation to boot without requiring a hard or floppy disk drive?

  A. Bootstrap Protocol (BootP).
  B. Reverse Address Resolution Protocol (RARP).
  C. Address Resolution Protocol (ARP).
  D. Classless Inter-Domain Routing (CIDR).
  A. Bootstrap Protocol (BootP).

  ---

  Bootstrap Protocol (BootP) is an Internet Layer protocol that enables a workstation to boot without requiring a hard or floppy disk drive. Reverse Address Resolution Protocol (RARP) is a TCP/IP protocol that permits a physical address, such as an Ethernet address, to be translated into an IP address. Address Resolution Protocol (ARP) is a TCP/IP protocol that permits an IP address to be translated into a physical address. Classless Inter-Domain Routing (CIDR) is a new IP addressing scheme.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 88.

• Question 964:

  Which of the following is the BEST way to detect software license violations?

  A. Implementing a corporate policy on copyright infringements and software use.
  B. Requiring that all PCs be diskless workstations.
  C. Installing metering software on the LAN so applications can be accessed through the metered software.
  D. Regularly scanning PCs in use to ensure that unauthorized copies of software have not been loaded on the PC.
  D. Regularly scanning PCs in use to ensure that unauthorized copies of software have not been loaded on the PC.

  ---

  The best way to prevent and detect software license violations is to regularly scan used PCs, either from the LAN or directly, to ensure that unauthorized copies of software have not been loaded on the PC.

  Other options are not detective.

  A corporate policy is not necessarily enforced and followed by all employees.

  Software can be installed from other means than floppies or CD-ROMs (from a LAN or even downloaded from the Internet) and software metering only concerns applications that are registered.

  Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 108).

• Question 965:

  One of the following statements about the differences between PPTP and L2TP is NOT true

  A. PPTP can run only on top of IP networks.
  B. PPTP is an encryption protocol and L2TP is not.
  C. L2TP works well with all firewalls and network devices that perform NAT.
  D. L2TP supports AAA servers
  C. L2TP works well with all firewalls and network devices that perform NAT.

  ---

  L2TP is affected by packet header modification and cannot cope with firewalls and network devices that perform NAT.

  "PPTP can run only on top of IP networks." is correct as PPTP encapsulates datagrams into an IP packet, allowing PPTP to route many network protocols across an IP network.

  "PPTP is an encryption protocol and L2TP is not." is correct. When using PPTP, the PPP payload is encrypted with Microsoft Point-to-Point Encryption (MPPE) using MSCHAP or EAP-TLS.

  "L2TP supports AAA servers" is correct as L2TP supports TACACS+ and RADIUS.

  NOTE:

  L2TP does work over NAT. It is possible to use a tunneled mode that wraps every packet into a UDP packet. Port 4500 is used for this purpose. However this is not true of PPTP and it is not true as well that it works well with all firewalls and

  NAT devices.

  References:

  All in One Third Edition page 545

  Official Guide to the CISSP Exam page 124-126

• Question 966:

  What can be described as a measure of the magnitude of loss or impact on the value of an asset?

  A. Probability
  B. Exposure factor
  C. Vulnerability
  D. Threat
  B. Exposure factor

  ---

  The exposure factor is a measure of the magnitude of loss or impact on the value of an asset.

  The probability is the chance or likelihood, in a finite sample, that an event will occur or that a specific loss value may be attained should the event occur.

  A vulnerability is the absence or weakness of a risk-reducing safeguard. A threat is event, the occurrence of which could have an undesired impact.

  Source: ROTHKE, Ben, CISSP CBK Review presentation on domain 3, August 1999.

• Question 967:

  Which type of control is concerned with avoiding occurrences of risks?

  A. Deterrent controls
  B. Detective controls
  C. Preventive controls
  D. Compensating controls
  C. Preventive controls

  ---

  Preventive controls are concerned with avoiding occurrences of risks while deterrent controls are concerned with discouraging violations. Detecting controls identify occurrences and compensating controls are alternative controls, used to

  compensate weaknesses in other controls.

  Supervision is an example of compensating control.

  Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 968:

  If your property Insurance has Replacement Cost Valuation (RCV) clause your damaged property will be compensated:

  A. Based on the value of item on the date of loss
  B. Based on new, comparable, or identical item for old regardless of condition of lost item
  C. Based on value of item one month before the loss
  D. Based on the value listed on the Ebay auction web site
  B. Based on new, comparable, or identical item for old regardless of condition of lost item

  ---

  RCV is the maximum amount your insurance company will pay you for damage to covered property before deducting for depreciation. The RCV payment is based on the current cost to replace your property with new, identical or comparable

  property.

  The other choices were detractor:

  Application and definition of the insurance terms Replacement Cost Value (RCV), Actual Cash Value (ACV) and depreciation can be confusing. It's important that you understand the terms to help settle your claim fairly.

  An easy way to understand RCV and ACV is to think in terms of "new" and "used."

  Replacement cost is the item's current price, new. "What will it cost when I replace it?" Actual cash is the item's used price, old. "How much money is it worth since I used it for five years?"

  Hold Back

  Most policies only pay the Actual Cash Value upfront, and then they pay you the "held back" depreciation after you incur the expense to repair or replace your personal property items.

  NOTE: You must remember to send documentation to the insurance company proving you've incurred the additional expense you will be reimbursed.

  Actual Cash Value (ACV)

  ACV is the amount your insurance company will pay you for damage to covered property after deducting for depreciation. ACV is the replacement cost of a new item, minus depreciation. If stated as a simple equation, ACV could be defined as

  follows: ACV=RCV-Depreciation

  Unfortunately, ACV is not always as easy to agree upon as a simple math equation. The ACV can also be calculated as the price a willing buyer would pay for your used item.

  Depreciation

  Depreciation (sometimes called "hold back") is defined as the "loss in value from all causes, including age, and wear and tear." Although the definition seems to be clear, in our experience, value" as a real-world application is clearly subjective

  and varies widely. We have seen the same adjuster apply NO depreciation (100 percent value) on one claim and 40 percent depreciation almost half value) on an almost identical claim.

  This shows that the process of applying depreciation is subjective and clearly negotiable.

  Excessive Depreciation

  When the insurance company depreciates more than they should, it is called "Excessive depreciation." Although not ethical, it is very common. Note any items that have excessive depreciation and write a letter to your insurance company.

  References:

  http://carehelp.org/downloads/category/1-insurance-handouts.html? download=17%3Ahandout08-rcv-and- acv

  and

  http://www.schirickinsurance.com/resources/value2005.pdf

  and

  TIPTON, Harold F. and KRAUSE, MICKI, information Security Management Handbook, 4th Edition, Volume Property Insurance overview, Page 587.

• Question 969:

  The Orange Book is founded upon which security policy model?

  A. The Biba Model
  B. The Bell LaPadula Model
  C. Clark-Wilson Model
  D. TEMPEST
  B. The Bell LaPadula Model

  ---

  From the glossary of Computer Security Basics: The Bell-LaPadula model is the security policy model on which the Orange Book requirements are based. From the Orange Book definition, "A formal state transition model of computer security policy that describes a set of access control rules. In this formal model, the entities in a computer system are divided into abstract sets of subjects and objects. The notion of secure state is defined and it is proven that each state transition preserves security by moving from secure state to secure state; thus, inductively proving the system is secure. A system state is defined to be 'secure' if the only permitted access modes of subjects to objects are in accordance with a specific security policy. In order to determine whether or not a specific access mode is allowed, the clearance of a subject is compared to the classification of the object and a determination is made as to whether the subject is authorized for the specific access mode." The Biba Model is an integrity model of computer security policy that describes a set of rules. In this model, a subject may not depend on any object or other subject that is less trusted than itself. The Clark Wilson Model is an integrity model for computer security policy designed for a commercial environment. It addresses such concepts as nondiscretionary access control, privilege separation, and least privilege. TEMPEST is a government program that prevents the compromising electrical and electromagnetic signals that emanate from computers and related equipment from being intercepted and deciphered. Source: RUSSEL, Deborah and GANGEMI, G.T. Sr., Computer Security Basics, O'Reilly, 1991. Also: U.S. Department of Defense, Trusted Computer System Evaluation Criteria (Orange Book), DOD 5200.28-STD. December 1985 (also available here).

• Question 970:

  Secure Shell (SSH-2) provides all the following services except:

  A. secure remote login
  B. command execution
  C. port forwarding
  D. user authentication
  D. user authentication

  ---

  This is one of the tricky negative question. You have to pay close attention to the word EXCEPT within the question.

  The SSH transport layer is a secure, low level transport protocol. It provides strong encryption, cryptographic host authentication, and integrity protection.

  Authentication in this protocol level is host-based; this protocol does not perform user authentication. A higher level protocol for user authentication can be designed on top of this protocol.

  The protocol has been designed to be simple and flexible to allow parameter negotiation, and to minimize the number of round-trips. The key exchange method, public key algorithm, symmetric encryption algorithm, message authentication

  algorithm, and hash algorithm are all negotiated. It is expected that in most environments, only 2 round-trips will be needed for full key exchange, server authentication, service request, and acceptance notification of service request. The worst

  case is 3 round-trips.

  The following are incorrect answers:

  "Remote log-on" is incorrect. SSH does provide remote log-on.

  "Command execution" is incorrect. SSH does provide command execution. "Port forwarding" is incorrect. SSH does provide port forwarding. SSH also has a wonderful feature called SSH Port Forwarding, sometimes called SSH Tunneling, which allows you to establish a secure SSH session and then tunnel arbitrary TCP connections through it. Tunnels can be created at any time, with almost no effort and no programming, which makes them very appealing. See the article below in the reference to take a look at SSH Port Forwarding in detail, as it is a very useful but often misunderstood technology. SSH Port Forwarding can be used for secure communications in a myriad of different ways. You can see a nice tutorial on the PUTTY web site on how to use PUTTY to do port forwarding at:

  http://www.cs.uu.nl/technical/services/ssh/putty/puttyfw.html Reference(s) used for this question: RFC 4253 at https://www.ietf.org/rfc/rfc4253.txt and SSH Port Forwarding by Symantec