Latest SSCP exam dumps with real ISC questions and answers
SSCP Exam in First Attempt Guaranteed
NEW QUESTION # 613
A Security Reference Monitor relates to which DoD security standard?
- A. LC3
- B. L2TP
- C. None of the items listed
- D. D1
- E. C2
Answer: E
NEW QUESTION # 614
Which layer of the DoD TCP/IP Model ensures error-free delivery and packet sequencing?
- A. Network access layer
- B. Application layer
- C. Host-to-host
- D. Internet layer
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
This layer of the DoD Model is also sometimes called Transport in some books but the proper name is Host-to- Host as per the RFC document.
The host-to-host layer provides for reliable end-to-end communications, ensures the data's error-free delivery, handles the data's packet sequencing, and maintains the data's integrity.
It is comparable to the transport layer of the OSI model.
Reference(s) used for this question:
http://en.wikipedia.org/wiki/Internet_protocol_suite
and
http://technet.microsoft.com/en-us/library/cc786900%28v=ws.10%29.aspx
and
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 85).
NEW QUESTION # 615
In a hierarchical PKI the highest CA is regularly called Root CA, it is also referred to by which one of the following term?
- A. Master CA
- B. Big CA
- C. Subordinate CA
- D. Top Level CA
Answer: D
Explanation:
Reference: Arsenault, Turner, Internet X.509 Public Key Infrastructure: Roadmap, Chapter "Terminology".
Also note that sometimes other terms such as Certification Authority Anchor (CAA) might be used within some government organization, Top level CA is another common term to indicate the top level CA, Top Level Anchor could also be used.
NEW QUESTION # 616
What best describes a scenario when an employee has been shaving off pennies from multiple accounts and depositing the funds into his own bank account?
- A. Trojan horses
- B. Data fiddling
- C. Salami techniques
- D. Data diddling
Answer: C
Explanation:
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2001, Page 644.
NEW QUESTION # 617
Which of the following addresses a portion of the primary memory by specifying the actual address of the memory location?
- A. Indirect addressing
- B. indexed addressing
- C. implied addressing
- D. direct addressing
Answer: D
Explanation:
Explanation/Reference:
Absolute/Direct
+------+-----+--------------------------------------+
|load | reg | address |
+------+-----+--------------------------------------+
(Effective address = address as given in instruction)
This requires space in an instruction for quite a large address. It is often available on CISC machines which have variable-length instructions, such as x86.
Some RISC machines have a special Load Upper Literal instruction which places a 16-bit constant in the top half of a register. An OR literal instruction can be used to insert a 16-bit constant in the lower half of that register, so that a full 32-bit address can then be used via the register-indirect addressing mode, which itself is provided as "base-plus-offset" with an offset of 0.
http://en.wikipedia.org/wiki/Addressing_mode (Very good coverage of the subject) also see:
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, page 186.
also see:
http://www.comsci.us/ic/notes/am.html
NEW QUESTION # 618
Which is NOT a suitable method for distributing certificate revocation information?
- A. OCSP (online certificate status protocol)
- B. Delta CRL
- C. Distribution point CRL
- D. CA revocation mailing list
Answer: D
Explanation:
Explanation/Reference:
The following are incorrect answers because they are all suitable methods.
A Delta CRL is a CRL that only provides information about certificates whose statuses have changed since the issuance of a specific, previously issued CRL.
The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate.
A Distribution point CRL or CRL Distribution Point, a location specified in the CRL Distribution Point (CRL DP) X.509, version 3, certificate extension when the certificate is issued.
References:
RFC 2459: Internet X.509 Public Key Infrastru
http://csrc.nist.gov/groups/ST/crypto_apps_infra/documents/sliding_window.pdf
http://www.ipswitch.eu/online_certificate_status_protocol_en.html
Computer Security Handbook By Seymour Bosworth, Arthur E. Hutt, Michel E. Kabay http:// books.google.com/books?id=rCx5OfSFUPkC&printsec=frontcover&dq=Computer+Security
+Handbook#PRA6-PA4,M1
NEW QUESTION # 619
In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?
- A. Analysis and tracking
- B. Triage
- C. Recovery
- D. Containment
Answer: A
Explanation:
In this step, your main objective is to examine and analyze what has occurred and focus on determining the root cause of the incident.
Recovery is incorrect as recovery is about resuming operations or bringing affected systems back into production
Containment is incorrect as containment is about reducing the potential impact of an incident.
Triage is incorrect as triage is about determining the seriousness of the incident and filtering out false positives
Reference:
Official Guide to the CISSP CBK, pages 700-704
NEW QUESTION # 620
Which of the following statements pertaining to IPSec is incorrect?
- A. IPSec protects against man-in-the-middle attacks.
- B. IPSec provides confidentiality and integrity to information transferred over IP networks through transport layer encryption and authentication.
- C. IPSec can help in protecting networks from some of the IP network attacks.
- D. IPSec protects against spoofing.
Answer: B
Explanation:
Explanation/Reference:
IPSec provides confidentiality and integrity to information transferred over IP networks through network (not transport) layer encryption and authentication. All other statements are correct.
Source: TIPTON, Harold F & KRAUSE, Micki, Information Security Management Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 6, Extranet Access Control Issues (page 110).
NEW QUESTION # 621
In biometrics, the "one-to-one" search used to verify claim to an identity made by a person is considered:
- A. Auditing
- B. Authorization
- C. Authentication
- D. Identification
Answer: C
Explanation:
Explanation/Reference:
Biometric devices can be use for either IDENTIFICATION or AUTHENTICATION ONE TO ONE is for AUTHENTICATION
This means that you as a user would provide some biometric credential such as your fingerprint. Then they will compare the template that you have provided with the one stored in the Database. If the two are exactly the same that prove that you are who you pretend to be.
ONE TO MANY is for IDENTIFICATION
A good example of this would be within airport. Many airports today have facial recognition cameras, as you walk through the airport it will take a picture of your face and then compare the template (your face) with a database full of templates and see if there is a match between your template and the ones stored in the Database. This is for IDENTIFICATION of a person.
Some additional clarification or comments that might be helpful are: Biometrics establish authentication using specific information and comparing results to expected data. It does not perform well for identification purposes such as scanning for a person's face in a moving crowd for example.
Identification methods could include: username, user ID, account number, PIN, certificate, token, smart card, biometric device or badge.
Auditing is a process of logging or tracking what was done after the identity and authentication process is completed.
Authorization is the rights the subject is given and is performed after the identity is established.
Reference OIG (2007) p148, 167
Authentication in biometrics is a "one-to-one" search to verify claim to an identity made by a person.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 38.
NEW QUESTION # 622
What does the simple integrity axiom mean in the Biba model?
- A. No read up
- B. No write down
- C. No read down
- D. No write up
Answer: C
Explanation:
Section: Access Control
Explanation/Reference:
The simple integrity axiom of the Biba access control model states that a subject at one level of integrity is not permitted to observe an object of a lower integrity (no read down).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 205).
NEW QUESTION # 623
What is a hot-site facility?
- A. A site with pre-installed computers, raised flooring, air conditioning, telecommunications and networking equipment, and UPS.
- B. A site with ready made work space with telecommunications equipment, LANs, PCs, and terminals for work groups.
- C. A site in which space is reserved with pre-installed wiring and raised floors.
- D. A site with raised flooring, air conditioning, telecommunications, and networking equipment, and UPS.
Answer: A
Explanation:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
NEW QUESTION # 624
An effective information security policy should not have which of the following characteristic?
- A. Be designed with a short- to mid-term focus
- B. Be understandable and supported by all stakeholders
- C. Specify areas of responsibility and authority
- D. Include separation of duties
Answer: A
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
An effective information security policy should be designed with a long-term focus. All other characteristics apply.
Source: ALLEN, Julia H., The CERT Guide to System and Network Security Practices, Addison-Wesley, 2001, Appendix B, Practice-Level Policy Considerations (page 397).
NEW QUESTION # 625
What is the primary role of smartcards in a PKI?
- A. Fast hardware encryption of the raw data
- B. Transparent renewal of user keys
- C. Tamper resistant, mobile storage and application of private keys of the users
- D. Easy distribution of the certificates between the users
Answer: C
Explanation:
Reference: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne, page 139;
SNYDER, J., What is a SMART CARD?.
Wikipedia has a nice definition at: http://en.wikipedia.org/wiki/Tamper_resistance
Security Tamper-resistant microprocessors are used to store and process private or sensitive information, such as private keys or electronic money credit. To prevent an attacker from retrieving or modifying the information, the chips are designed so that the information is not accessible through external means and can be accessed only by the embedded software, which should contain the appropriate security measures.
Examples of tamper-resistant chips include all secure cryptoprocessors, such as the IBM 4758 and chips used in smartcards, as well as the Clipper chip.
It has been argued that it is very difficult to make simple electronic devices secure against tampering, because numerous attacks are possible, including:
physical attack of various forms (microprobing, drills, files, solvents, etc.)
freezing the device
applying out-of-spec voltages or power surges
applying unusual clock signals
inducing software errors using radiation
measuring the precise time and power requirements of certain operations (see power analysis)
Tamper-resistant chips may be designed to zeroise their sensitive data (especially cryptographic keys) if they detect penetration of their security encapsulation or out-ofspecification environmental parameters. A chip may even be rated for "cold zeroisation", the ability to zeroise itself even after its power supply has been crippled.
Nevertheless, the fact that an attacker may have the device in his possession for as long as he likes, and perhaps obtain numerous other samples for testing and practice, means that it is practically impossible to totally eliminate tampering by a sufficiently motivated opponent. Because of this, one of the most important elements in protecting a system is overall system design. In particular, tamper-resistant systems should "fail gracefully" by ensuring that compromise of one device does not compromise the entire system. In this manner, the attacker can be practically restricted to attacks that cost less than the expected return from compromising a single device (plus, perhaps, a little more for kudos). Since the most sophisticated attacks have been estimated to cost several hundred thousand dollars to carry out, carefully designed systems may be invulnerable in practice.
NEW QUESTION # 626
Domain Name Service is a distributed database system that is used to map:
- A. MAC addresses to domain names.
- B. Domain Name to IP addresses.
- C. MAC Address to IP addresses.
- D. IP addresses to MAC Addresses.
Answer: B
Explanation:
The Domain Name Service is a distributed database system that is used to map domain names to IP addresses and IP addresses to domain names.
The Domain Name System is maintained by a distributed database system, which uses the client-server model. The nodes of this database are the name servers. Each domain has at least one authoritative DNS server that publishes information about that domain and the name servers of any domains subordinate to it. The top of the hierarchy is served by the root nameservers, the servers to query when looking up (resolving) a TLD.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 100. and https://en.wikipedia.org/wiki/Domain_Name_System
NEW QUESTION # 627
In a stateful inspection firewall, data packets are captured by an inspection engine that is operating at the:
- A. Data Link Layer.
- B. Inspection Layer.
- C. Application Layer.
- D. Network or Transport Layer.
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
Most stateful packet inspection firewalls work at the network or transport layers. For the TCP/IP protcol, this allows the firewall to make decisions both on IP addresses, protocols and TCP/UDP port numbers Application layer is incorrect. This is too high in the OSI stack for this type of firewall.
Inspection layer is incorrect. There is no such layer in the OSI stack.
"Data link layer" is incorrect. This is too low in the OSI stack for this type of firewall.
References:
CBK, p. 466
AIO3, pp. 485 - 486
NEW QUESTION # 628
A DMZ is also known as a
- A. bastion host
- B. a place to attract hackers
- C. three legged firewall
- D. screened subnet
Answer: D
Explanation:
Explanation/Reference:
This is another name for the demilitarized zone (DMZ) of a network.
"Three legged firewall" is incorrect. While a DMZ can be implemented on one leg of such a device, this is not the best answer.
"A place to attract hackers" is incorrect. The DMZ is a way to provide limited public access to an organization's internal resources (DNS, EMAIL, public web, etc) not as an attractant for hackers.
"Bastion host" is incorrect. A bastion host serves as a gateway between trusted and untrusted network.
References:
CBK, p. 434
AIO3, pp. 495 - 496
NEW QUESTION # 629
......
Exam Sure Pass ISC Certification with SSCP exam questions: https://pass4sure.actualtorrent.com/SSCP-exam-guide-torrent.html