Mar 13, 2024 Updated SSCP Dumps Questions For ISC Exam
Best Value Available Preparation Guide for SSCP Exam
NEW QUESTION # 294
Which of the following is NOT an advantage that TACACS+ has over TACACS?
- A. Ability for security tokens to be resynchronized
- B. Event logging
- C. User has the ability to change his password
- D. Use of two-factor password authentication
Answer: B
Explanation:
Section: Access Control
Explanation/Reference:
Although TACACS+ provides better audit trails, event logging is a service that is provided with TACACS.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
121).
NEW QUESTION # 295
Which of the following issues is not addressed by digital signatures?
- A. denial-of-service
- B. nonrepudiation
- C. data integrity
- D. authentication
Answer: A
Explanation:
Section: Cryptography
Explanation/Reference:
A digital signature directly addresses both confidentiality and integrity of the CIA triad. It does not directly address availability, which is what denial-of-service attacks.
The other answers are not correct because:
"nonrepudiation" is not correct because a digital signature can provide for nonrepudiation.
"authentication" is not correct because a digital signature can be used as an authentication mechanism
"data integrity" is not correct because a digital signature does verify data integrity (as part of nonrepudiation) References:
Official ISC2 Guide page: 227 & 265
All in One Third Edition page: 648
NEW QUESTION # 296
A proxy is considered a:
- A. fourth generation firewall.
- B. third generation firewall.
- C. second generation firewall.
- D. first generation firewall.
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
The proxy (application layer firewall, circuit level proxy, or application proxy ) is a second generation firewall
"First generation firewall" incorrect. A packet filtering firewall is a first generation firewall.
"Third generation firewall" is incorrect. Stateful Firewall are considered third generation firewalls
"Fourth generation firewall" is incorrect. Dynamic packet filtering firewalls are fourth generation firewalls References:
CBK, p. 464
AIO3, pp. 482 - 484
Neither CBK or AIO3 use the generation terminology for firewall types but you will encounter it frequently as a practicing security professional. See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/centri4/user/ scf4ch3.htm for a general discussion of the different generations.
NEW QUESTION # 297
The standard server port number for HTTP is which of the following?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
Explanation/Reference:
HTTP is Port 80.
Reference: MAIWALD, Eric, Network Security: A Beginner's Guide, McGraw-Hill/Osborne Media, 2001, page 135.
NEW QUESTION # 298
What is the role of IKE within the IPsec protocol?
- A. data signature
- B. enforcing quality of service
- C. peer authentication and key exchange
- D. data encryption
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation
Explanation/Reference: RFC 2409: The Internet Key Exchange (IKE); DORASWAMY, Naganand & HARKINS, Dan, Ipsec:
The New Security Standard for the Internet, Intranets, and Virtual Private Networks, 1999, Prentice Hall PTR; SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.
NEW QUESTION # 299
Which of the following is NOT a defined ISO basic task related to network management?
- A. Accounting resources
- B. Communications management
- C. Security management
- D. Fault management
Answer: B
Explanation:
ISO has defined five basic tasks related to network management :
Fault management: Detects the devices that present some kind of fault.
Configuration management: Allows users to know, define and change remotely the
configuration of any device.
Accounting resources: Holds the records of the resource usage in the WAN.
Performance management: Monitors usage levels and sets alarms when a threshold has
been surpassed.
Security management: Detects suspicious traffic or users and generates alarms
accordingly.
Source: Information Systems Audit and Control Association, Certified Information Systems
Auditor 2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices
(page 137).
NEW QUESTION # 300
What IDS approach relies on a database of known attacks?
- A. Behavior-based intrusion detection
- B. Statistical anomaly-based intrusion detection
- C. Signature-based intrusion detection
- D. Network-based intrusion detection
Answer: C
Explanation:
Explanation/Reference:
A weakness of the signature-based (or knowledge-based) intrusion detection approach is that only attack signatures that are stored in a database are detected. Network-based intrusion detection can either be signature-based or statistical anomaly-based (also called behavior-based).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 49).
NEW QUESTION # 301
What ISO/OSI layer do switches primarily operate at?
Do take note that this question makes reference to a plain vanilla switch and not one of the smart switches that is available on the market today.
- A. Network layer
- B. Physical layer
- C. Session layer
- D. Data link layer
Answer: D
Explanation:
Explanation/Reference:
Switches primarily operate at the data link layer (layer 2), although intelligent, extremely fast Layer 3 switching techniques are being more frequently used.
Source: KRUTZ, Ronald L & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
111).
NEW QUESTION # 302
A ___________ is a program that poses as a useful or legitimate program, but turns out to be malicious code.
- A. Trojan Horse
- B. Worm
- C. Polymorphic Virus
- D. Logic Bomb
Answer: A
NEW QUESTION # 303
How many bits is the effective length of the key of the Data Encryption Standard algorithm?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Explanation/Reference:
The correct answer is "56". This is actually a bit of a trick question, since the actual key length is 64 bits.
However, every eighth bit is ignored because it is used for parity. This makes the "effective length of the key" that the question actually asks for 56 bits.
The other answers are not correct because:
168 - This is the number of effective bits in Triple DES (56 times 3).
128 - Many encryption algorithms use 128 bit key, but not DES. Note that you may see 128 bit encryption referred to as "military strength encryption" because many military systems use key of this length.
64 - This is the actual length of a DES encryption key, but not the "effective length" of the DES key.
Reference:
Official ISC2 Guide page: 238
All in One Third Edition page: 622
NEW QUESTION # 304
Which of the following categories of hackers poses the greatest threat?
- A. Disgruntled employees
- B. Corporate spies
- C. Criminal hackers
- D. Student hackers
Answer: A
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
According to the authors, hackers fall in these categories, in increasing threat order: security experts, students, underemployed adults, criminal hackers, corporate spies and disgruntled employees.
Disgruntled employees are the most dangerous security problem of all because they are most likely to have a good knowledge of the organization's IT systems and security measures.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 2: Hackers.
NEW QUESTION # 305
Which of the following is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length?
- A. Coaxial cable
- B. Twisted Pair cable
- C. Fiber Optic cable
- D. Axial cable
Answer: C
Explanation:
Explanation/Reference:
Fiber Optic cable is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length (up to two kilometers in some cases).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 72.
NEW QUESTION # 306
Application Layer Firewalls operate at the:
- A. OSI protocol Layer four, the Transport Layer.
- B. OSI protocol Layer seven, the Application Layer.
- C. OSI protocol Layer five, the Session Layer.
- D. OSI protocol Layer six, the Presentation Layer.
Answer: B
Explanation:
Explanation/Reference:
Since the application layer firewall makes decisions based on application-layer information in the packet, it operates at the application layer of the OSI stack.
"OSI protocol layer 6, the presentation layer" is incorrect. The application layer firewall must have access to the application layer information in the packet and therefore operates at the application layer.
"OSI protocol layer 5, the session layer" is incorrect. The application layer firewall must have access to the application layer information in the packet and therefore operates at the application layer.
"OSI protocol layer 4, the transport layer" is incorrect. The application layer firewall must have access to the application layer information in the packet and therefore operates at the application layer.
References:
CBK, p. 467
AIO3, pp.488 - 490
NEW QUESTION # 307
Which of the following terms can be described as the process to conceal data into another file or media in a practice known as security through obscurity?
- A. Encryption
- B. ADS - Alternate Data Streams
- C. NTFS ADS
- D. Steganography
Answer: D
Explanation:
Explanation/Reference:
It is the art and science of encoding hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message or could claim there is a message.
It is a form of security through obscurity.
The word steganography is of Greek origin and means "concealed writing." It combines the Greek words steganos (στεγανός), meaning "covered or protected," and graphei (γραφή) meaning "writing." The first recorded use of the term was in 1499 by Johannes Trithemius in his Steganographia, a treatise on cryptography and steganography, disguised as a book on magic. Generally, the hidden messages will appear to be (or be part of) something else: images, articles, shopping lists, or some other cover text. For example, the hidden message may be in invisible ink between the visible lines of a private letter.
The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable, will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message.
It is sometimes referred to as Hiding in Plain Sight. This image of trees blow contains in it another image of a cat using Steganography.
ADS Tree with Cat inside
This image below is hidden in the picture of the trees above:
Hidden Kitty
As explained here the image is hidden by removing all but the two least significant bits of each color component and subsequent normalization.
ABOUT MSF and LSF
One of the common method to perform steganography is by hiding bits within the Least Significant Bits of a media (LSB) or what is sometimes referred to as Slack Space. By modifying only the least significant bit, it is not possible to tell if there is an hidden message or not looking at the picture or the media. If you would change the Most Significant Bits (MSB) then it would be possible to view or detect the changes just by looking at the picture. A person can perceive only up to 6 bits of depth, bit that are changed past the first sixth bit of the color code would be undetectable to a human eye.
If we make use of a high quality digital picture, we could hide six bits of data within each of the pixel of the image. You have a color code for each pixel composed of a Red, Green, and Blue value. The color code is 3 sets of 8 bits each for each of the color. You could change the last two bit to hide your data. See below a color code for one pixel in binary format. The bits below are not real they are just example for illustration purpose:
RED GREEN BLUE
0101 0101 1100 1011 1110 0011
MSB LSB MSB LSB MSB LSB
Let's say that I would like to hide the letter A uppercase within the pixels of the picture. If we convert the letter "A" uppercase to a decimal value it would be number 65 within the ASCII table , in binary format the value 65 would translet to 01000001
You can break the 8 bits of character A uppercase in group of two bits as follow: 01 00 00 01 Using the pixel above we will hide those bits within the last two bits of each of the color as follow:
RED GREEN BLUE
0101 0101 1100 1000 1110 0000
MSB LSB MSB LSB MSB LSB
As you can see above, the last two bits of RED was already set to the proper value of 01, then we move to the GREEN value and we changed the last two bit from 11 to 00, and finally we changed the last two bits of blue to 00. One pixel allowed us to hide 6 bits of data. We would have to use another pixel to hide the remaining two bits.
The following answers are incorrect:
- ADS - Alternate Data Streams: This is almost correct but ADS is different from steganography in that ADS hides data in streams of communications or files while Steganography hides data in a single file.
- Encryption: This is almost correct but Steganography isn't exactly encryption as much as using space in a file to store another file.
- NTFS ADS: This is also almost correct in that you're hiding data where you have space to do so. NTFS, or New Technology File System common on Windows computers has a feature where you can hide files where they're not viewable under normal conditions. Tools are required to uncover the ADS-hidden files.
The following reference(s) was used to create this question:
The CCCure Security+ Holistic Tutorial at http://www.cccure.tv
and
Steganography tool
and
http://en.wikipedia.org/wiki/Steganography
NEW QUESTION # 308
What are the components of an object's sensitivity label?
- A. A single classification and a Compartment Set.
- B. A single classification and a single compartment.
- C. A Classification Set and a single Compartment.
- D. A Classification Set and user credentials.
Answer: A
Explanation:
Both are the components of a sensitivity label.
The following are incorrect:
A Classification Set and a single Compartment. Is incorrect because the nomenclature "Classification Set" is incorrect, there only one classifcation and it is not a "single compartment" but a Compartment Set.
A single classification and a single compartment. Is incorrect because while there only is one classifcation, it is not a "single compartment" but a Compartment Set.
A Classification Set and user credentials. Is incorrect because the nomenclature "Classification Set" is incorrect, there only one classifcation and it is not "user credential" but a Compartment Set. The user would have their own sensitivity label.
NEW QUESTION # 309
As per the Orange Book, what are two types of system assurance?
- A. Operational Assurance and Life-Cycle Assurance.
- B. Operational Assurance and Architectural Assurance.
- C. Architectural Assurance and Implementation Assurance.
- D. Design Assurance and Implementation Assurance.
Answer: A
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Are the two types of assurance mentioned in the Orange book.
The following answers are incorrect:
Operational Assurance and Architectural Assurance. Is incorrect because Architectural Assurance is not a type of assurance mentioned in the Orange book.
Design Assurance and Implementation Assurance. Is incorrect because neither are types of assurance mentioned in the Orange book.
Architectural Assurance and Implementation Assurance. Is incorrect because neither are types of assurance mentioned in the Orange book.
NEW QUESTION # 310
When packets are captured and converted to hexadecimal, _______ represents the ICMP protocol in the IP header.
- A. 06
- B. All of the above
- C. 0
- D. 1
- E. 01
- F. 2
Answer: E
NEW QUESTION # 311
Select the major difference(s) between block and stream ciphers. (Choose all that apply)
- A. Block = hardware driven; stream = software driven
- B. Stream = hardware driven; block = software driven
- C. Block = slower encryption; stream = fast encryption
- D. Streams = bit by bit; block = encrypted in equal sections
- E. Block = bit by bit = encrypted in equal sections
Answer: B,C,D
NEW QUESTION # 312
Which of the following test makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems?
- A. Recovery testing
- B. Security testing
- C. Stress/volume testing
- D. Interface testing
Answer: B
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Security testing makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems.
Recovery testing checks the system's ability to recover after a software or hardware failure.
Stress/volume testing involves testing an application with large quantities of data in order to evaluate performance during peak hours.
Interface testing evaluates the connection of two or more components that pass information from one area to another.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 300).
NEW QUESTION # 313
You are running a packet sniffer on a network and see a packet containing a long string of
"0x90 0x90 0x90 0x90...." in the middle of it traveling to an x86-based machine as a target. This could be indicative of what activity being attempted?
- A. A source quench packet.
- B. A buffer overflow attack.
- C. Over-subscription of the traffic on a backbone.
- D. A FIN scan.
Answer: B
Explanation:
A series of the same control characters, hexadecimal code, imbedded in the
string is usually an indicator of a buffer overflow attack.
The Intel x86 processors use the hexadecimal number 90 to represent NOP (no operation).
Many buffer overflow attacks use long strings of control characters and this is
representative of that type of attack.
A buffer overflow takes place when too much data are accepted as input to a specific
process. A buffer is an allocated segment of memory. A buffer can be overflowed arbitrarily
with too much data, but for it to be of any use to an attacker, the code inserted into the
buffer must be of a specific length, followed up by commands the attacker wants executed.
So, the purpose of a buffer overflow may be either to make a mess, by shoving arbitrary
data into various memory segments, or to accomplish a specific task, by pushing into the
memory segment a carefully crafted set of data that will accomplish a specific task. This
task could be to open a command shell with administrative privilege or execute malicious
code.
Common threats to system availability, integrity, and confidentiality include hardware
failure, misuse of system privileges, buffer overflows and other memory attacks, denial of
service, reverse engineering, and system hacking.
Since many vulnerabilities result from insecure design and most threats are well known, it
is the responsibility of the security architect to ensure that their designs are addressing
security requirements appropriately while also ensuring that the system can continue to
perform its intended function.
The following answers are incorrect:
Over-subscription of the traffic on a backbone. Is incorrect because if there was Over-
subscription of the traffic on a backbone, that would typically result in not being able to
send or receive any packets, more commonly known as Denial of Service or DoS.
A source quench packet. This is incorrect because a source quench packet is an ICMP
message that contains the internet header plus 64 bits of the original datagram.
A FIN scan. This is incorrect because a FIN scan is when a packet with the FIN flag set is
sent to a specific port and the results are then analyzed.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition, Security
Architecture and Design, Page 332, for people using the Kindle edition you will find it at
Kindle Locations 7310-7315.
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :
Security Architecture and Design (Kindle Locations 1403-1407). . Kindle Edition.
Wikipedia http://en.wikipedia.org/wiki/Port_scanner
ICMP http://security.maruhn.com/iptables-tutorial/x1078.html
Wikipedia http://en.wikipedia.org/wiki/Buffer_overflow
NEW QUESTION # 314
What is RAD?
- A. Risk-assessment diagramming
- B. A development methodology
- C. A project management technique
- D. A measure of system complexity
Answer: B
Explanation:
Explanation/Reference:
RAD stands for Rapid Application Development.
RAD is a methodology that enables organizations to develop strategically important systems faster while reducing development costs and maintaining quality.
RAD is a programming system that enables programmers to quickly build working programs.
In general, RAD systems provide a number of tools to help build graphical user interfaces that would normally take a large development effort.
Two of the most popular RAD systems for Windows are Visual Basic and Delphi. Historically, RAD systems have tended to emphasize reducing development time, sometimes at the expense of generating in-efficient executable code. Nowadays, though, many RAD systems produce extremely faster code that is optimized.
Conversely, many traditional programming environments now come with a number of visual tools to aid development. Therefore, the line between RAD systems and other development environments has become blurred.
Reference:
Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 307)
http://www.webopedia.com
NEW QUESTION # 315
Why are clipping levels used?
- A. Limit the number of alphanumeric characters in a password
- B. Limit errors in RADIUS systems
- C. Reduce the amount of data to be evaluated
- D. To only set thresholds for file and object access
Answer: C
Explanation:
Clipping is used to reduce the amount to be evaluated.
NEW QUESTION # 316
What key size is used by the Clipper Chip?
- A. 56 bits
- B. 64 bits
- C. 80 bits
- D. 40 bits
Answer: C
Explanation:
The Clipper Chip is a NSA designed tamperproof chip for encrypting data and it uses the SkipJack algorithm. Each Clipper Chip has a unique serial number and a copy of the unit key is stored in the database under this serial number. The sending Clipper Chip generates and sends a Law Enforcement Access Field (LEAF) value included in the transmitted message. It is based on a 80-bit key and a 16-bit checksum. Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 1).
NEW QUESTION # 317
What does the (star) integrity axiom mean in the Biba model?
- A. No write down
- B. No read down
- C. No write up
- D. No read up
Answer: C
Explanation:
The (star) integrity axiom of the Biba access control model states that an object at one level of integrity is not permitted to modify an object of a higher level of integrity (no write up). Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 205).
NEW QUESTION # 318
Which of the following can best be defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs?
- A. A chosen-ciphertext attack
- B. A chosen-plaintext attack
- C. A known-plaintext attack
- D. A known-algorithm attack
Answer: C
Explanation:
Section: Cryptography
Explanation/Reference:
RFC2828 (Internet Security Glossary) defines a known-plaintext attack as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs (although the analyst may also have other clues, such as the knowing the cryptographic algorithm). A chosen-ciphertext attack is defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of plaintext that corresponds to ciphertext selected (i.e., dictated) by the analyst. A chosen-plaintext attack is a cryptanalysis technique in which the analyst tries to determine the key from knowledge of ciphertext that corresponds to plaintext selected (i.e., dictated) by the analyst. The other choice is a distracter.
The following are incorrect answers:
A chosen-plaintext attacks
The attacker has the plaintext and ciphertext, but can choose the plaintext that gets encrypted to see the corresponding ciphertext. This gives her more power and possibly a deeper understanding of the way the encryption process works so she can gather more information about the key being used. Once the key is discovered, other messages encrypted with that key can be decrypted.
A chosen-ciphertext attack
In chosen-ciphertext attacks, the attacker can choose the ciphertext to be decrypted and has access to the resulting decrypted plaintext. Again, the goal is to figure out the key. This is a harder attack to carry out compared to the previously mentioned attacks, and the attacker may need to have control of the system that contains the cryptosystem.
A known-algorithm attack
Knowing the algorithm does not give you much advantage without knowing the key. This is a bogus detractor.
The algorithm should be public, which is the Kerckhoffs's Principle . The only secret should be the key.
Reference(s) used for this question:
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
and
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 866). McGraw-Hill. Kindle Edition.
and
Kerckhoffs's Principle
NEW QUESTION # 319
......
Full SSCP Practice Test and 1074 Unique Questions, Get it Now!: https://www.examdumpsvce.com/SSCP-valid-exam-dumps.html
The Best SSCP Exam Study Material Premium Files and Preparation Tool: https://drive.google.com/open?id=1Le_mDEiMLZeEySD0qn1YxRmHFT2mUssj
