Authentic ISC SSCP Exam Dumps PDF - Dec-2023 Updated
SSCP Dumps Special Discount for limited time Try FOR FREE
NEW QUESTION # 372
In SSL/TLS protocol, what kind of authentication is supported when you establish a secure session between a client and a server?
- A. Only server authentication (optional)
- B. Role based authentication scheme
- C. Server authentication (mandatory) and client authentication (optional)
- D. Peer-to-peer authentication
Answer: C
Explanation:
Explanation/Reference:
RESCORLA, Eric, SSL and TLS: Designing and Building Secure Systems, 2000, Addison Wesley Professional; SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.
NEW QUESTION # 373
IT security measures should:
- A. Not be developed in a layered fashion.
- B. Be tailored to meet organizational security goals.
- C. Be complex
- D. Make sure that every asset of the organization is well protected.
Answer: B
Explanation:
In general, IT security measures are tailored according to an organization's unique needs. While numerous factors, such as the overriding mission requirements, and guidance, are to be considered, the fundamental issue is the protection of the mission or business from IT security-related, negative impacts. Because IT security needs are not uniform, system designers and security practitioners should consider the level of trust when connecting to other external networks and internal sub-domains. Recognizing the uniqueness of each system allows a layered security strategy to be used - implementing lower assurance solutions with lower costs to protect less critical systems and higher assurance solutions only at the most critical areas.
The more complex the mechanism, the more likely it may possess exploitable flaws. Simple mechanisms tend to have fewer exploitable flaws and require less maintenance. Further, because configuration management issues are simplified, updating or replacing a simple mechanism becomes a less intensive process.
Security designs should consider a layered approach to address or protect against a specific threat or to reduce a vulnerability. For example, the use of a packet-filtering router in conjunction with an application gateway and an intrusion detection system combine to increase the work-factor an attacker must expend to successfully attack the system. Adding good password controls and adequate user training improves the system's security posture even more.
The need for layered protections is especially important when commercial-off-the-shelf (COTS) products are used. Practical experience has shown that the current state-of-the-art for security quality in COTS products does not provide a high degree of protection against sophisticated attacks. It is possible to help mitigate this situation by placing several controls in series, requiring additional work by attackers to accomplish their goals.
Source: STONEBURNER, Gary & al, National Institute of Standards and Technology (NIST), NIST Special Publication 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), June 2001 (pages 9-10).
NEW QUESTION # 374
Which of the following is TRUE regarding Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)?
- A. UDP provides for Error Correction, TCP does not.
- B. TCP does not guarantee delivery of data, while UDP does guarantee data delivery.
- C. UDP is useful for longer messages, rather than TCP.
- D. TCP is connection-oriented, UDP is not.
Answer: D
Explanation:
TCP is a reliable connection-oriented transport for guaranteed delivery of data.
Protocols represent certain rules and regulations that are essential in order to have data communication between two entities. Internet Protocols work in sending and receiving data packets. This type of communication may be either connection-less or connection-oriented.
In a connection-oriented scenario, an acknowledgement is being received by the sender from the receiver in support of a perfect transfer. Transmission Control Protocol or TCP is such a protocol.
On the other hand, UDP or User Datagram Protocol is of the connection-less type where no feedback is being forwarded to the sender after delivery and the data transfer have taken place or not. Though, it's not a guaranteed method, but, once a connection is established, UDP works much faster than TCP as TCP has to rely on a feedback and accordingly, the entire 3-way handshaking takes place.
The following answers are incorrect:
UDP provides for Error Correction, TCP does not: UDP does not provide for error
correction, while TCP does.
UDP is useful for longer messages, rather than TCP: UDP is useful for shorter messages
due to its connectionless nature.
TCP does not guarantee delivery of data, while UDP does guarantee data delivery: The
opposite is true.
References Used for this question:
http://www.cyberciti.biz/faq/key-differences-between-tcp-and-udp-protocols/
http://www.skullbox.net/tcpudp.php
James's TCP-IP FAQ - Understanding Port Numbers.
NEW QUESTION # 375
Which of the following would be used to implement Mandatory Access Control (MAC)?
- A. Clark-Wilson Access Control
- B. User dictated access control
- C. Lattice-based access control
- D. Role-based access control
Answer: C
Explanation:
Explanation/Reference:
The lattice is a mechanism use to implement Mandatory Access Control (MAC) Under Mandatory Access Control (MAC) you have:
Mandatory Access Control
Under Non Discretionary Access Control (NDAC) you have:
Rule-Based Access Control
Role-Based Access Control
Under Discretionary Access Control (DAC) you have:
Discretionary Access Control
The Lattice Based Access Control is a type of access control used to implement other access control method. A lattice is an ordered list of elements that has a least upper bound and a most lower bound.
The lattice can be used for MAC, DAC, Integrity level, File Permission, and more For example in the case of MAC, if we look at common government classifications, we have the following:
TOP SECRET
SECRET -----------------------I am the user at secret
CONFIDENTIAL
SENSITIVE BUT UNCLASSIFIED
UNCLASSIFIED
If you look at the diagram above where I am a user at SECRET it means that I can access document at lower classification but not document at TOP SECRET. The lattice is a list of ORDERED ELEMENT, in this case the ordered elements are classification levels. My least upper bound is SECRET and my most lower bound is UNCLASSIFIED.
However the lattice could also be used for Integrity Levels such as:
VERY HIGH
HIGH
MEDIUM ----------I am a user, process, application at the medium level
LOW
VERY LOW
In the case of of Integrity levels you have to think about TRUST. Of course if I take for example the the VISTA operating system which is based on Biba then Integrity Levels would be used. As a user having access to the system I cannot tell a process running with administrative privilege what to do. Else any users on the system could take control of the system by getting highly privilege process to do things on their behalf. So no read down would be allowed in this case and this is an example of the Biba model.
Last but not least the lattice could be use for file permissions:
RWX
RW ---------User at this level
R
If I am a user with READ and WRITE (RW) access privilege then I cannot execute the file because I do not have execute permission which is the X under linux and UNIX.
Many people confuse the Lattice Model and many books says MAC = LATTICE, however the lattice can be use for other purposes.
There is also Role Based Access Control (RBAC) that exists out there. It COULD be used to simulate MAC but it is not MAC as it does not make use of Label on objects indicating sensitivity and categories.
MAC also require a clearance that dominates the object.
You can get more info about RBAC at:http://csrc.nist.gov/groups/SNS/rbac/faq.html#03 Also note that many book uses the same acronym for Role Based Access Control and Rule Based Access Control which is RBAC, this can be confusing.
The proper way of writing the acronym for Rule Based Access Control is RuBAC, unfortunately it is not commonly used.
References:
There is a great article on technet that talks about the lattice in VISTA:
http://blogs.technet.com/b/steriley/archive/2006/07/21/442870.aspx
also see:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 33).
and
http://www.microsoft-watch.com/content/vista/gaging_vistas_integrity.html
NEW QUESTION # 376
To protect and/or restore lost, corrupted, or deleted information, thereby preserving the data integrity and availability is the purpose of:
- A. A tape backup method.
- B. Mirroring.
- C. Remote journaling.
- D. Database shadowing.
Answer: A
Explanation:
The purpose of a tape backup method is to protect and/or restore lost, corrupted, or deleted information, thereby preserving the data integrity and ensuring availability.
All other choices could suffer from corruption and it might not be possible to restore the data without proper backups being done.
This is a tricky question, if the information is lost, corrupted, or deleted only a good backup could be use to restore the information. Any synchronization mechanism would update the mirror copy and the data could not be recovered.
With backups there could be a large gap where your latest data may not be available. You would have to look at your Recovery Point Objective and see if this is acceptable for your company recovery objectives.
The following are incorrect answers:
Mirroring will preserve integrity and restore points in all cases of drive failure. However, if you have corrupted data on the primary set of drives you may get corrupted data on the secondary set as well.
Remote Journaling provides Continuous or periodic synchronized recording of transaction data at a remote location as a backup strategy. (http://www.businessdictionary.com/definition/remote-journaling.html) With journaling there might be a gap of time between the data updates being send in batch at regular interval. So some of the data could be lost.
Database shadowing is synonymous with Mirroring but it only applies to databases, but not
to information and data as a whole.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 68.
NEW QUESTION # 377
Which of the following security models does NOT concern itself with the flow of data?
- A. The Biba model
- B. The Bell-LaPadula model
- C. The information flow model
- D. The noninterference model
Answer: D
Explanation:
Explanation/Reference:
The goal of a noninterference model is to strictly separate differing security levels to assure that higher- level actions do not determine what lower-level users can see. This is in contrast to other security models that control information flows between differing levels of users, By maintaining strict separation of security levels, a noninterference model minimizes leakages that might happen through a covert channel.
The Bell-LaPadula model is incorrect. The Bell-LaPadula model is concerned with confidentiality and bases access control decsions on the classfication of objects and the clearences of subjects.
The information flow model is incorrect. The information flow models have a similar framework to the Bell- LaPadula model and control how information may flow between objects based on security classes.
The Biba model is incorrect. The Biba model is concerned with integrity and is a complement to the Bell- LaPadula model in that higher levels of integrity are more trusted than lower levels. Access control us based on these integrity levels to assure that read/write operations do not decrease an object's integrity.
References:
CBK, pp 325 - 326
AIO3, pp. 290 - 291
NEW QUESTION # 378
Integrity = ______________
- A. Ability to access data when requested
- B. Data being delivered from the source to the intended receiver without being altered
- C. Protection of data from unauthorized users
- D. All answers are correct
- E. Data being kept correct and current
Answer: B
NEW QUESTION # 379
Ensuring least privilege does not require:
- A. Identifying what the user's job is.
- B. Ensuring that the user alone does not have sufficient rights to subvert an important process.
- C. Determining the minimum set of privileges required for a user to perform their duties.
- D. Restricting the user to required privileges and nothing more.
Answer: B
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Ensuring that the user alone does not have sufficient rights to subvert an important process is a concern of the separation of duties principle and it does not concern the least privilege principle.
Source: DUPUIS, Clément, Access Control Systems and Methodology CISSP Open Study Guide, version 1.0, march 2002 (page 33).
NEW QUESTION # 380
When preparing a business continuity plan, who of the following is responsible for identifying and prioritizing time-critical systems?
- A. BCP committee
- B. Executive management staff
- C. Senior business unit management
- D. Functional business units
Answer: C
Explanation:
Many elements of a BCP will address senior management, such as the statement of importance and priorities, the statement of organizational responsibility, and the statement of urgency and timing. Executive management staff initiates the project, gives final approval and gives ongoing support. The BCP committee directs the planning, implementation, and tests processes whereas functional business units participate in implementation and testing. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 8: Business Continuity Planning and Disaster Recovery Planning (page 275).
NEW QUESTION # 381
Which of the following protocols is not implemented at the Internet layer of the TCP/IP protocol model?
- A. Internet Group Management Protocol (IGMP)
- B. Internet control message protocol (ICMP)
- C. Internet protocol (IP)
- D. User datagram protocol (UDP)
Answer: D
Explanation:
Explanation/Reference:
The User Datagram Protocol (UDP) is implemented at the host-to-host transport layer, not at the internet layer.
Protocol at what layer?
Ensure you are familiar with both the OSI model and the DoD TCP/IP model as well. You need to know how to contrast the two side by side and what are the names being used on both side. Below you have a graphic showing the two and how things maps between the two as well as some of the most common protcolos found at each of the layers:
Protocols at what layers of the DoD TCP/IP model
Graphic from http://technet.microsoft.com/en-us/library/cc958821.aspx
The following are incorrect answers:
All of the other protocols sit at the Internet Layer of the TCP/IP model.
NOTE:
Some reference are calling the Transport layer on the DoD model Host-to-Host.
Reference(s) used for this question:
Shon Harris, CISSP All In One (AIO), 6th edition , Telecommunication and Network Security, Page
518,534
and
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 85).
and
Microsoft Technet at http://technet.microsoft.com/en-us/library/cc958821.aspx
NEW QUESTION # 382
The property of a system or a system resource being accessible and usable upon demand by an authorized system entity, according to performance specifications for the system is referred to as?
- A. Reliability
- B. Confidentiality
- C. Availability
- D. Integrity
Answer: C
Explanation:
An company security program must:
1) assure that systems and applications operate effectively and provide appropriate confidentiality, integrity, and availability;
2) protect informationcommensurate with the level of risk and magnitude ofharmresulting fromloss, misuse, unauthorized access, or modification.
The property of a system or a system resource being accessible and usable upon demand by an authorized system entity, according to performance specifications for the system; i.e., a system is available if it provides services according to the system design whenever users request them.
The following are incorrect answers:
Confidentiality - The information requires protection from unauthorized disclosure and only the INTENDED recipient should have access to the meaning of the data either in storage or in transit.
Integrity - The information must be protected from unauthorized, unanticipated, or unintentional modification. This includes, but is not limited to:
Authenticity -A third party must be able to verify that the content of a message has not been changed in transit.
Non-repudiation - The origin or the receipt of a specific message must be verifiable by a third party.
Accountability - A security goal that generates the requirement for actions of an entity to be traced uniquely to that entity.
Reference used for this question:
RFC 2828 and SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (page 5).
NEW QUESTION # 383
What is considered the most important type of error to avoid for a biometric access control system?
- A. Type I Error
- B. Type II Error
- C. Combined Error Rate
- D. Crossover Error Rate
Answer: B
Explanation:
When a biometric system is used for access control, the most important error
is the false accept or false acceptance rate, or Type II error, where the system would
accept an impostor.
A Type I error is known as the false reject or false rejection rate and is not as important in
the security context as a type II error rate. A type one is when a valid company employee is
rejected by the system and he cannot get access even thou it is a valid user.
The Crossover Error Rate (CER) is the point at which the false rejection rate equals the
false acceptance rate if your would create a graph of Type I and Type II errors. The lower
the CER the better the device would be.
The Combined Error Rate is a distracter and does not exist.
Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management
Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 1, Biometric Identification
(page 10).
NEW QUESTION # 384
Layer 4 in the DoD model overlaps with which layer(s) of the OSI model?
- A. Layers 2, 3, & 4 - Data Link, Network, and Transport Layers
- B. Layers 5, 6, & 7 - Session, Presentation, and Application Layers
- C. Layer 3 - Network Layer
- D. Layer 7 - Application Layer
Answer: B
NEW QUESTION # 385
In a hierarchical PKI the highest CA is regularly called Root CA, it is also referred to by which one of the following term?
- A. Subordinate CA
- B. Master CA
- C. Top Level CA
- D. Big CA
Answer: C
Explanation:
Section: Cryptography
Explanation/Reference: Arsenault, Turner, Internet X.509 Public Key Infrastructure: Roadmap, Chapter "Terminology".
Also note that sometimes other terms such as Certification Authority Anchor (CAA) might be used within some government organization, Top level CA is another common term to indicate the top level CA, Top Level Anchor could also be used.
NEW QUESTION # 386
Sensitivity labels are an example of what application control type?
- A. Preventive security controls
- B. Preventive accuracy controls
- C. Compensating administrative controls
- D. Detective security controls
Answer: A
Explanation:
Section: Access Control
Explanation/Reference:
Sensitivity labels are a preventive security application controls, such as are firewalls, reference monitors, traffic padding, encryption, data classification, one-time passwords, contingency planning, separation of development, application and test environments.
The incorrect answers are:
Detective security controls - Intrusion detection systems (IDS), monitoring activities, and audit trails.
Compensating administrative controls - There no such application control.
Preventive accuracy controls - data checks, forms, custom screens, validity checks, contingency planning, and backups.
Sources:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 7: Applications and Systems Development (page 264).
KRUTZ, Ronald & VINES, Russel, The CISSP Prep Guide: Gold Edition, Wiley Publishing Inc., 2003, Chapter
7: Application Controls, Figure 7.1 (page 360).
NEW QUESTION # 387
Which of the following are the two MOST common implementations of Intrusion Detection Systems?
- A. Network-based and Host-based.
- B. Network-based and Guest-based.
- C. Server-based and Host-based.
- D. Network-based and Client-based.
Answer: A
Explanation:
The two most common implementations of Intrusion Detection are Network-
based and Host-based.
IDS can be implemented as a network device, such as a router, switch, firewall, or
dedicated device monitoring traffic, typically referred to as network IDS (NIDS).
The" (IDS) "technology can also be incorporated into a host system (HIDS) to monitor a
single system for undesirable activities. "
A network intrusion detection system (NIDS) is a network device .... that monitors traffic
traversing the network segment for which it is integrated." Remember that NIDS are usually
passive in nature.
HIDS is the implementation of IDS capabilities at the host level. Its most significant
difference from NIDS is that related processes are limited to the boundaries of a single-host
system. However, this presents advantages in effectively detecting objectionable activities
because the IDS process is running directly on the host system, not just observing it from
the network.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 3649-3652). Auerbach Publications. Kindle
Edition.
NEW QUESTION # 388
......
The SSCP certification is an excellent choice for IT professionals who are looking to specialize in network and systems security. The program is designed to provide a comprehensive understanding of the key concepts and best practices in information security, and it is recognized globally as a valuable credential. System Security Certified Practitioner (SSCP) certification is ideal for professionals working in roles such as network security engineer, systems administrator, security analyst, and security consultant.
SSCP Dumps for success in Actual Exam: https://certkingdom.vce4dumps.com/SSCP-latest-dumps.html