ISC SSCP Online Practice Questions and Exam Preparation

ISC SSCP Online Questions & Answers

• Question 971:

  Unshielded Twisted Pair cabling is a:

  A. four-pair wire medium that is used in a variety of networks.
  B. three-pair wire medium that is used in a variety of networks.
  C. two-pair wire medium that is used in a variety of networks.
  D. one-pair wire medium that is used in a variety of networks.
  A. four-pair wire medium that is used in a variety of networks.

  ---

  Unshielded Twisted Pair cabling is a four-pair wire medium that is used in a variety of networks.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 101.

• Question 972:

  What size is an MD5 message digest (hash)?

  A. 128 bits
  B. 160 bits
  C. 256 bits
  D. 128 bytes
  A. 128 bits

  ---

  MD5 is a one-way hash function producing a 128-bit message digest from the input message, through 4 rounds of transformation. MD5 is specified as an Internet Standard (RFC1312). Reference(s) used for this question:

  TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

• Question 973:

  Who first described the DoD multilevel military security policy in abstract, formal terms?

  A. David Bell and Leonard LaPadula
  B. Rivest, Shamir and Adleman
  C. Whitfield Diffie and Martin Hellman
  D. David Clark and David Wilson
  A. David Bell and Leonard LaPadula

  ---

  It was David Bell and Leonard LaPadula who, in 1973, first described the DoD multilevel military security policy in abstract, formal terms. The Bell-LaPadula is a Mandatory Access Control (MAC) model concerned with confidentiality. Rivest, Shamir and Adleman (RSA) developed the RSA encryption algorithm. Whitfield Diffie and Martin Hellman published the Diffie-Hellman key agreement algorithm in 1976. David Clark and David Wilson developed the Clark-Wilson integrity model, more appropriate for security in commercial activities.

  Source: RUSSEL, Deborah and GANGEMI, G.T. Sr., Computer Security Basics, O'Reilly, July 1992 (pages 78,109).

• Question 974:

  What does the (star) integrity axiom mean in the Biba model?

  A. No read up
  B. No write down
  C. No read down
  D. No write up
  D. No write up

  ---

  The (star) integrity axiom of the Biba access control model states that an object at one level of integrity is not permitted to modify an object of a higher level of integrity (no write up). Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 5: Security Architectures and Models (page 205).

• Question 975:

  Which of the following usually provides reliable, real-time information without consuming network or host resources?

  A. network-based IDS
  B. host-based IDS
  C. application-based IDS
  D. firewall-based IDS
  A. network-based IDS

  ---

  A network-based IDS usually provides reliable, real-time information without consuming network or host resources.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 48.

• Question 976:

  Which of the following tape formats can be used to backup data systems in addition to its original intended audio uses?

  A. Digital Video Tape (DVT).
  B. Digital Analog Tape (DAT).
  C. Digital Voice Tape (DVT).
  D. Digital Audio Tape (DAT).
  D. Digital Audio Tape (DAT).

  ---

  Digital Audio Tape (DAT) can be used to backup data systems in addition to its original intended audio uses.

  Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 70.

• Question 977:

  Which of the following statements pertaining to the Bell-LaPadula is TRUE if you are NOT making use of the strong star property?

  A. It allows "read up."
  B. It addresses covert channels.
  C. It addresses management of access controls.
  D. It allows "write up."
  D. It allows "write up."

  ---

  BellLaPadula Confidentiality Model10 The BellLaPadula model is perhaps the most well- known and significant security model, in addition to being one of the oldest models used in the creation of modern secure computing systems. Like the

  Trusted Computer System Evaluation Criteria (or TCSEC), it was inspired by early U.S. Department of Defense security policies and the need to prove that confidentiality could be maintained. In other words, its primary goal is to prevent

  disclosure as the model system moves from one state (one point in time) to another. When the strong star property is not being used it means that both the property and the Simple Security Property rules would be applied.

  The Star (*) property rule of the Bell-LaPadula model says that subjects cannot write down, this would compromise the confidentiality of the information if someone at the secret layer would write the object down to a confidential container for

  example.

  The Simple Security Property rule states that the subject cannot read up which means that a subject at the secret layer would not be able to access objects at Top Secret for example.

  You must remember: The model tells you about are NOT allowed to do. Anything else would be allowed. For example within the Bell LaPadula model you would be allowed to write up as it does not compromise the security of the information.

  In fact it would upgrade it to the point that you could lock yourself out of your own information if you have only a secret security clearance.

  The following are incorrect answers because they are all FALSE:

  "It allows read up" is incorrect. The "simple security" property forbids read up.

  "It addresses covert channels" is incorrect. Covert channels are not addressed by the Bell- LaPadula model.

  "It addresses management of access controls" is incorrect. Management of access controls are beyond the scope of the Bell-LaPadula model.

  Reference(s) used for this question:

  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 17595-17600). Auerbach Publications. Kindle Edition.

• Question 978:

  Which of the following is used by RADIUS for communication between clients and servers?

  A. TCP
  B. SSL
  C. UDP
  D. SSH
  C. UDP

  ---

  Source: TIPTON, Harold F. and KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 2, 2001, CRC Press, NY, Page 33.

• Question 979:

  Which of the following is less likely to be used today in creating a Virtual Private Network?

  A. L2TP
  B. PPTP
  C. IPSec
  D. L2F
  D. L2F

  ---

  L2F (Layer 2 Forwarding) provides no authentication or encryption. It is a Protocol that supports the creation of secure virtual private dial-up networks over the Internet. At one point L2F was merged with PPTP to produce L2TP to be used on networks and not only on dial up links. IPSec is now considered the best VPN solution for IP environments. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 8: Cryptography (page 507).

• Question 980:

  Which of the following biometric devices offers the LOWEST CER?

  A. Keystroke dynamics
  B. Voice verification
  C. Iris scan
  D. Fingerprint
  C. Iris scan

  ---

  From most effective (lowest CER) to least effective (highest CER) are:

  Iris scan, fingerprint, voice verification, keystroke dynamics.

  Reference : Shon Harris Aio v3 , Chapter-4 : Access Control , Page : 131

  Also see: http://www.sans.org/reading_room/whitepapers/authentication/biometric-selection- body-parts- online_139