[UPDATED 2023] Getting SSCP Certification Made Easy!
SSCP Exam Crack Test Engine Dumps Training With 1074 Questions
NEW QUESTION 404
Which of the following issues is not addressed by digital signatures?
- A. nonrepudiation
- B. denial-of-service
- C. authentication
- D. data integrity
Answer: B
Explanation:
Explanation/Reference:
A digital signature directly addresses both confidentiality and integrity of the CIA triad. It does not directly address availability, which is what denial-of-service attacks.
The other answers are not correct because:
"nonrepudiation" is not correct because a digital signature can provide for nonrepudiation.
"authentication" is not correct because a digital signature can be used as an authentication mechanism
"data integrity" is not correct because a digital signature does verify data integrity (as part of nonrepudiation)
References:
Official ISC2 Guide page: 227 & 265
All in One Third Edition page: 648
NEW QUESTION 405
Which of the following protects Kerberos against replay attacks?
- A. Tokens
- B. Time stamps
- C. Cryptography
- D. Passwords
Answer: B
Explanation:
A replay attack refers to the recording and retransmission of packets on the network. Kerberos uses time stamps, which protect against this type of attack.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 8: Cryptography (page 581).
NEW QUESTION 406
Which of the following is NOT a characteristic of a host-based intrusion detection system?
- A. A HIDS can analyse system logs, processes and resources
- B. A HIDS does not consume large amounts of system resources
- C. A HIDS can notify system administrators when unusual events are identified
- D. A HIDS looks for unauthorized changes to the system
Answer: B
Explanation:
A HIDS does not consume large amounts of system resources is the correct choice. HIDS can consume inordinate amounts of CPU and system resources in order to function effectively, especially during an event.
All the other answers are characteristics of HIDSes
A HIDS can:
scrutinize event logs, critical system files, and other auditable system resources; look for unauthorized change or suspicious patterns of behavior or activity can send alerts when unusual events are discovered
Reference:
Official guide to the CISSP CBK. Pages 197 to 198.
NEW QUESTION 407
The Reference Validation Mechanism that ensures the authorized access relationships between subjects and objects is implementing which of the following concept:
- A. Discretionary Access Control.
- B. Mandatory Access Control.
- C. The Security Kernel.
- D. The reference monitor.
Answer: D
Explanation:
The reference monitor concept is an abstract machine that ensures that all subjects have the necessary access rights before accessing objects. Therefore, the kernel will mediates all accesses to objects by subjects and will do so by validating through the reference monitor concept.
The kernel does not decide whether or not the access will be granted, it will be the Reference Monitor which is a subset of the kernel that will say YES or NO.
All access requests will be intercepted by the Kernel, validated through the reference monitor, and then access will either be denied or granted according to the request and the subject privileges within the system.
1.The reference monitor must be small enough to be full tested and valided
2.The Kernel must MEDIATE all access request from subjects to objects
3.The processes implementing the reference monitor must be protected
4.The reference monitor must be tamperproof
The following answers are incorrect:
The security kernel is the mechanism that actually enforces the rules of the reference monitor concept.
The other answers are distractors.
Shon Harris, All In One, 5th Edition, Security Architecture and Design, Page 330 also see http://en.wikipedia.org/wiki/Reference_monitor
NEW QUESTION 408
Which of the following is an advantage that UDP has over TCP?
- A. UDP is more reliable than TCP.
- B. UDP is faster than TCP.
- C. UDP is connection-oriented whereas TCP is not.
- D. UDP makes a better effort to deliver packets.
Answer: B
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
UDP is a scaled-down version of TCP. It is used like TCP, but only offers a "best effort" delivery. It is connectionless, does not offer error correction, does not sequence the packet segments, and less reliable than TCP but because of its lower overhead, it provides a faster transmission than TCP.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
86).
NEW QUESTION 409
What is a packet sniffer?
- A. It monitors network traffic for illegal packets.
- B. It scans network segments for cabling faults.
- C. It tracks network connections to off-site locations.
- D. It captures network traffic for later analysis.
Answer: D
Explanation:
Explanation/Reference:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
NEW QUESTION 410
Which of the following best defines a Computer Security Incident Response Team (CSIRT)?
- A. An organization that disseminates incident-related information to its constituency and other involved parties.
- B. An organization that coordinates and supports the response to security incidents.
- C. An organization that provides a secure channel for receiving reports about suspected security incidents.
- D. An organization that ensures that security incidents are reported to the authorities.
Answer: B
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
RFC 2828 (Internet Security Glossary) defines a Computer Security Incident Response Team (CSIRT) as an organization that coordinates and supports the response to security incidents that involves sites within a defined constituency. This is the proper definition for the CSIRT. To be considered a CSIRT, an organization must provide a secure channel for receiving reports about suspected security incidents, provide assistance to members of its constituency in handling the incidents and disseminate incident-related information to its constituency and other involved parties. Security-related incidents do not necessarily have to be reported to the authorities.
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
NEW QUESTION 411
When attempting to establish Liability, which of the following would be describe as performing the ongoing maintenance necessary to keep something in proper working order, updated, effective, or to abide by what is commonly expected in a situation?
- A. Due care
- B. Due practice
- C. Due diligence
- D. Due concern
Answer: A
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
My friend JD Murray at Techexams.net has a nice definition of both, see his explanation below:
Oh, I hate these two. It's like describing the difference between "jealously" and "envy." Kinda the same thing but not exactly. Here it goes:
Due diligence is performing reasonable examination and research before committing to a course of action.
Basically, "look before you leap." In law, you would perform due diligence by researching the terms of a contract before signing it. The opposite of due diligence might be "haphazard" or "not doing your homework." Due care is performing the ongoing maintenance necessary to keep something in proper working order, or to abide by what is commonly expected in a situation. This is especially important if the due care situation exists because of a contract, regulation, or law. The opposite of due care is "negligence." In summary, Due Diligence is Identifying threats and risks while Due Care is Acting upon findings to mitigate risks EXAM TIP:
The Due Diligence refers to the steps taken to identify risks that exists within the environment. This is base on best practices, standards such as ISO 27001, ISO 17799, and other consensus. The first letter of the word Due and the word Diligence should remind you of this. The two letters are DD = Do Detect.
In the case of due care, it is the actions that you have taken (implementing, designing, enforcing, updating) to reduce the risks identified and keep them at an acceptable level. The same apply here, the first letters of the work Due and the work Care are DC. Which should remind you that DC = Do correct.
The other answers are only detractors and not valid.
Reference(s) used for this question:
CISSP Study Guide, Syngress, By Eric Conrad, Page 419
HARRIS, Shon, All-In-One CISSP Certification Exam Guide Fifth Edition, McGraw-Hill, Page 49 and 110.
and
Corporate; (Isc)² (2010-04-20). Official (ISC)2 Guide to the CISSP CBK, Second Edition ((ISC)2 Press) (Kindle Locations 11494-11504). Taylor & Francis. Kindle Edition.
and
My friend JD Murray at Techexams.net
NEW QUESTION 412
CORRECT TEXT
Name two types of Intrusion Detection Systems ________ and ________.
Answer:
Explanation:
based, network based
NEW QUESTION 413
Which of the following is a set of data processing elements that increases the performance in a computer by overlapping the steps of different instructions?
- A. complex-instruction-set-computer (CISC)
- B. pipelining
- C. reduced-instruction-set-computer (RISC)
- D. multitasking
Answer: B
Explanation:
Explanation/Reference:
Pipelining is a natural concept in everyday life, e.g. on an assembly line. Consider the assembly of a car:
assume that certain steps in the assembly line are to install the engine, install the hood, and install the wheels (in that order, with arbitrary interstitial steps). A car on the assembly line can have only one of the three steps done at once. After the car has its engine installed, it moves on to having its hood installed, leaving the engine installation facilities available for the next car. The first car then moves on to wheel installation, the second car to hood installation, and a third car begins to have its engine installed. If engine installation takes 20 minutes, hood installation takes 5 minutes, and wheel installation takes 10 minutes, then finishing all three cars when only one car can be assembled at once would take 105 minutes. On the other hand, using the assembly line, the total time to complete all three is 75 minutes. At this point, additional cars will come off the assembly line at 20 minute increments.
In computing, a pipeline is a set of data processing elements connected in series, so that the output of one element is the input of the next one. The elements of a pipeline are often executed in parallel or in time- sliced fashion; in that case, some amount of buffer storage is often inserted between elements. Pipelining is used in processors to allow overlapping execution of multiple instructions within the same circuitry. The circuitry is usually divided into stages, including instruction decoding, arithmetic, and register fetching stages, wherein each stage processes one instruction at a time.
The following were not correct answers:
CISC: is a CPU design where single instructions execute several low-level operations (such as a load from memory, an arithmetic operation, and a memory store) within a single instruction.
RISC: is a CPU design based on simplified instructions that can provide higher performance as the simplicity enables much faster execution of each instruction.
Multitasking: is a method where multiple tasks share common processing resources, such as a CPU, through a method of fast scheduling that gives the appearance of parallelism, but in reality only one task is being performed at any one time.
Reference:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, pages 188-189.
Also see
http://en.wikipedia.org/wiki/Pipeline_(computing)
NEW QUESTION 414
This type of backup management provides a continuous on-line backup by using optical or tape "jukeboxes," similar to WORMs (Write Once, Read Many):
- A. Hierarchical Instance Management (HIM).
- B. Hierarchical Resource Management (HRM).
- C. Hierarchical Access Management (HAM).
- D. Hierarchical Storage Management (HSM).
Answer: D
Explanation:
Hierarchical Storage Management (HSM) provides a continuous on-line
backup by using optical or tape "jukeboxes," similar to WORMs.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 71.
NEW QUESTION 415
Which of the following protects Kerberos against replay attacks?
- A. Tokens
- B. Time stamps
- C. Cryptography
- D. Passwords
Answer: B
Explanation:
Explanation/Reference:
A replay attack refers to the recording and retransmission of packets on the network. Kerberos uses time stamps, which protect against this type of attack.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter
8: Cryptography (page 581).
NEW QUESTION 416
The communications products and services, which ensure that the various components of a network (such as devices, protocols, and access methods) work together refers to:
- A. Netware Architecture.
- B. Network Architecture.
- C. Multiprotocol Architecture.
- D. WAN Architecture.
Answer: B
Explanation:
A Network Architecture refers to the communications products and services, which ensure that the various components of a network (such as devices, protocols, and access methods) work together.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 101.
NEW QUESTION 417
Which of the following is a CHARACTERISTIC of a decision support system (DSS) in regards to Threats and Risks Analysis?
- A. DSS combines the use of models with non-traditional data access and retrieval functions.
- B. DSS emphasizes flexibility in the decision making approach of users.
- C. DSS supports only structured decision-making tasks.
- D. DSS is aimed at solving highly structured problems.
Answer: B
Explanation:
DSS emphasizes flexibility in the decision-making approach of users. It is
aimed at solving less structured problems, combines the use of models and analytic
techniques with traditional data access and retrieval functions and supports semi-structured
decision-making tasks.
DSS is sometimes referred to as the Delphi Method or Delphi Technique:
The Delphi technique is a group decision method used to ensure that each member gives
an honest opinion of what he or she thinks the result of a particular threat will be. This
avoids a group of individuals feeling pressured to go along with others' thought processes
and enables them to participate in an independent and anonymous way. Each member of
the group provides his or her opinion of a certain threat and turns it in to the team that is
performing the analysis. The results are compiled and distributed to the group members,
who then write down their comments anonymously and return them to the analysis group.
The comments are compiled and redistributed for more comments until a consensus is
formed. This method is used to obtain an agreement on cost, loss values, and probabilities
of occurrence without individuals having to agree verbally.
Here is the ISC2 book coverage of the subject:
One of the methods that uses consensus relative to valuation of information is the
consensus/modified Delphi method. Participants in the valuation exercise are asked to
comment anonymously on the task being discussed. This information is collected and
disseminated to a participant other than the original author. This participant comments
upon the observations of the original author. The information gathered is discussed in a
public forum and the best course is agreed upon by the group (consensus).
EXAM TIP:
The DSS is what some of the books are referring to as the Delphi Method or Delphi
Technique. Be familiar with both terms for the purpose of the exam.
The other answers are incorrect:
'DSS is aimed at solving highly structured problems' is incorrect because it is aimed at
solving less structured problems.
'DSS supports only structured decision-making tasks' is also incorrect as it supports semi-
structured decision-making tasks.
'DSS combines the use of models with non-traditional data access and retrieval functions'
is also incorrect as it combines the use of models and analytic techniques with traditional
data access and retrieval functions.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 91). McGraw-Hill.
Kindle Edition.
and
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :
Information Security Governance and Risk Management ((ISC)2 Press) (Kindle Locations
1424-1426). Auerbach Publications. Kindle Edition.
NEW QUESTION 418
Frame relay uses a public switched network to provide:
- A. Metropolitan Area Network (MAN) connectivity.
- B. Local Area Network (LAN) connectivity.
- C. World Area Network (WAN) connectivity.
- D. Wide Area Network (WAN) connectivity.
Answer: D
Explanation:
Frame relay uses a public switched network to provide Wide Area Network
(WAN) connectivity.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 73.
NEW QUESTION 419
What can best be described as an abstract machine which must mediate all access to subjects to objects?
- A. The security kernel
- B. A security domain
- C. The security perimeter
- D. The reference monitor
Answer: D
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
The reference monitor is an abstract machine which must mediate all access to subjects to objects, be protected from modification, be verifiable as correct, and is always invoked. The security kernel is the hardware, firmware and software elements of a trusted computing base that implement the reference monitor concept. The security perimeter includes the security kernel as well as other security-related system functions that are within the boundary of the trusted computing base. System elements that are outside of the security perimeter need not be trusted. A security domain is a domain of trust that shares a single security policy and single management.
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
NEW QUESTION 420
Which of the following encryption methods is known to be unbreakable?
- A. DES codebooks.
- B. Elliptic Curve Cryptography.
- C. Symmetric ciphers.
- D. One-time pads.
Answer: D
Explanation:
Section: Cryptography
Explanation/Reference:
A One-Time Pad uses a keystream string of bits that is generated completely at random that is used only once.
Because it is used only once it is considered unbreakable.
The following answers are incorrect:
Symmetric ciphers. This is incorrect because a Symmetric Cipher is created by substitution and transposition.
They can and have been broken
DES codebooks. This is incorrect because Data Encryption Standard (DES) has been broken, it was replaced by Advanced Encryption Standard (AES).
Elliptic Curve Cryptography. This is incorrect because Elliptic Curve Cryptography or ECC is typically used on wireless devices such as cellular phones that have small processors. Because of the lack of processing power the keys used at often small. The smaller the key, the easier it is considered to be breakable. Also, the technology has not been around long enough or tested thourough enough to be considered truly unbreakable.
NEW QUESTION 421
Which of the following is given the responsibility of the maintenance and protection of the data?
- A. User
- B. Security administrator
- C. Data custodian
- D. Data owner
Answer: C
Explanation:
It is usually responsible for maintaining and protecting the data.
The following answers are incorrect:
Data owner is usually a member of management , in charge of a specific business unit and
is ultimately responsible for the protection and use of the information.
User is any individual who routinely uses the data for work-related tasks.
Security administrator's tasks include creating new system user accounts , implementing
new security software.
References : Shon Harris AIO v3 , Chapter - 3: Security Management Practices , Pages :
99 - 103
NEW QUESTION 422
What can a packet filtering firewall also be called?
- A. a shielding router
- B. a scanning router
- C. a sniffing router
- D. a screening router
Answer: D
Explanation:
Explanation/Reference:
While neither CBK nor AIO3 use the term "screening router," they both discuss how the packet filtering capabilities of a router can be used to block traffic much like a packet filtering firewall. Krutz and Vine use this term on p. 90.
"A scanning router" is incorrect. This is a nonsense term to distract you.
"A shielding router" is incorrect. This is a nonsense term to distract you.
"A sniffing router" is incorrect. This is a nonsense term to distract you.
References:
CBK, p. 433
AIO3, pp.484 - 485
NEW QUESTION 423
Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?
- A. 192.175.42.5
- B. 192.1.42.5
- C. 192.166.42.5
- D. 192.168.42.5
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
This is a valid Class C reserved address. For Class C, the reserved addresses are 192.168.0.0 -
192.168.255.255.
The private IP address ranges are defined within RFC 1918:
RFC 1918 private ip address range
The following answers are incorrect:
192.166.42.5 Is incorrect because it is not a Class C reserved address.
192.175.42.5 Is incorrect because it is not a Class C reserved address.
192.1.42.5 Is incorrect because it is not a Class C reserved address.
NEW QUESTION 424
Considerations of privacy, invasiveness, and psychological and physical comfort when using the system are important elements for which of the following?
- A. Adaptability of biometrics systems
- B. Accountability of biometrics systems
- C. Acceptability of biometrics systems
- D. Availability of biometrics systems
Answer: C
Explanation:
Explanation/Reference:
Acceptability refers to considerations of privacy, invasiveness, and psychological and physical comfort when using the system.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 39.
NEW QUESTION 425
Qualitative loss resulting from the business interruption does NOT usually include:
- A. Loss of market leadership
- B. Loss of public confidence and credibility
- C. Loss of revenue
- D. Loss of competitive advantage or market share
Answer: C
Explanation:
Explanation/Reference:
This question is testing your ability to evaluate whether items on the list are Qualitative or Quantitative. All of the items listed were Qualitative except Lost of Revenue which is Quantitative.
Those are mainly two approaches to risk analysis, see a description of each below:
A quantitative risk analysis is used to assign monetary and numeric values to all elements of the risk analysis process. Each element within the analysis (asset value, threat frequency, severity of vulnerability, impact damage, safeguard costs, safeguard effectiveness, uncertainty, and probability items) is quantified and entered into equations to determine total and residual risks. It is more of a scientific or mathematical approach to risk analysis compared to qualitative.
A qualitative risk analysis uses a "softer" approach to the data elements of a risk analysis . It does not quantify that data, which means that it does not assign numeric values to the data so that they can be used in equations.
Qualitative and quantitative impact information should be gathered and then properly analyzed and interpreted. The goal is to see exactly how a business will be affected by different threats.
The effects can be economical, operational, or both. Upon completion of the data analysis, it should be reviewed with the most knowledgeable people within the company to ensure that the findings are appropriate and that it describes the real risks and impacts the organization faces. This will help flush out any additional data points not originally obtained and will give a fuller understanding of all the possible business impacts.
Loss criteria must be applied to the individual threats that were identified. The criteria may include the following:
Loss in reputation and public confidence
Loss of competitive advantages
Increase in operational expenses
Violations of contract agreements
Violations of legal and regulatory requirements
Delayed income costs
Loss in revenue
Loss in productivity
Reference used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 909). McGraw-Hill. Kindle Edition.
NEW QUESTION 426
An application layer firewall is also called a:
- A. A Presentation Layer Gateway.
- B. A Session Layer Gateway.
- C. A Transport Layer Gateway.
- D. Proxy
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
An application layer firewall can also be called a proxy.
"A presentation layer gateway" is incorrect. A gateway connects two unlike environments and is usually required to translate between diffferent types of applications or protocols. This is not the function of a firewall.
"A session layer gateway" is incorrect. A gateway connects two unlike environments and is usually required to translate between diffferent types of applications or protocols. This is not the function of a firewall.
"A transport layer gateway" is incorrect. A gateway connects two unlike environments and is usually required to translate between diffferent types of applications or protocols. This is not the function of a firewall.
References:
CBK, p. 467
AIO3, pp. 486 - 490, 960
NEW QUESTION 427
The Diffie-Hellman algorithm is primarily used to provide which of the following?
- A. Key Agreement
- B. Non-repudiation
- C. Integrity
- D. Confidentiality
Answer: A
Explanation:
Diffie and Hellman describe a means for two parties to agree upon a shared secret in such a way that the secret will be unavailable to eavesdroppers. This secret may then be converted into cryptographic keying material for other (symmetric) algorithms. A large number of minor variants of this process exist. See RFC 2631 Diffie-Hellman Key Agreement Method for more details.
In 1976, Diffie and Hellman were the first to introduce the notion of public key cryptography, requiring a system allowing the exchange of secret keys over non-secure channels. The Diffie-Hellman algorithm is used for key exchange between two parties communicating with each other, it cannot be used for encrypting and decrypting messages, or digital signature. Diffie and Hellman sought to address the issue of having to exchange keys via courier and other unsecure means. Their efforts were the FIRST asymmetric key agreement algorithm. Since the Diffie-Hellman algorithm cannot be used for encrypting and decrypting it cannot provide confidentiality nor integrity. This algorithm also does not provide for digital signature functionality and thus non-repudiation is not a choice.
NOTE: The DH algorithm is susceptible to man-in-the-middle attacks.
KEY AGREEMENT VERSUS KEY EXCHANGE A key exchange can be done multiple way. It can be done in person, I can generate a key and then encrypt the key to get it securely to you by encrypting it with your public key. A Key Agreement protocol is done over a public medium such as the internet using a mathematical formula to come out with a common value on both sides of the communication link, without the ennemy being able to know what the common agreement is.
The following answers were incorrect:
All of the other choices were not correct choices
Reference(s) used for this question:
Shon Harris, CISSP All In One (AIO), 6th edition . Chapter 7, Cryptography, Page 812. http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange http://www.google.com/patents?vid=4200770
NEW QUESTION 428
......
SSCP Exam Dumps Contains FREE Real Quesions from the Actual Exam: https://pdfvce.trainingdumps.com/SSCP-valid-vce-dumps.html
