SSCP Dumps Updated Aug 02, 2024 Practice Test and 1305 unique questions
2024 Latest 100% Exam Passing Ratio - SSCP Dumps PDF
NEW QUESTION # 274
What is the proper term to refer to a single unit of Ethernet data at the link layer of the DoD TCP model ?
- A. Ethernet Segment.
- B. Ethernet Frame.
- C. Ethernet Datagram.
- D. Ethernet Packet.
Answer: B
Explanation:
Ethernet is frame based network technology. See below a few definitions from RFC 1122:
SEGMENT A segment is the unit of end-to-end transmission in the TCP protocol. A segment consists of a TCP header followed by application data. A segment is transmitted by encapsulation inside an IP datagram.
PACKET A packet is the unit of data passed across the interface between the internet layer and the link layer. It includes an IP header and data. A packet may be a complete IP datagram or a fragment of an IP datagram.
FRAME A frame is the unit of transmission in a link layer protocol, and consists of a link-layer header followed by a packet.
The following answers are incorrect:
Ethernet segment. Is incorrect because Ethernet segment is a distractor, TCP segment would be the correct terminology. Ethernet is a frame based network technology,
Ethernet datagram. Is incorrect because Ethernet datagram is a distractor, IP datagram would be the correct terminology. Ethernet is a frame based network technology
Ethernet packet. Is incorrect because Ethernet packet is a distractor, a Packet is a group of information so would not be a "single unit". Ethernet is a frame based network technology.
Look at the diagrams below that were extracted from my Security+ Computer Based Tutorial. TCP/IP Data Structures
IMPORTANT NOTE:
The names used on the diagram above are from RFC 1122 which describe the DOD
Model.
Vendors and Books may use slightly different names or even number of layers.
TCP/IP Data Structure The following Reference(s) were used for this question:
Wikipedia http://en.wikipedia.org/wiki/Ethernet
NEW QUESTION # 275
Which of the following backup methods is most appropriate for off-site archiving?
- A. Differential backup method
- B. Off-site backup method
- C. Full backup method
- D. Incremental backup method
Answer: C
Explanation:
Explanation/Reference:
The full backup makes a complete backup of every file on the system every time it is run. Since a single backup set is needed to perform a full restore, it is appropriate for off-site archiving.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
69).
NEW QUESTION # 276
The high availability of multiple all-inclusive, easy-to-use hacking tools that do NOT require much technical knowledge has brought a growth in the number of which type of attackers?
- A. Black hats
- B. Phreakers
- C. White hats
- D. Script kiddies
Answer: D
Explanation:
Section: Malicious Code
Explanation/Reference:
As script kiddies are low to moderately skilled hackers using available scripts and tools to easily launch attacks against victims.
The other answers are incorrect because :
Black hats is incorrect as they are malicious , skilled hackers.
White hats is incorrect as they are security professionals.
Phreakers is incorrect as they are telephone/PBX (private branch exchange) hackers.
Reference : Shon Harris AIO v3 , Chapter 12: Operations security , Page : 830
NEW QUESTION # 277
SATAN stands for _______________________________________________
- A. Security Administrator Tool for Analyzing Networks
- B. Scavanger Administrator Tool for Analyzing Networks
- C. Simple Administration Tool for Analyzing Networks
- D. SANS Administrator Tool for Analyzing Networks
- E. Storage Administration Tool for Analyzing Networks
- F. System Administrator Tool for Analyzing Networks
Answer: A
Explanation:
: . SATAN (an acronym standing for Security Administrator Tool for Analyzing Networks) is a testing and reporting tool that gathers information from networks, such as type of machine and security flaws that may be on these machines. SATAN was developed by Dan Farmer of Silicon Graphics with a purpose of scanning thousands of host computers on the Internet for security vulnerabilities. Availability: anonymous ftp at ftp.cerias.purdue.edu
NEW QUESTION # 278
What does it mean to say that sensitivity labels are "incomparable"?
- A. the number of categories in the two labels are different.
- B. The number of classification in the two labels is different.
- C. Neither label contains all the classifications of the other.
- D. Neither label contains all the categories of the other.
Answer: D
Explanation:
Explanation/Reference:
If a category does not exist then you cannot compare it. Incomparable is when you have two disjointed sensitivity labels, that is a category in one of the labels is not in the other label. "Because neither label contains all the categories of the other, the labels can't be compared. They're said to be incomparable" COMPARABILITY:
The label:
TOP SECRET [VENUS ALPHA]
is "higher" than either of the labels:
SECRET [VENUS ALPHA] TOP SECRET [VENUS]
But you can't really say that the label:
TOP SECRET [VENUS]
is higher than the label:
SECRET [ALPHA]
Because neither label contains all the categories of the other, the labels can't be compared. They're said to be incomparable. In a mandatory access control system, you won't be allowed access to a file whose label is incomparable to your clearance.
The Multilevel Security policy uses an ordering relationship between labels known as the dominance relationship. Intuitively, we think of a label that dominates another as being "higher" than the other.
Similarly, we think of a label that is dominated by another as being "lower" than the other. The dominance relationship is used to determine permitted operations and information flows.
DOMINANCE
The dominance relationship is determined by the ordering of the Sensitivity/Clearance component of the label and the intersection of the set of Compartments.
Sample Sensitivity/Clearance ordering are:
Top Secret > Secret > Confidential > Unclassified
s3 > s2 > s1 > s0
Formally, for label one to dominate label 2 both of the following must be true:
The sensitivity/clearance of label one must be greater than or equal to the sensitivity/clearance of label two.
The intersection of the compartments of label one and label two must equal the compartments of label two.
Additionally:
Two labels are said to be equal if their sensitivity/clearance and set of compartments are exactly equal.
Note that dominance includes equality.
One label is said to strictly dominate the other if it dominates the other but is not equal to the other.
Two labels are said to be incomparable if each label has at least one compartment that is not included in the other's set of compartments.
The dominance relationship will produce a partial ordering over all possible MLS labels, resulting in what is known as the MLS Security Lattice.
The following answers are incorrect:
The number of classification in the two labels is different. Is incorrect because the categories are what is being compared, not the classifications.
Neither label contains all the classifications of the other. Is incorrect because the categories are what is being compared, not the classifications.
the number of categories in the two labels is different. Is incorrect because it is possibe a category exists more than once in one sensitivity label and does exist in the other so they would be comparable.
Reference(s) used for this question:
OReilly - Computer Systems and Access Control (Chapter 3)
http://www.oreilly.com/catalog/csb/chapter/ch03.html
and
http://rubix.com/cms/mls_dom
NEW QUESTION # 279
What is the primary reason why some sites choose not to implement Trivial File Transfer Protocol (TFTP)?
- A. It cannot support the Lightwight Directory Access Protocol (LDAP)
- B. It is too complex to manage user access restrictions under TFTP
- C. It does not offer high level encryption like FTP
- D. Due to the inherent security risks
Answer: D
Explanation:
Some sites choose not to implement Trivial File Transfer Protocol (TFTP) due to the inherent security risks. TFTP is a UDP-based file transfer program that provides no security. There is no user authentication.
NEW QUESTION # 280
Which of the following rules appearing in an Internet firewall policy is inappropriate?
- A. Firewalls should fail to a configuration that denies all services, and require a firewall administrator to re-enable services after a firewall has failed.
- B. Source routing shall be disabled on all firewalls and external routers.
- C. Firewalls shall be configured to transparently allow all outbound and inbound services.
- D. Firewalls shall not accept traffic on its external interfaces that appear to be coming from internal network addresses.
Answer: C
Explanation:
Unless approved by the Network Services manager, all in-bound services shall be intercepted and processed by the firewall. Allowing unrestricted services inbound and outbound is certainly NOT recommended and very dangerous.
Pay close attention to the keyword: all
All of the other choices presented are recommended practices for a firewall policy.
Reference(s) used for this question:
GUTTMAN, Barbara & BAGWILL, Robert, NIST Special Publication 800-xx, Internet Security Policy: A Technical Guide, Draft Version, May 25, 2000 (page 78).
NEW QUESTION # 281
A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:
- A. Mandatory Access Control
- B. Rule-based Access control
- C. Non-Discretionary Access Control
- D. Discretionary Access Control
Answer: C
Explanation:
A central authority determines what subjects can have access to certain
objects based on the organizational security policy.
The key focal point of this question is the 'central authority' that determines access rights.
Cecilia one of the quiz user has sent me feedback informing me that NIST defines MAC as:
"MAC Policy means that Access Control Policy Decisions are made by a CENTRAL
AUTHORITY. Which seems to indicate there could be two good answers to this question.
However if you read the NISTR document mentioned in the references below, it is also
mentioned that: MAC is the most mentioned NDAC policy. So MAC is a form of NDAC
policy.
Within the same document it is also mentioned: "In general, all access control policies
other than DAC are grouped in the category of non- discretionary access control (NDAC).
As the name implies, policies in this category have rules that are not established at the
discretion of the user. Non-discretionary policies establish controls that cannot be changed
by users, but only through administrative action."
Under NDAC you have two choices:
Rule Based Access control and Role Base Access Control
MAC is implemented using RULES which makes it fall under RBAC which is a form of
NDAC. It is a subset of NDAC.
This question is representative of what you can expect on the real exam where you have
more than once choice that seems to be right. However, you have to look closely if one of
the choices would be higher level or if one of the choice falls under one of the other choice.
In this case NDAC is a better choice because MAC is falling under NDAC through the use
of Rule Based Access Control.
The following are incorrect answers:
MANDATORY ACCESS CONTROL
In Mandatory Access Control the labels of the object and the clearance of the subject
determines access rights, not a central authority. Although a central authority (Better known
as the Data Owner) assigns the label to the object, the system does the determination of
access rights automatically by comparing the Object label with the Subject clearance. The
subject clearance MUST dominate (be equal or higher) than the object being accessed.
The need for a MAC mechanism arises when the security policy of a system dictates that:
1.Protection decisions must not be decided by the object owner.
2.The system must enforce the protection decisions (i.e., the system enforces the security policy over the wishes or intentions of the object owner).
Usually a labeling mechanism and a set of interfaces are used to determine access based on the MAC policy; for example, a user who is running a process at the Secret classification should not be allowed to read a file with a label of Top Secret. This is known as the "simple security rule," or "no read up."
Conversely, a user who is running a process with a label of Secret should not be allowed to write to a file with a label of Confidential. This rule is called the "*-property" (pronounced "star property") or "no write down." The *-property is required to maintain system security in an automated environment.
DISCRETIONARY ACCESS CONTROL In Discretionary Access Control the rights are determined by many different entities, each of the persons who have created files and they are the owner of that file, not one central authority.
DAC leaves a certain amount of access control to the discretion of the object's owner or anyone else who is authorized to control the object's access. For example, it is generally used to limit a user's access to a file; it is the owner of the file who controls other users' accesses to the file. Only those users specified by the owner may have some combination of read, write, execute, and other permissions to the file.
DAC policy tends to be very flexible and is widely used in the commercial and government sectors. However, DAC is known to be inherently weak for two reasons:
First, granting read access is transitive; for example, when Ann grants Bob read access to a file, nothing stops Bob from copying the contents of Ann's file to an object that Bob controls. Bob may now grant any other user access to the copy of Ann's file without Ann's knowledge.
Second, DAC policy is vulnerable to Trojan horse attacks. Because programs inherit the identity of the invoking user, Bob may, for example, write a program for Ann that, on the surface, performs some useful function, while at the same time destroys the contents of Ann's files. When investigating the problem, the audit files would indicate that Ann destroyed her own files. Thus, formally, the drawbacks of DAC are as follows:
Discretionary Access Control (DAC) Information can be copied from one object to another;
therefore, there is no real assurance on the flow of information in a system.
No restrictions apply to the usage of information when the user has received it.
The privileges for accessing objects are decided by the owner of the object, rather than
through a system-wide policy that reflects the organization's security requirements.
ACLs and owner/group/other access control mechanisms are by far the most common
mechanism for implementing DAC policies. Other mechanisms, even though not designed
with DAC in mind, may have the capabilities to implement a DAC policy.
RULE BASED ACCESS CONTROL
In Rule-based Access Control a central authority could in fact determine what subjects can
have access when assigning the rules for access. However, the rules actually determine
the access and so this is not the most correct answer.
RuBAC (as opposed to RBAC, role-based access control) allow users to access systems
and information based on pre determined and configured rules. It is important to note that
there is no commonly understood definition or formally defined standard for rule-based
access control as there is for DAC, MAC, and RBAC. "Rule-based access" is a generic
term applied to systems that allow some form of organization-defined rules, and therefore
rule-based access control encompasses a broad range of systems. RuBAC may in fact be
combined with other models, particularly RBAC or DAC. A RuBAC system intercepts every
access request and compares the rules with the rights of the user to make an access
decision. Most of the rule-based access control relies on a security label system, which
dynamically composes a set of rules defined by a security policy. Security labels are
attached to all objects, including files, directories, and devices. Sometime roles to subjects
(based on their attributes) are assigned as well. RuBAC meets the business needs as well
as the technical needs of controlling service access. It allows business rules to be applied
to access control-for example, customers who have overdue balances may be denied
service access. As a mechanism for MAC, rules of RuBAC cannot be changed by users.
The rules can be established by any attributes of a system related to the users such as
domain, host, protocol, network, or IP addresses. For example, suppose that a user wants
to access an object in another network on the other side of a router. The router employs
RuBAC with the rule composed by the network addresses, domain, and protocol to decide
whether or not the user can be granted access. If employees change their roles within the
organization, their existing authentication credentials remain in effect and do not need to be
re configured. Using rules in conjunction with roles adds greater flexibility because rules
can be applied to people as well as to devices. Rule-based access control can be
combined with role-based access control, such that the role of a user is one of the
attributes in rule setting. Some provisions of access control systems have rule- based policy engines in addition to a role-based policy engine and certain implemented dynamic policies [Des03]. For example, suppose that two of the primary types of software users are product engineers and quality engineers. Both groups usually have access to the same data, but they have different roles to perform in relation to the data and the application's function. In addition, individuals within each group have different job responsibilities that may be identified using several types of attributes such as developing programs and testing areas. Thus, the access decisions can be made in real time by a scripted policy that regulates the access between the groups of product engineers and quality engineers, and each individual within these groups. Rules can either replace or complement role-based access control. However, the creation of rules and security policies is also a complex process, so each organization will need to strike the appropriate balance.
References used for this question: http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316.pdf and AIO v3 p162-167 and OIG (2007) p.186-191 also KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 33.
NEW QUESTION # 282
A Security Kernel is defined as a strict implementation of a reference monitor mechanism responsible for enforcing a security policy.
To be secure, the kernel must meet three basic conditions, what are they?
- A. Completeness, Isolation, and Verifiability
- B. Policy, mechanism, and assurance
- C. Isolation, layering, and abstraction
- D. Confidentiality, Integrity, and Availability
Answer: A
Explanation:
A security kernel is responsible for enforcing a security policy. It is a strict implementation of a reference monitor mechanism. The architecture of a kernel operating system is typically layered, and the kernel should be at the lowest and most primitive level.
It is a small portion of the operating system through which all references to information and all changes to authorizations must pass. In theory, the kernel implements access control and information flow control between implemented objects according to the security policy.
To be secure, the kernel must meet three basic conditions:
completeness (all accesses to information must go through the kernel), isolation (the kernel itself must be protected from any type of unauthorized access), and verifiability (the kernel must be proven to meet design specifications).
The reference monitor, as noted previously, is an abstraction, but there may be a reference validator, which usually runs inside the security kernel and is responsible for performing security access checks on objects, manipulating privileges, and generating any resulting security audit messages.
A term associated with security kernels and the reference monitor is the trusted computing base (TCB). The TCB is the portion of a computer system that contains all elements of the system responsible for supporting the security policy and the isolation of objects. The security capabilities of products for use in the TCB can be verified through various evaluation criteria, such as the earlier Trusted Computer System Evaluation Criteria (TCSEC) and the current Common Criteria standard.
Many of these security terms--reference monitor, security kernel, TCB--are defined loosely by vendors for purposes of marketing literature. Thus, it is necessary for security professionals to read the small print and between the lines to fully understand what the vendor is offering in regard to security features.
TIP FOR THE EXAM:
The terms Security Kernel and Reference monitor are synonymous but at different levels.
As it was explained by Diego:
While the Reference monitor is the concept, the Security kernel is the implementation of such concept (via hardware, software and firmware means).
The two terms are the same thing, but on different levels: one is conceptual, one is "technical" The following are incorrect answers:
Confidentiality, Integrity, and Availability
Policy, mechanism, and assurance
Isolation, layering, and abstraction
NEW QUESTION # 283
How is Annualized Loss Expectancy (ALE) derived from a threat?
- A. SLE x ARO
- B. SLE/EF
- C. AV x EF
- D. ARO x (SLE - EF)
Answer: A
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
Three steps are undertaken in a quantitative risk assessment:
Initial management approval
Construction of a risk assessment team, and
The review of information currently available within the organization.
There are a few formulas that you MUST understand for the exam. See them below:
SLE (Single Loss Expectancy)
Single loss expectancy (SLE) must be calculated to provide an estimate of loss. SLE is defined as the difference between the original value and the remaining value of an asset after a single exploit.
The formula for calculating SLE is as follows: SLE = asset value (in $) x exposure factor (loss due to successful threat exploit, as a %) Losses can include lack of availability of data assets due to data loss, theft, alteration, or denial of service (perhaps due to business continuity or security issues).
ALE (Annualized Loss Expectancy)
Next, the organization would calculate the annualized rate of occurrence (ARO).
This is done to provide an accurate calculation of annualized loss expectancy (ALE).
ARO is an estimate of how often a threat will be successful in exploiting a vulnerability over the period of a year.
When this is completed, the organization calculates the annualized loss expectancy (ALE).
The ALE is a product of the yearly estimate for the exploit (ARO) and the loss in value of an asset after an SLE.
The calculation follows ALE = SLE x ARO
Note that this calculation can be adjusted for geographical distances using the local annual frequency estimate (LAFE) or the standard annual frequency estimate (SAFE). Given that there is now a value for SLE, it is possible to determine what the organization should spend, if anything, to apply a countermeasure for the risk in question.
Remember that no countermeasure should be greater in cost than the risk it mitigates, transfers, or avoids.
Countermeasure cost per year is easy and straightforward to calculate. It is simply the cost of the countermeasure divided by the years of its life (i.e., use within the organization). Finally, the organization is able to compare the cost of the risk versus the cost of the countermeasure and make some objective decisions regarding its countermeasure selection.
The following were incorrect answers:
All of the other choices were incorrect.
The following reference(s) were used for this quesiton:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 10048-10069). Auerbach Publications. Kindle Edition.
NEW QUESTION # 284
Which of the following is the most secure firewall implementation?
- A. Packet-filtering firewalls
- B. Screened-subnet firewalls
- C. Screened-host firewalls
- D. Dual-homed host firewalls
Answer: B
Explanation:
One the most secure implementations of firewall architectures is the screened-subnet firewall. It employs two packet-filtering routers and a bastion host. Like a screened host firewall, this firewall supports both packet-filtering and proxy services. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 93).
NEW QUESTION # 285
To understand the 'whys' in crime, many times it is necessary to understand MOM. Which of the following is not a component of MOM?
- A. Motivation
- B. Opportunities
- C. Methods
- D. Means
Answer: C
Explanation:
To understand the whys in crime, many times it is necessary to understand the Motivations, Opportunities, and Means (MOM). Motivations are the who and why of a crime. Opportunities are the where and when of a crime, and Means pertains to the capabilities a criminal would need to be successful. Methods is not a component of MOM.
NEW QUESTION # 286
Which of the following layers provides end-to-end data transfer service?
- A. Data Link Layer.
- B. Presentation Layer.
- C. Transport Layer.
- D. Network Layer.
Answer: C
Explanation:
It is the Transport Layer that is responsible for reliable end-to-end data transfer between end systems.
The following answers are incorrect:
Network Layer. Is incorrect because the Network Layer is the OSI layer that is responsible for routing, switching, and subnetwork access across the entire OSI environment.
Data Link Layer. Is incorrect because the Data Link Layer is the serial communications path between nodes or devices without any intermediate switching nodes.
Presentation Layer. Is incorrect because the Presentation Layer is the OSI layer that determines how application information is represented (i.e., encoded) while in transit between two end systems.
NEW QUESTION # 287
Computer-generated evidence is considered:
- A. Best evidence
- B. Demonstrative evidence
- C. Direct evidence
- D. Second hand evidence
Answer: D
Explanation:
Explanation/Reference:
Computer-generated evidence normally falls under the category of hearsay evidence, or second-hand evidence, because it cannot be proven accurate and reliable. Under the U.S. Federal Rules of Evidence, hearsay evidence is generally not admissible in court. Best evidence is original or primary evidence rather than a copy or duplicate of the evidence. It does not apply to computer-generated evidence. Direct evidence is oral testimony by witness. Demonstrative evidence are used to aid the jury (models, illustrations, charts).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 9: Law, Investigation, and Ethics (page 310).
And: ROTHKE, Ben, CISSP CBK Review presentation on domain 9.
NEW QUESTION # 288
What is called the use of technologies such as fingerprint, retina, and iris scans to authenticate the individuals requesting access to resources?
- A. Biometrics
- B. Macrometrics
- C. MicroBiometrics
- D. Micrometrics
Answer: A
Explanation:
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 35.
NEW QUESTION # 289
Which of the following is NOT a common backup method?
- A. Differential backup method
- B. Daily backup method
- C. Full backup method
- D. Incremental backup method
Answer: B
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
A daily backup is not a backup method, but defines periodicity at which backups are made. There can be daily full, incremental or differential backups.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
69).
NEW QUESTION # 290
Which of the following items is NOT a benefit of cold sites?
- A. Quick Recovery
- B. Low Cost
- C. No resource contention with other organisation
- D. A secondary location is available to reconstruct the environment
Answer: A
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
A cold site is a permanent location that provide you with your own space that you can move into in case of a disaster or catastrophe. It is one of the cheapest solution available as a rental place but it is also the one that would take the most time to recover. A cold site usually takes one to two weeks for recoverey.
Although major disruptions with long-term effects may be rare, they should be accounted for in the contingency plan. The plan should include a trategy to recover and perform system operations at an alternate facility for an extended period. In general, three types of alternate sites are available:
Dedicated site owned or operated by the organization. Also called redundant or alternate sites; Reciprocal agreement or memorandum of agreement with an internal or external entity; and Commercially leased facility.
Regardless of the type of alternate site chosen, the facility must be able to support system operations as defined in the contingency plan. The three alternate site types commonly categorized in terms of their operational readiness are cold sites, warm sites, or hot sites. Other variations or combinations of these can be found, but generally all variations retain similar core features found in one of these three site types.
Progressing from basic to advanced, the sites are described below:
Cold Sites are typically facilities with adequate space and infrastructure (electric power, telecommunications connections, and environmental controls) to support information system recovery activities.
ƒWarm Sites are partially equipped office spaces that contain some or all of the system hardware, software, telecommunications, and power sources.
Hot Sites are facilities appropriately sized to support system requirements and configured with the necessary system hardware, supporting infrastructure, and support personnel.
As discussed above, these three alternate site types are the most common. There are also variations, and hybrid mixtures of features from any one of the three. Each organization should evaluate its core requirements in order to establish the most effective solution.
Two examples of variations to the site types are:
ƒMobile Sites are self-contained, transportable shells custom-fitted with specific telecommunications and system equipment necessary to meet system requirements.
ƒMirrored Sites are fully redundant facilities with automated real-time information mirroring. Mirrored sites are identical to the primary site in all technical respects.
There are obvious cost and ready-time differences among the options. In these examples, the mirrored site is the most expensive choice, but it ensures virtually 100 percent availability. Cold sites are the least expensive to maintain, although they may require substantial time to acquire and install necessary equipment. Partially equipped sites, such as warm sites, fall in the middle of the spectrum. In many cases, mobile sites may be delivered to the desired location within 24 hours, but the time necessary for equipment installation and setup can increase this response time. The selection of fixed-site locations should account for the time and mode of transportation necessary to move personnel and/or equipment there. In addition, the fixed site should be in a geographic area that is unlikely to be negatively affected by the same hazard as the organization's primary site.
The following reference(s) were used for this question:
http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf
NEW QUESTION # 291
When compiling a risk assessment report, which of the following items should be included?
(Choose all that apply)
- A. Data sensitivity levels
- B. Method of attack used
- C. Vulnerability levels
- D. Names of frequent security violators
- E. ALE calculations
Answer: A,C,E
NEW QUESTION # 292
A X.509 public key certificate with the key usage attribute "non repudiation" can be used for which of the following?
- A. decrypt encrypted messages
- B. verifying signed messages
- C. encrypting messages
- D. signing messages
Answer: B
Explanation:
Explanation/Reference:
References: RFC 2459 : Internet X.509 Public Key Infrastructure Certificate and CRL Profile; GUTMANN,
P., X.509 style guide.
NEW QUESTION # 293
Compared to RSA, which of the following is true of Elliptic Curve Cryptography(ECC)?
- A. It is believed to require longer key for equivalent security.
- B. It has been mathematically proved to be less secure.
- C. It has been mathematically proved to be more secure.
- D. It is believed to require shorter keys for equivalent security.
Answer: D
Explanation:
Section: Cryptography
Explanation/Reference:
The following answers are incorrect: It has been mathematically proved to be less secure. ECC has not been proved to be more or less secure than RSA. Since ECC is newer than RSA, it is considered riskier by some, but that is just a general assessment, not based on mathematical arguments.
It has been mathematically proved to be more secure. ECC has not been proved to be more or less secure than RSA. Since ECC is newer than RSA, it is considered riskier by some, but that is just a general assessment, not based on mathematical arguments.
It is believed to require longer key for equivalent security. On the contrary, it is believed to require shorter keys for equivalent security of RSA.
Shon Harris, AIO v5 pg719 states:
"In most cases, the longer the key, the more protection that is provided, but ECC can provide the same level of protection with a key size that is shorter that what RSA requires" The following reference(s) were/was used to create this question:
ISC2 OIG, 2007 p. 258
Shon Harris, AIO v5 pg719
NEW QUESTION # 294
Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?
- A. Smart cards
- B. Symmetric Ciphers
- C. Public Key Infrastructure (PKI)
- D. Single Sign-On (SSO)
Answer: D
Explanation:
The advantages of SSO include having the ability to use stronger passwords,
easier administration as far as changing or deleting the passwords, minimize the risks of
orphan accounts, and requiring less time to access resources.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 39.
NEW QUESTION # 295
What ISO/OSI layer do switches primarily operate at?
Do take note that this question makes reference to a plain vanilla switch and not one of the smart switches that is available on the market today.
- A. Session layer
- B. Data link layer
- C. Network layer
- D. Physical layer
Answer: B
Explanation:
Explanation/Reference:
Switches primarily operate at the data link layer (layer 2), although intelligent, extremely fast Layer 3 switching techniques are being more frequently used.
Source: KRUTZ, Ronald L & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
111).
NEW QUESTION # 296
Which of the following steps should be one of the first step performed in a Business Impact Analysis (BIA)?
- A. Estimate the Recovery Time Objectives (RTO).
- B. Identify and Prioritize Critical Organization Functions
- C. Identify all CRITICAL business units within the organization.
- D. Evaluate the impact of disruptive events.
Answer: B
Explanation:
Project Initiation and Management
This is the first step in building the Business Continuity program is project initiation and management. During this phase, the following activities will occur:
Obtain senior management support to go forward with the project Define a project scope, the objectives to be achieved, and the planning assumptions Estimate the project resources needed to be successful, both human resources and financial resources Define a timeline and major deliverables of the project In this phase, the program will be managed like a project, and a project manager should be assigned to the BC and DR domain.
The next step in the planning process is to have the planning team perform a BIA. The BIA will help the company decide what needs to be recovered, and how quickly. Mission functions are typically designated with terms such as critical, essential, supporting and nonessential to help determine the appropriate prioritization.
One of the first steps of a BIA is to Identify and Prioritize Critical Organization Functions. All organizational functions and the technology that supports them need to be classified based on their recovery priority. Recovery time frames for organization operations are driven by the consequences of not performing the function. The consequences may be the result of organization lost during the down period; contractual commitments not met resulting in fines or lawsuits, lost goodwill with customers.
All other answers are incorrect.
NEW QUESTION # 297
Which of the following is best provided by symmetric cryptography?
- A. Confidentiality
- B. Availability
- C. Non-repudiation
- D. Integrity
Answer: A
Explanation:
Section: Cryptography
Explanation/Reference:
When using symmetric cryptography, both parties will be using the same key for encryption and decryption.
Symmetric cryptography is generally fast and can be hard to break, but it offers limited overall security in the fact that it can only provide confidentiality.
Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 2).
NEW QUESTION # 298
......
The System Security Certified Practitioner (SSCP) certification exam is designed for IT professionals who are keen on demonstrating their knowledge and skills in the field of system security. SSCP exam is administered by the International Information System Security Certification Consortium, also known as (ISC)², one of the most reputable organizations in the IT security industry. System Security Certified Practitioner (SSCP) certification exam covers a range of topics, including access controls, cryptography, risk management, and threat analysis. With the growing importance of cybersecurity, the SSCP certification is an excellent way for professionals to showcase their expertise in securing systems and data.
Risk Identification, Analysis, & Monitoring (15%):
- Understanding the Process of Risk Management – It includes risk visibility & reporting, risk treatment, risk management frameworks, and risk management concepts;
- Operating & Maintaining Monitoring Systems – This area includes the information about logging, events of interest, source systems, as well as regulatory and legal concerns;
- Performing Various Security Evaluation Activities – This objective covers audit finding remediation, remediation validation, interpreting & reporting testing and scanning results, as well as participating in security testing;
- Analyzing Monitoring Results – As for this domain, it requires the students’ skills in performing event data analysis, finding security anomalies and baselines, as well as your knowledge about the visualization, trends, and metrics. It also covers their expertise in documenting and communicating findings.
Verified SSCP dumps Q&As - 100% Pass from PassCollection: https://www.passcollection.com/SSCP_real-exams.html
Pass Exam With Full Sureness - SSCP Dumps with 1305 Questions: https://drive.google.com/open?id=1y6E5o5QXEI0nUNTpKTua72W1fPFHFZYL
