ISC SSCP Real 2025 Braindumps Mock Exam Dumps [Q514-Q539]

ISC SSCP Real 2025 Braindumps Mock Exam Dumps

SSCP Exam Questions | Real SSCP Practice Dumps

ISC SSCP Certification Exam is aimed at professionals who have at least one year of experience in the field of information security. SSCP exam consists of 125 multiple-choice questions and has a duration of three hours. The passing score for the exam is 700 out of 1000. SSCP exam covers various topics such as access controls, security operations and administration, risk identification, monitoring and analysis, and threat response and recovery.

The SSCP certification exam is ideal for individuals who have a minimum of one year of experience in one or more of the seven SSCP domains. These domains include access controls, security operations and administration, risk identification and monitoring, incident response and recovery, cryptography, network and communications security, and systems and application security. SSCP exam consists of 125 multiple-choice questions, and candidates have three hours to complete it. Upon successfully passing the exam, candidates are awarded the SSCP certification, which is valid for three years. System Security Certified Practitioner (SSCP) certification is recognized globally and is highly valued by organizations that prioritize security. Overall, the SSCP certification is an excellent way for IT professionals to validate their knowledge and expertise in system security and advance their careers in the field.

 

NEW QUESTION # 514
A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

• A. Mandatory Access Control
• B. Non-Discretionary Access Control
• C. Rule-based Access control
• D. Discretionary Access Control

Answer: B

Explanation:
A central authority determines what subjects can have access to certain objects based on the organizational security policy.
The key focal point of this question is the 'central authority' that determines access rights.
Cecilia one of the quiz user has sent me feedback informing me that NIST defines MAC as: "MAC Policy means that Access Control Policy Decisions are made by a CENTRAL AUTHORITY.
Which seems to indicate there could be two good answers to this question.
However if you read the NISTR document mentioned in the references below, it is also mentioned that: MAC is the most mentioned NDAC policy. So MAC is a form of NDAC policy.
Within the same document it is also mentioned: "In general, all access control policies other than DAC are grouped in the category of non- discretionary access control (NDAC). As the name implies, policies in this category have rules that are not established at the discretion of the user.
Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action." Under NDAC you have two choices:
Rule Based Access control and Role Base Access Control
MAC is implemented using RULES which makes it fall under RBAC which is a form of NDAC. It is a subset of NDAC.
This question is representative of what you can expect on the real exam where you have more than once choice that seems to be right. However, you have to look closely if one of the choices would be higher level or if one of the choice falls under one of the other choice. In this case NDAC is a better choice because MAC is falling under NDAC through the use of Rule Based Access Control.
The following are incorrect answers:
MANDATORY ACCESS CONTROL
In Mandatory Access Control the labels of the object and the clearance of the subject determines access rights, not a central authority. Although a central authority (Better known as the Data Owner) assigns the label to the object, the system does the determination of access rights automatically by comparing the Object label with the Subject clearance. The subject clearance MUST dominate (be equal or higher) than the object being accessed.
The need for a MAC mechanism arises when the security policy of a system dictates that:
1. Protection decisions must not be decided by the object owner.
2. The system must enforce the protection decisions (i.e., the system enforces the security policy over the wishes or intentions of the object owner).
Usually a labeling mechanism and a set of interfaces are used to determine access based on the MAC policy; for example, a user who is running a process at the Secret classification should not be allowed to read a file with a label of Top Secret. This is known as the "simple security rule," or
"no read up."
Conversely, a user who is running a process with a label of Secret should not be allowed to write to a file with a label of Confidential. This rule is called the "*-property" (pronounced "star property") or "no write down." The *-property is required to maintain system security in an automated environment.
DISCRETIONARY ACCESS CONTROL
In Discretionary Access Control the rights are determined by many different entities, each of the persons who have created files and they are the owner of that file, not one central authority.
DAC leaves a certain amount of access control to the discretion of the object's owner or anyone else who is authorized to control the object's access. For example, it is generally used to limit a user's access to a file; it is the owner of the file who controls other users' accesses to the file.
Only those users specified by the owner may have some combination of read, write, execute, and other permissions to the file.
DAC policy tends to be very flexible and is widely used in the commercial and government sectors. However, DAC is known to be inherently weak for two reasons:
First, granting read access is transitive; for example, when Ann grants Bob read access to a file, nothing stops Bob from copying the contents of Ann's file to an object that Bob controls. Bob may now grant any other user access to the copy of Ann's file without Ann's knowledge.
Second, DAC policy is vulnerable to Trojan horse attacks. Because programs inherit the identity of the invoking user, Bob may, for example, write a program for Ann that, on the surface, performs some useful function, while at the same time destroys the contents of Ann's files. When investigating the problem, the audit files would indicate that Ann destroyed her own files. Thus, formally, the drawbacks of DAC are as follows:
Discretionary Access Control (DAC) Information can be copied from one object to another; therefore, there is no real assurance on the flow of information in a system. No restrictions apply to the usage of information when the user has received it. The privileges for accessing objects are decided by the owner of the object, rather than through a system-wide policy that reflects the organization's security requirements.
ACLs and owner/group/other access control mechanisms are by far the most common mechanism for implementing DAC policies. Other mechanisms, even though not designed with DAC in mind, may have the capabilities to implement a DAC policy.
RULE BASED ACCESS CONTROL
In Rule-based Access Control a central authority could in fact determine what subjects can have access when assigning the rules for access. However, the rules actually determine the access and so this is not the most correct answer.
RuBAC (as opposed to RBAC, role-based access control) allow users to access systems and information based on pre determined and configured rules. It is important to note that there is no commonly understood definition or formally defined standard for rule-based access control as there is for DAC, MAC, and RBAC. "Rule-based access" is a generic term applied to systems that allow some form of organization-defined rules, and therefore rule-based access control encompasses a broad range of systems. RuBAC may in fact be combined with other models, particularly RBAC or DAC. A RuBAC system intercepts every access request and compares the rules with the rights of the user to make an access decision. Most of the rule-based access control relies on a security label system, which dynamically composes a set of rules defined by a security policy. Security labels are attached to all objects, including files, directories, and devices.
Sometime roles to subjects (based on their attributes) are assigned as well. RuBAC meets the business needs as well as the technical needs of controlling service access. It allows business rules to be applied to access control--for example, customers who have overdue balances may be denied service access. As a mechanism for MAC, rules of RuBAC cannot be changed by users. The rules can be established by any attributes of a system related to the users such as domain, host, protocol, network, or IP addresses. For example, suppose that a user wants to access an object in another network on the other side of a router. The router employs RuBAC with the rule composed by the network addresses, domain, and protocol to decide whether or not the user can be granted access. If employees change their roles within the organization, their existing authentication credentials remain in effect and do not need to be re configured. Using rules in conjunction with roles adds greater flexibility because rules can be applied to people as well as to devices. Rule-based access control can be combined with role-based access control, such that the role of a user is one of the attributes in rule setting. Some provisions of access control systems have rule- based policy engines in addition to a role-based policy engine and certain implemented dynamic policies [Des03]. For example, suppose that two of the primary types of software users are product engineers and quality engineers. Both groups usually have access to the same data, but they have different roles to perform in relation to the data and the application's function. In addition, individuals within each group have different job responsibilities that may be identified using several types of attributes such as developing programs and testing areas. Thus, the access decisions can be made in real time by a scripted policy that regulates the access between the groups of product engineers and quality engineers, and each individual within these groups. Rules can either replace or complement role-based access control.
However, the creation of rules and security policies is also a complex process, so each organization will need to strike the appropriate balance.

NEW QUESTION # 515
Which of the following would best describe certificate path validation?

• A. Verification of the integrity of the concerned private key
• B. Verification of the validity of all certificates of the certificate chain to the root certificate
• C. Verification of the integrity of the associated root certificate
• D. Verification of the revocation status of the concerned certificate

Answer: B

Explanation:
With the advent of public key cryptography (PKI), it is now possible to communicate securely with untrusted parties over the Internet without prior arrangement. One of the necessities arising from such communication is the ability to accurately verify someone's identity (i.e. whether the person you are communicating with is indeed the person who he/she claims to be). In order to be able to perform identity check for a given entity, there should be a fool-proof method of "binding" the entity's public key to its unique domain name (DN).
A X.509 digital certificate issued by a well known certificate authority (CA), like Verisign, Entrust, Thawte, etc., provides a way of positively identifying the entity by placing trust on the CA to have performed the necessary verifications. A X.509 certificate is a cryptographically sealed data object that contains the entity's unique DN, public key, serial number, validity period, and possibly other extensions.
The Windows Operating System offers a Certificate Viewer utility which allows you to double-click on any certificate and review its attributes in a human-readable format. For instance, the "General" tab in the Certificate Viewer Window (see below) shows who the certificate was issued to as well as the certificate's issuer, validation period and usage functions.

Certification Path graphic
Certification Path graphic The "Certification Path" tab contains the hierarchy for the chain of certificates. It allows you to select the certificate issuer or a subordinate certificate and then click on "View Certificate" to open the certificate in the Certificate Viewer.
Each end-user certificate is signed by its issuer, a trusted CA, by taking a hash value (MD5 or SHA-1) of ASN.1 DER (Distinguished Encoding Rule) encoded object and then encrypting the resulting hash with the issuer's private key (CA's Private Key) which is a digital signature. The encrypted data is stored in the "signatureValue" attribute of the entity's (CA) public certificate.
Once the certificate is signed by the issuer, a party who wishes to communicate with this
entity can then take the entity's public certificate and find out who the issuer of the
certificate is. Once the issuer's of the certificate (CA) is identified, it would be possible to
decrypt the value of the "signatureValue" attribute in the entity's certificate using the
issuer's public key to retrieve the hash value. This hash value will be compared with the
independently calculated hash on the entity's certificate. If the two hash values match, then
the information contained within the certificate must not have been altered and, therefore,
one must trust that the CA has done enough background check to ensure that all details in
the entity's certificate are accurate.
The process of cryptographically checking the signatures of all certificates in the certificate
chain is called "key chaining". An additional check that is essential to key chaining is
verifying that the value of the "subjectKeyIdentifier" extension in one certificate matches the
same in the subsequent certificate.
Similarly, the process of comparing the subject field of the issuer certificate to the issuer
field of the subordinate certificate is called "name chaining". In this process, these values
must match for each pair of adjacent certificates in the certification path in order to
guarantee that the path represents unbroken chain of entities relating directly to one
another and that it has no missing links.
The two steps above are the steps to validate the Certification Path by ensuring the validity
of all certificates of the certificate chain to the root certificate as described in the two
paragraphs above.
Reference(s) used for this question:
FORD, Warwick & BAUM, Michael S., Secure Electronic Commerce: Building the
Infrastructure for Digital Signatures and Encryption (2nd Edition), 2000, Prentice Hall PTR,
Page 262.
and
https://www.tibcommunity.com/docs/DOC-2197

NEW QUESTION # 516
Who of the following is responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of IT systems and data?

• A. IT Security practitioners
• B. Business and functional managers
• C. System and information owners
• D. Chief information officer

Answer: C

Explanation:
Explanation/Reference:
The system and information owners are responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of the IT systems and data they own. IT security practitioners are responsible for proper implementation of security requirements in their IT systems.
Source: STONEBURNER, Gary et al., NIST Special publication 800-30, Risk management Guide for Information Technology Systems, 2001 (page 6).

NEW QUESTION # 517
Which of the following should NOT be performed by an operator?

• A. Data entry
• B. Monitoring execution of the system
• C. Implementing the initial program load
• D. Section: Security Operation Adimnistration
  Explanation/Reference:
  Under the principle of separation of duties, an operator should not be performing data entry. This should be left to data entry personnel.
  System operators represent a class of users typically found in data center environments where mainframe systems are used. They provide day-to-day operations of the mainframe environment, ensuring that scheduled jobs are running effectively and troubleshooting problems that may arise. They also act as the arms and legs of the mainframe environment, load and unloading tape and results of job print runs. Operators have elevated privileges, but less than those of system administrators. If misused, these privileges may be used to circumvent the system's security policy. As such, use of these privileges should be monitored through audit logs.
  Some of the privileges and responsibilities assigned to operators include:
  Implementing the initial program load: This is used to start the operating system. The boot process or initial program load of a system is a critical time for ensuring system security. Interruptions to this process may reduce the integrity of the system or cause the system to crash, precluding its availability.
  Monitoring execution of the system: Operators respond to various events, to include errors, interruptions, and job completion messages.
  Volume mounting: This allows the desired application access to the system and its data.
  Controlling job flow: Operators can initiate, pause, or terminate programs. This may allow an operator to affect the scheduling of jobs. Controlling job flow involves the manipulation of configuration information needed by the system. Operators with the ability to control a job or application can cause output to be altered or diverted, which can threaten the confidentiality.
  Bypass label processing: This allows the operator to bypass security label information to run foreign tapes (foreign tapes are those from a different data center that would not be using the same label format that the system could run). This privilege should be strictly controlled to prevent unauthorized access.
  Renaming and relabeling resources: This is sometimes necessary in the mainframe environment to allow programs to properly execute. Use of this privilege should be monitored, as it can allow the unauthorized viewing of sensitive information.
  Reassignment of ports and lines: Operators are allowed to reassign ports or lines. If misused, reassignment can cause program errors, such as sending sensitive output to an unsecured location. Furthermore, an incidental port may be opened, subjecting the system to an attack through the creation of a new entry point into the system.
  Reference(s) used for this question:
  Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 19367-19395). Auerbach Publications. Kindle Edition.
  129
  Which of the following should be performed by an operator?
  A. Changing profiles
  B. Approving changes
  C. Adding and removal of users
  D. Installing system software
• E. Controlling job flow

Answer: A

Explanation:
Of the listed tasks, installing system software is the only task that should normally be performed by an operator in a properly segregated environment.
Source: MOSHER, Richard & ROTHKE, Ben, CISSP CBK Review presentation on domain 7.

NEW QUESTION # 518
Which of the following embodies all the detailed actions that personnel are required to follow?

• A. Procedures
• B. Baselines
• C. Guidelines
• D. Standards

Answer: A

Explanation:
Procedures are step-by-step instructions in support of of the policies, standards, guidelines and baselines. The procedure indicates how the policy will be implemented and who does what to accomplish the tasks." Standards is incorrect. Standards are a "Mandatory statement of minimum requirements that support some part of a policy, the standards in this case is your own company standards and not standards such as the ISO standards" Guidelines is incorrect. "Guidelines are discretionary or optional controls used to enable individuals to make judgments with respect to security actions." Baselines is incorrect. Baselines "are a minimum acceptable level of security. This minimum is implemented using specific rules necessary to implement the security controls in support of the policy and standards." For example, requiring a password of at leat 8 character would be an example. Requiring all users to have a minimun of an antivirus, a personal firewall, and an anti spyware tool could be another example.

NEW QUESTION # 519
What mechanism does a system use to compare the security labels of a subject and an object?

• A. Validation Module.
• B. Clearance Check.
• C. Security Module.
• D. Reference Monitor.

Answer: D

Explanation:
Because the Reference Monitor is responsible for access control to the
objects by the subjects it compares the security labels of a subject and an object.
According to the OIG: The reference monitor is an access control concept referring to an
abstract machine that mediates all accesses to objects by subjects based on information in
an access control database. The reference monitor must mediate all access, be protected
from modification, be verifiable as correct, and must always be invoked. The reference
monitor, in accordance with the security policy, controls the checks that are made in the
access control database.
The following are incorrect:
Validation Module. A Validation Module is typically found in application source code and is
used to validate data being inputted.
Clearance Check. Is a distractor, there is no such thing other than what someone would do
when checking if someone is authorized to access a secure facility.
Security Module. Is typically a general purpose module that prerforms a variety of security
related functions.
References:
OIG CBK, Security Architecture and Design (page 324)
AIO, 4th Edition, Security Architecture and Design, pp 328-328.
Wikipedia - http://en.wikipedia.org/wiki/Reference_monitor

NEW QUESTION # 520
Which of the following is used to interrupt the opportunity to use or perform collusion to subvert operation for fraudulent purposes?

• A. Principle of need-to-know
• B. Key escrow
• C. Principle of least privilege
• D. Rotation of duties

Answer: D

Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Job rotations reduce the risk of collusion of activities between individuals. Companies with individuals working with sensitive information or systems where there might be the opportunity for personal gain through collusion can benefit by integrating job rotation with segregation of duties. Rotating the position may uncover activities that the individual is performing outside of the normal operating procedures, highlighting errors or fraudulent behavior.
Rotation of duties is a method of reducing the risk associated with a subject performing a (sensitive) task by limiting the amount of time the subject is assigned to perform the task before being moved to a different task.
The following are incorrect answers:
Key escrow is related to the protection of keys in storage by splitting the key in pieces that will be controlled by different departments. Key escrow is the process of ensuring a third party maintains a copy of a private key or key needed to decrypt information. Key escrow also should be considered mandatory for most organization's use of cryptography as encrypted information belongs to the organization and not the individual; however often an individual's key is used to encrypt the information.
Separation of duties is a basic control that prevents or detects errors and irregularities by assigning responsibility for different parts of critical tasks to separate individuals, thus limiting the effect a single person can have on a system. One individual should not have the capability to execute all of the steps of a particular process. This is especially important in critical business areas, where individuals may have greater access and capability to modify, delete, or add data to the system. Failure to separate duties could result in individuals embezzling money from the company without the involvement of others.
The need-to-know principle specifies that a person must not only be cleared to access classified or other sensitive information, but have requirement for such information to carry out assigned job duties. Ordinary or limited user accounts are what most users are assigned. They should be restricted only to those privileges that are strictly required, following the principle of least privilege. Access should be limited to specific objects following the principle of need-to-know.
The principle of least privilege requires that each subject in a system be granted the most restrictive set of privileges (or lowest clearance) needed for the performance of authorized tasks. Least privilege refers to granting users only the accesses that are required to perform their job functions. Some employees will require greater access than others based upon their job functions. For example, an individual performing data entry on a mainframe system may have no need for Internet access or the ability to run reports regarding the information that they are entering into the system. Conversely, a supervisor may have the need to run reports, but should not be provided the capability to change information in the database.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 10628-10631). Auerbach Publications. Kindle Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 10635-10638). Auerbach Publications. Kindle Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 10693-10697). Auerbach Publications. Kindle Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 16338-16341). Auerbach Publications. Kindle Edition.

NEW QUESTION # 521
What does the directive of the European Union on Electronic Signatures deal with?

• A. Non repudiation
• B. Authentication of web servers
• C. Encryption of classified data
• D. Encryption of secret data

Answer: A

NEW QUESTION # 522
The absence of a safeguard, or a weakness in a system that may possibly be exploited is called a(n)?

• A. Threat
• B. Exposure
• C. Vulnerability
• D. Risk

Answer: C

Explanation:
A vulnerability is a weakness in a system that can be exploited by a threat.

NEW QUESTION # 523
Which of the following statements pertaining to the maintenance of an IT contingency plan is incorrect?

• A. Copies of the plan should be provided to recovery personnel for storage offline at home and office.
• B. The Contingency Planning Coordinator should make sure that every employee gets an up-to-date copy of the plan.
• C. Strict version control should be maintained.
• D. The plan should be reviewed at least once a year for accuracy and completeness.

Answer: B

Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
Because the contingency plan contains potentially sensitive operational and personnel information, its distribution should be marked accordingly and controlled. Not all employees would obtain a copy, but only those involved in the execution of the plan.
All other statements are correct.
NOTE FROM CLEMENT:
I have received multiple emails stating the explanations contradict the correct answer. It seems many people have a hard time with negative question. In this case the Incorrect choice (the one that is not true) is the correct choice. Be very carefull of such questions, you will get some on the real exam as well.
Reference(s) used for this question:
SWANSON, Marianne, & al., National Institute of Standards and Technology (NIST), NIST Special Publication
800-34, Contingency Planning Guide for Information Technology Systems

NEW QUESTION # 524
What is a packet sniffer?

• A. It captures network traffic for later analysis.
• B. It scans network segments for cabling faults.
• C. It tracks network connections to off-site locations.
• D. It monitors network traffic for illegal packets.

Answer: A

Explanation:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

NEW QUESTION # 525
Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?

• A. 172.140.42.5
• B. 172.31.42.5
• C. 172.12.42.5
• D. 172.15.42.5

Answer: B

Explanation:
This is a valid Class B reserved address. For Class B networks, the reserved addresses are 172.16.0.0 - 172.31.255.255.
The private IP address ranges are defined within RFC 1918: RFC 1918 private ip address range

The following answers are incorrect:
172.12.42.5 Is incorrect because it is not a Class B reserved address.
172.140.42.5 Is incorrect because it is not a Class B reserved address.
172.15.42.5 Is incorrect because it is not a Class B reserved address.

NEW QUESTION # 526
To be admissible in court, computer evidence must be which of the following?

• A. Incriminating
• B. Decrypted
• C. Relevant
• D. Edited

Answer: C

Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
Before any evidence can be admissible in court, the evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence. This holds true for computer evidence as well.
While there are no absolute means to ensure that evidence will be allowed and helpful in a court of law, information security professionals should understand the basic rules of evidence. Evidence should be relevant, authentic, accurate, complete, and convincing. Evidence gathering should emphasize these criteria.
As stated in CISSP for Dummies:
Because computer-generated evidence can sometimes be easily manipulated, altered , or tampered with, and because it's not easily and commonly understood, this type of evidence is usually considered suspect in a court of law. In order to be admissible, evidence must be Relevant: It must tend to prove or disprove facts that are relevant and material to the case.
Reliable: It must be reasonably proven that what is presented as evidence is what was originally collected and that the evidence itself is reliable. This is accomplished, in part, through proper evidence handling and the chain of custody. (We discuss this in the upcoming section
"Chain of custody and the evidence life cycle.")
Legally permissible: It must be obtained through legal means. Evidence that's not legally permissible may include evidence obtained through the following means:
Illegal search and seizure: Law enforcement personnel must obtain a prior court order; however, non-law enforcement personnel, such as a supervisor or system administrator, may be able to conduct an authorized search under some circumstances.
Illegal wiretaps or phone taps: Anyone conducting wiretaps or phone taps must obtain a prior court order.
Entrapment or enticement: Entrapment encourages someone to commit a crime that the individual may have had no intention of committing. Conversely, enticement lures someone toward certain evidence (a honey pot, if you will) after that individual has already committed a crime. Enticement is not necessarily illegal but does raise certain ethical arguments and may not be admissible in court.
Coercion: Coerced testimony or confessions are not legally permissible.
Unauthorized or improper monitoring: Active monitoring must be properly authorized and conducted in a standard manner; users must be notified that they may be subject to monitoring.
The following answers are incorrect:
decrypted. Is incorrect because evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence.
edited. Is incorrect because evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence. Edited evidence violates the rules of evidence.
incriminating. Is incorrect because evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence.
Reference(s) used for this question:
CISSP STudy Guide (Conrad, Misenar, Feldman) Elsevier. 2012. Page 423
and
Mc Graw Hill, Shon Harris CISSP All In One (AIO), 6th Edition , Pages 1051-1056 and CISSP for Dummies , Peter Gregory

NEW QUESTION # 527
What is the maximum number of different keys that can be used when encrypting with Triple DES?

• A. 0
• B. 1
• C. 2
• D. 3

Answer: A

Explanation:
Triple DES encrypts a message three times. This encryption can be accomplished in several ways. The most secure form of triple DES is when the three encryptions are performed with three different keys. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 152).

NEW QUESTION # 528
In telephony different types of connections are being used. The connection from the phone company's branch office to local customers is referred to as which of the following choices?

• A. indigenous loop
• B. new loop
• C. local loop
• D. loopback

Answer: C

Explanation:
Section: Network and Telecommunications
Explanation/Reference:
Transmission on fiber optic wire requires repeating at distance intervals. The glass fiber requires more protection within an outer cable than copper. For these reasons and because the installation of any new wiring is labor-intensive, few communities yet have fiber optic wires or cables from the phone company's branch office to local customers (local loop).
In telephony, a local loop is the wired connection from a telephone company's central office in a locality to its customers' telephones at homes and businesses. This connection is usually on a pair of copper wires called twisted pair. The system was originally designed for voice transmission only using analog transmission technology on a single voice channel. Today, your computer's modem makes the conversion between analog signals and digital signals. With Integrated Services Digital Network (ISDN) or Digital Subscriber Line (DSL), the local loop can carry digital signals directly and at a much higher bandwidth than they do for voice only.
Local Loop diagram

Image from: http://www.thenetworkencyclopedia.com/entry/local-loop/
The following are incorrect answers:
New loop This is only a detractor and does not exist
Loopback In telephone systems, a loopback is a test signal sent to a network destination that is returned as received to the originator. The returned signal may help diagnose a problem.
Ingenious loop This is only a detractor and does not exist
Reference(s) used for this question:
http://searchnetworking.techtarget.com/definition/local-loop
and
STEINER, Kurt, Telecommunications and Network Security, Version 1, May 2002, CISSP Open Study Group (Domain Leader: skottikus), Page 14.

NEW QUESTION # 529
IT security measures should:

• A. Not be developed in a layered fashion.
• B. Be complex
• C. Make sure that every asset of the organization is well protected.
• D. Be tailored to meet organizational security goals.

Answer: D

Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
In general, IT security measures are tailored according to an organization's unique needs. While numerous factors, such as the overriding mission requirements, and guidance, are to be considered, the fundamental issue is the protection of the mission or business from IT security-related, negative impacts. Because IT security needs are not uniform, system designers and security practitioners should consider the level of trust when connecting to other external networks and internal sub-domains. Recognizing the uniqueness of each system allows a layered security strategy to be used - implementing lower assurance solutions with lower costs to protect less critical systems and higher assurance solutions only at the most critical areas.
The more complex the mechanism, the more likely it may possess exploitable flaws. Simple mechanisms tend to have fewer exploitable flaws and require less maintenance. Further, because configuration management issues are simplified, updating or replacing a simple mechanism becomes a less intensive process.
Security designs should consider a layered approach to address or protect against a specific threat or to reduce a vulnerability. For example, the use of a packet-filtering router in conjunction with an application gateway and an intrusion detection system combine to increase the work-factor an attacker must expend to successfully attack the system. Adding good password controls and adequate user training improves the system's security posture even more.
The need for layered protections is especially important when commercial-off-the-shelf (COTS) products are used. Practical experience has shown that the current state-of-the-art for security quality in COTS products does not provide a high degree of protection against sophisticated attacks. It is possible to help mitigate this situation by placing several controls in series, requiring additional work by attackers to accomplish their goals.
Source: STONEBURNER, Gary & al, National Institute of Standards and Technology (NIST), NIST Special Publication 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), June 2001 (pages 9-10).

NEW QUESTION # 530
Which of the following usually provides reliable, real-time information without consuming network or host resources?

• A. application-based IDS
• B. firewall-based IDS
• C. network-based IDS
• D. host-based IDS

Answer: C

Explanation:
A network-based IDS usually provides reliable, real-time information without consuming network or host resources.

NEW QUESTION # 531
Which of the following should NOT normally be allowed through a firewall?

• A. HTTP
• B. SNMP
• C. SSH
• D. SMTP

Answer: B

Explanation:
Explanation/Reference:
The Simple Network Management Protocol (SNMP) is a useful tool for remotely managing network devices.
Since it can be used to reconfigure devices, SNMP traffic should be blocked at the organization's firewall.
Using a VPN with encryption or some type of Tunneling software would be highly recommended in this case.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 4: Sockets and Services from a Security Viewpoint.

NEW QUESTION # 532
Which of the following computer recovery sites is only partially equipped with processing equipment?

• A. warm site
• B. rolling hot site
• C. hot site
• D. cold site

Answer: A

Explanation:
A warm site has some basic equipment or in some case almost all of the equipment but it is not sufficient to be operational without bringing in the last backup and in some cases more computers and other equipment.
The following answers are incorrect:
hot site. Is incorrect because a hot-site is fully configured with all the required hardware. The only thing missing is the last backup and you are up and running.
Rolling hot site. Is incorrect because a rolling hot-site is fully configured with all the required hardware.
cold site. Is incorrect because a cold site has basically power, HVAC, basic cabling, but no or little as far as processing equipment is concerned. All other equipment must be brought to this site. It might take a week or two to reconstruct.
References:
OIG CBK Business Continuity and Disaster Recovery Planning (pages 368 - 369)

NEW QUESTION # 533
Which one of the following is usually not a benefit resulting from the use of firewalls?

• A. reduces the threat level on internal system.
• B. prevents the spread of viruses.
• C. allows centralized management and control of services.
• D. reduces the risks of external threats from malicious hackers.

Answer: B

Explanation:
This is not a benefit of a firewall. Most firewalls are limited when it comes to preventing the spread of viruses.
This question is testing your knowledge of Malware and Firewalls. The keywords within the questions are "usually" and "virus". Once again to come up with the correct answer, you must stay within the context of the question and really ask yourself which of the 4 choices is NOT usually done by a firewall.
Some of the latest Appliances such as Unified Threat Management (UTM) devices does have the ability to do virus scanning but most first and second generation firewalls would not have such ability. Remember, the questions is not asking about all possible scenarios that could exist but only about which of the 4 choices presented is the BEST.
For the exam you must know your general classes of Malware. There are generally four major classes of malicious code that fall under the general definition of malware:
1. Virus: Parasitic code that requires human action or insertion, or which attaches itself to another program to facilitate replication and distribution. Virus-infected containers can range from e-mail, documents, and data file macros to boot sectors, partitions, and memory fobs. Viruses were the first iteration of malware and were typically transferred by floppy disks (also known as
"sneakernet") and injected into memory when the disk was accessed or infected files were transferred from system to system.
2. Worm: Self-propagating code that exploits system or application vulnerabilities to replicate.
Once on a system, it may execute embedded routines to alter, destroy, or monitor the system on which it is running, then move on to the next system. A worm is effectively a virus that does not require human interaction or other programs to infect systems.
3. Trojan Horse: Named after the Trojan horse of Greek mythology (and serving a very similar function), a Trojan horse is a general term referring to programs that appear desirable, but actually contain something harmful. A Trojan horse purports to do one thing that the user wants while secretly performing other potentially malicious actions. For example, a user may download a game file, install it, and begin playing the game. Unbeknownst to the user, the application may also install a virus, launch a worm, or install a utility allowing an attacker to gain unauthorized access to the system remotely, all without the user's knowledge.
4. Spyware: Prior to its use in malicious activity, spyware was typically a hidden application injected through poor browser security by companies seeking to gain more information about a user's Internet activity. Today, those methods are used to deploy other malware, collect private data, send advertising or commercial messages to a system, or monitor system input, such as keystrokes or mouse clicks.
The following answers are incorrect:
reduces the risks of external threats from malicious hackers. This is incorrect because a firewall can reduce the risks of external threats from malicious hackers.
reduces the threat level on internal system. This is incorrect because a firewall can reduce the threat level on internal system.
allows centralized management and control of services. This is incorrect because a firewall can allow centralize management and control of services.

NEW QUESTION # 534
Brute force attacks against encryption keys have increased in potency because of increased computing power. Which of the following is often considered a good protection against the brute force cryptography attack?

• A. Algorithms that are immune to brute force key attacks.
• B. The use of good key generators.
• C. Nothing can defend you against a brute force crypto key attack.
• D. The use of session keys.

Answer: D

Explanation:
If we assume a crytpo-system with a large key (and therefore a large key space) a brute force attack will likely take a good deal of time - anywhere from several hours to several years depending on a number of variables. If you use a session key for each message you encrypt, then the brute force attack provides the attacker with only the key for that one message. So, if you are encrypting 10 messages a day, each with a different session key, but it takes me a month to break each session key then I am fighting a loosing battle.
The other answers are not correct because:
"The use of good key generators" is not correct because a brute force key attack will
eventually run through all possible combinations of key. Therefore, any key will eventually
be broken in this manner given enough time.
"Nothing can defend you against a brute force crypto key attack" is incorrect, and not the
best answer listed. While it is technically true that any key will eventually be broken by a
brute force attack, the question remains "how long will it take?". In other words, if you
encrypt something today but I can't read it for 10,000 years, will you still care? If the key is
changed every session does it matter if it can be broken after the session has ended? Of
the answers listed here, session keys are "often considered a good protection against the
brute force cryptography attack" as the question asks.
"Algorithms that are immune to brute force key attacks" is incorrect because there currently
are no such algorithms.
References:
Official ISC2 Guide page: 259
All in One Third Edition page: 623

NEW QUESTION # 535
ICMP and IGMP belong to which layer of the OSI model?

• A. Transport Layer.
• B. Network Layer.
• C. Datagram Layer.
• D. Data Link Layer.

Answer: B

Explanation:
Explanation/Reference:
The network layer contains the Internet Protocol (IP), the Internet Control Message Protocol (ICMP), and the Internet Group Management Protocol (IGMP)
The following answers are incorrect:
Datagram Layer. Is incorrect as a distractor as there is no Datagram Layer.
Transport Layer. Is incorrect because it is used to data between applications and uses the TCP and UDP protocols.
Data Link Layer. Is incorrect because this layer deals with addressing hardware.

NEW QUESTION # 536
Making sure that the data has not been changed unintentionally, due to an accident or malice is:

• A. Integrity.
• B. Confidentiality.
• C. Availability.
• D. Auditability.

Answer: A

Explanation:
Integrity refers to the protection of information from unauthorized modification or deletion.
Confidentiality is incorrect. Confidentiality refers to the protection of information from unauthorized disclosure.
Availability is incorrect. Availability refers to the assurance that information and services will be available to authorized users in accordance with the service level objective.
Auditability is incorrect. Auditability refers to the ability to trace an action to the identity that performed it and identify the date and time at which it occurred.
References:
CBK, pp. 5 - 6 AIO3, pp. 56 - 57

NEW QUESTION # 537
Packet Filtering Firewalls examines both the source and destination address of the:

• A. user data packet
• B. Incoming Data packets only
• C. incoming and outgoing data packets
• D. outgoing data packets only

Answer: C

Explanation:
Packeting filtering firewalls are devices that enforce administrative security policies by filtering incoming traffic as well as outgoing traffic based on rules that can include the source and/or destination addresses.
"Outgoing data packets" is incorrect. Firewalls filter incoming as well as outgoing traffic. This is sometimes called Egress and Ingress filtering.
"Incoming data packets only" is incorrect. (see previous explantion)
"User data packet" is incorrect. A packet filtering firewall does not typicallly look into the data portion of the packet.
References
CBK, p. 464 AIO3, pp. 482 - 484

NEW QUESTION # 538
The act of intercepting the first message in a public key exchange and substituting a bogus key for the original key is an example of which style of attack?

• A. Social Engineering
• B. ManIn The Middle
• C. Hijacking
• D. Spoofing
• E. Distributed Denial of Service (DDoS)

Answer: B

NEW QUESTION # 539
......

Details of SSCP Certification Exam

The (ISC)2 SSCP designation is dedicated to IT managers, administrators, network security specialists, or directors who are responsible for the operational security in the company they are working for. Also, this certificate can be a great achievement for System Administrators, Security Analysts, Network Security Engineers, or System Engineers. Besides, the Security Specialists, System Analysts, Database, or Security Administrators will also find this certification helpful for their career path. The candidates who want to take the SSCP certification exam should demonstrate that they have at least one year of paid work experience in at least one of the domains tested in the final exam. Also, in case the candidates have a bachelor's or master’s degree in one cybersecurity program, then the prerequisite for one year of experience will be compensated. In case the candidates cannot demonstrate that they have one year of experience, then they can take the certification test and become an (ISC)2 Associate. Thus, they will have two years to earn the required one-year experience and be eligible for getting the designation. As for the SSCP certification exam, it has a duration of 3 hours and includes 125 questions. All of them are multiple-choice items. The candidates can pass it if they manage to obtain 700 points out of a maximum of 1000. Also, the official test is available in different languages. The exam-takers can choose between English, Brazilian, and Japanese languages. Another important aspect that the candidates should know is that this is a proctored exam. This means that they should enter on the Pearson VUE platform and follow the steps for registration. Once the enrollment process is complete, then examinees will have to choose an available testing center and start preparing for the test.

 

Verified SSCP Exam Dumps Q&As - Provide SSCP with Correct Answers: https://www.passcollection.com/SSCP_real-exams.html

Pass Your SSCP Dumps Free Latest ISC Practice Tests: https://drive.google.com/open?id=1lo9_LtejYYf9aCrjey4YXMz_slPgE7a8