[Dec 04, 2023] Download Free ISC SSCP Real Exam Questions
Pass Your Exam With 100% Verified SSCP Exam Questions
ISC SSCP (System Security Certified Practitioner) exam is a highly respected certification program for individuals who are interested in pursuing a career in the field of system security. System Security Certified Practitioner (SSCP) certification is designed to validate and enhance the skills and knowledge of professionals who are responsible for the security of organizational IT systems. The SSCP certification is a globally recognized credential that is highly valued by employers in various industries.
NEW QUESTION # 503
A periodic review of user account management should not determine:
- A. Strength of user-chosen passwords.
- B. Whether active accounts are still being used.
- C. Whether management authorizations are up-to-date.
- D. Conformity with the concept of least privilege.
Answer: A
Explanation:
Organizations should have a process for (1) requesting, establishing, issuing, and closing user accounts; (2) tracking users and their respective access authorizations; and (3) managing these functions.
Reviews should examine the levels of access each individual has, conformity with the concept of least privilege, whether all accounts are still active, whether management authorizations are up-to-date, whether required training has been completed, and so forth. These reviews can be conducted on at least two levels: (1) on an application-by-application basis, or (2) on a system wide basis.
The strength of user passwords is beyond the scope of a simple user account management review, since it requires specific tools to try and crack the password file/database through either a dictionary or brute-force attack in order to check the strength of passwords.
Reference(s) used for this question:
SWANSON, Marianne & GUTTMAN, Barbara, National Institute of Standards and
Technology (NIST), NIST Special Publication 800-14, Generally Accepted Principles and
Practices for Securing Information Technology Systems, September 1996 (page 28).
NEW QUESTION # 504
Which of the following networking devices allows the connection of two or more homogeneous LANs in a simple way where they forward the traffic based on the MAC address ?
- A. Firewalls
- B. Bridges
- C. Gateways
- D. Routers
Answer: B
Explanation:
Explanation/Reference:
Bridges are simple, protocol-dependent networking devices that are used to connect two or more homogeneous LANs to form an extended LAN.
A bridge does not change the contents of the frame being transmitted but acts as a relay.
A gateway is designed to reduce the problems of interfacing any combination of local networks that employ different level protocols or local and long-haul networks.
A router connects two networks or network segments and may use IP to route messages.
Firewalls are methods of protecting a network against security threats from other systems or networks by centralizing and controlling access to the protected network segment.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter
7: Telecommunications and Network Security (page 397).
NEW QUESTION # 505
Which of the following is the most reliable, secure means of removing data from magnetic storage media such as a magnetic tape, or a cassette?
- A. Degaussing
- B. Buffer overflow
- C. Parity Bit Manipulation
- D. Zeroization
Answer: A
Explanation:
A "Degausser (Otherwise known as a Bulk Eraser) has the main function of reducing to near zero the magnetic flux stored in the magnetized medium. Flux density is measured in Gauss or Tesla. The operation is speedier than overwriting and done in one short operation. This is achieved by subjecting the subject in bulk to a series of fields of alternating polarity and gradually decreasing strength.
The following answers are incorrect:Parity Bit Manipulation. Parity has to do with disk lerror detection, not data removal. A bit or series of bits appended to a character or block of characters to ensure that the information received is the same as the infromation that was sent.
Zeroization. Zeroization involves overwrting data to sanitize it. It is time-consuming and not foolproof. The potential of restoration of data does exist with this method. Buffer overflow. This is a detractor. Although many Operating Systems use a disk buffer to temporarily hold data read from disk, its primary purpose has no connection to data removal. An overflow goes outside the constraints defined for the buffer and is a method used by an attacker to attempt access to a system.
The following reference(s) were/was used to create this question:
Shon Harris AIO v3. pg 908 Reference: What is degaussing.
NEW QUESTION # 506
Today, privacy violations are almost as serious as security violations?
- A. False
- B. True
Answer: B
NEW QUESTION # 507
What is RAD?
- A. A project management technique
- B. Risk-assessment diagramming
- C. A measure of system complexity
- D. A development methodology
Answer: D
Explanation:
RAD stands for Rapid Application Development.
RAD is a methodology that enables organizations to develop strategically important systems faster while reducing development costs and maintaining quality.
RAD is a programming system that enables programmers to quickly build working programs.
In general, RAD systems provide a number of tools to help build graphical user interfaces that would normally take a large development effort.
Two of the most popular RAD systems for Windows are Visual Basic and Delphi. Historically, RAD systems have tended to emphasize reducing development time, sometimes at the expense of generating in-efficient executable code. Nowadays, though, many RAD systems produce extremely faster code that is optimized.
Conversely, many traditional programming environments now come with a number of visual tools to aid development. Therefore, the line between RAD systems and other development environments has become blurred.
Reference:
Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 307)
http://www.webopedia.com
NEW QUESTION # 508
Which of the following OSI layers provides routing and related services?
- A. Presentation Layer
- B. Network Layer
- C. Session Layer
- D. Physical Layer
Answer: B
Explanation:
Explanation/Reference:
The Network Layer performs network routing functions.
The following answers are incorrect:
Presentation Layer. Is incorrect because the Presentation Layer transforms the data to provide a standard interface for the Application layer.
Session Layer. Is incorrect because the Session Layer controls the dialogues/connections (sessions) between computers.
Physical Layer. is incorrect because the Physical Layer defines all the electrical and physical specifications for devices.
NEW QUESTION # 509
Which of the concepts best describes Availability in relation to computer resources?
- A. Users can make authorized changes to data
- B. Users can be assured that the data content has not been altered
- C. Users can gain access to any resource upon request (assuming they have proper permissions)
- D. None of the concepts describes Availability properly
Answer: C
NEW QUESTION # 510
What is the primary difference between FTP and TFTP?
- A. TFTP is used to transfer configuration files to and from network equipment.
- B. Ability to automate
- C. Authentication
- D. Speed of negotiation
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
TFTP (Trivial File Transfer Protocol) is sometimes used to transfer configuration files from equipments such as routers but the primary difference between FTP and TFTP is that TFTP does not require authentication. Speed and ability to automate are not important.
Both of these protocols (FTP and TFTP) can be used for transferring files across the Internet. The differences between the two protocols are explained below:
FTP is a complete, session-oriented, general purpose file transfer protocol. TFTP is used as a bare-bones special purpose file transfer protocol.
FTP can be used interactively. TFTP allows only unidirectional transfer of files.
FTP depends on TCP, is connection oriented, and provides reliable control. TFTP depends on UDP, requires less overhead, and provides virtually no control.
FTP provides user authentication. TFTP does not.
FTP uses well-known TCP port numbers: 20 for data and 21 for connection dialog. TFTP uses UDP port number 69 for its file transfer activity.
The Windows NT FTP server service does not support TFTP because TFTP does not support authentication.
Windows 95 and TCP/IP-32 for Windows for Workgroups do not include a TFTP client program.
Ref: http://support.microsoft.com/kb/102737
NEW QUESTION # 511
What is the main difference between a Smurf and a Fraggle attack?
- A. A Smurf attack is UDP-based and a Fraggle attack is TCP-based.
- B. A Smurf attack is UDP-based and a Fraggle attack is ICMP-based.
- C. Smurf attack packets cannot be spoofed.
- D. A Smurf attack is ICMP-based and a Fraggle attack is UDP-based.
Answer: D
Explanation:
Fraggle is an attack similar to Smurf, but instead of using ICMP, it uses UDP. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 11: Application and System Development (page 790).
NEW QUESTION # 512
Which of the following is true about digital certificate?
- A. Can't contain geography data such as country for example.
- B. You can only get digital certificate from Verisign, RSA if you wish to prove the key belong to a specific user.
- C. It is the same as digital signature proving Integrity and Authenticity of the data
- D. Electronic credential proving that the person the certificate was issued to is who they claim to be
Answer: D
Explanation:
Digital certificate helps others verify that the public keys presented by users are genuine and valid. It is a form of Electronic credential proving that the person the certificate was issued to is who they claim to be.
The certificate is used to identify the certificate holder when conducting electronic transactions. It is issued by a certification authority (CA). It contains the name of an organization or individual, the business address, a serial number, expiration dates, a copy of the certificate
holder's public key (used for encrypting messages), and the digital signature of the
certificate-issuing authority so that a recipient can verify that the certificate is real. Some
digital certificates conform to a standard, X.509. Digital certificates can be kept in registries
so that authenticating users can look up other users' public keys.
Digital certificates are key to the PKI process. The digital certificate serves two roles. First,
it ensures the integrity of the public key and makes sure that the key remains unchanged
and in a valid state. Second, it validates that the public key is tied to the stated owner and
that all associated information is true and correct. The information needed to accomplish
these goals is added into the digital certificate.
A Certificate Authority (CA) is an entity trusted by one or more users as an authority in a
network that issues, revokes, and manages digital certificates.
A Registration Authority (RA) performs certificate registration services on behalf of a CA.
The RA, a single purpose server, is responsible for the accuracy of the information
contained in a certificate request. The RA is also expected to perform user validation
before issuing a certificate request.
A Digital Certificate is not like same as a digital signature, they are two different things, a
digital Signature is created by using your Private key to encrypt a message digest and a
Digital Certificate is issued by a trusted third party who vouch for your identity.
There are many other third parties which are providing Digital Certifictes and not just
Verisign, RSA.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 14894-14903). Auerbach Publications. Kindle
Edition.
Gregg, Michael; Haines, Billy (2012-02-16). CASP: CompTIA Advanced Security
Practitioner Study Guide Authorized Courseware: Exam CAS-001 (p. 24). Wiley. Kindle
Edition.
Please refer to http://en.wikipedia.org/wiki/Digital_certificate
What is Digital certificate:
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci211947,00.html
another deifination on http://www.webopedia.com/TERM/D/digital_certificate.html
NEW QUESTION # 513
Which security model ensures that actions that take place at a higher security level do not affect actions that take place at a lower level?
- A. The noninterference model
- B. The Bell-LaPadula model
- C. The information flow model
- D. The Clark-Wilson model
Answer: A
Explanation:
Section: Access Control
Explanation/Reference:
The goal of a noninterference model is to strictly separate differing security levels to assure that higher-level actions do not determine what lower-level users can see. This is in contrast to other security models that control information flows between differing levels of users, By maintaining strict separation of security levels, a noninterference model minimizes leakages that might happen through a covert channel.
The model ensures that any actions that take place at a higher security level do not affect, or interfere with, actions that take place at a lower level.
It is not concerned with the flow of data, but rather with what a subject knows about the state of the system.
So if an entity at a higher security level performs an action, it can not change the state for the entity at the lower level.
The model also addresses the inference attack that occurs when some one has access to some type of information and can infer(guess) something that he does not have the clearance level or authority to know.
The following are incorrect answers:
The Bell-LaPadula model is incorrect. The Bell-LaPadula model is concerned only with confidentiality and bases access control decisions on the classfication of objects and the clearences of subjects.
The information flow model is incorrect. The information flow models have a similar framework to the Bell- LaPadula model and control how information may flow between objects based on security classes. Information will be allowed to flow only in accordance with the security policy.
The Clark-Wilson model is incorrect. The Clark-Wilson model is concerned with change control and assuring that all modifications to objects preserve integrity by means of well-formed transactions and usage of an access triple (subjet - interface - object).
References:
CBK, pp 325 - 326
AIO3, pp. 290 - 291
AIOv4 Security Architecture and Design (page 345)
AIOv5 Security Architecture and Design (pages 347 - 348)
https://en.wikibooks.org/wiki/Security_Architecture_and_Design/Security_Models#Noninterference_Models
NEW QUESTION # 514
What can be defined as a list of subjects along with their access rights that are authorized to access a specific object?
- A. A role-based matrix
- B. An access control matrix
- C. An access control list
- D. A capability table
Answer: C
Explanation:
Section: Access Control
Explanation/Reference:
"It [ACL] specifies a list of users [subjects] who are allowed access to each object" CBK, p. 188 A capability table is incorrect. "Capability tables are used to track, manage and apply controls based on the object and rights, or capabilities of a subject. For example, a table identifies the object, specifies access rights allowed for a subject, and permits access based on the user's posession of a capability (or ticket) for the object." CBK, pp. 191-192. The distinction that makes this an incorrect choice is that access is based on posession of a capability by the subject.
To put it another way, as noted in AIO3 on p. 169, "A capabiltiy table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL." An access control matrix is incorrect. The access control matrix is a way of describing the rules for an access control strategy. The matrix lists the users, groups and roles down the left side and the resources and functions across the top. The cells of the matrix can either indicate that access is allowed or indicate the type of access.
CBK pp 317 - 318.
AIO3, p. 169 describes it as a table if subjects and objects specifying the access rights a certain subject possesses pertaining to specific objects.
In either case, the matrix is a way of analyzing the access control needed by a population of subjects to a population of objects. This access control can be applied using rules, ACL's, capability tables, etc.
A role-based matrix is incorrect. Again, a matrix of roles vs objects could be used as a tool for thinking about the access control to be applied to a set of objects. The results of the analysis could then be implemented using RBAC.
References:
CBK, Domain 2: Access Control.
AIO3, Chapter 4: Access Control
NEW QUESTION # 515
Contracts and agreements are often times unenforceable or hard to enforce in which of the following alternate facility recovery agreement?
- A. cold site
- B. warm site
- C. reciprocal agreement
- D. hot site
Answer: C
Explanation:
Explanation/Reference:
A reciprocal agreement is where two or more organizations mutually agree to provide facilities to the other if a disaster occurs. The organizations must have similiar hardware and software configurations.
Reciprocal agreements are often not legally binding.
Reciprocal agreements are not contracts and cannot be enforced. You cannot force someone you have such an agreement with to provide processing to you.
Government regulators do not accept reciprocal agreements as valid disaster recovery sites.
Cold sites are empty computer rooms consisting only of environmental systems, such as air conditioning and raised floors, etc. They do not meet the requirements of most regulators and boards of directors that the disaster plan be tested at least annually.
Time Brokers promise to deliver processing time on other systems. They charge a fee, but cannot guaranty that processing will always be available, especially in areas that experienced multiple disasters.
With the exception of providing your own hot site, commercial hot sites provide the greatest protection.
Most will allow you up to six weeks to restore your sites if you declare a disaster. They also permit an annual amount of time to test the Disaster Plan.
References:
OIG CBK Business Continuity and Disaster Recovery Planning (pages 368 - 369) The following answers are incorrect:
hot site. Is incorrect because you have a contract in place stating what services are to be provided.
warm site. Is incorrect because you have a contract in place stating what services are to be provided.
cold site. Is incorrect because you have a contract in place stating what services are to be provided.
NEW QUESTION # 516
Failure of a contingency plan is usually:
- A. A technical failure.
- B. Because of a lack of awareness.
- C. A management failure.
- D. Because of a lack of training.
Answer: C
Explanation:
Failure of a contingency plan is usually management failure to exhibit ongoing interest and concern about the BCP/DRP effort, and to provide financial and other resources as needed. Lack of management support will result in a lack awareness and training.
Source: ANDRESS, Mandy, Exam Cram CISSP, Coriolis, 2001, Chapter 9: Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) (page 163).
NEW QUESTION # 517
The ability to identify and audit a user and his / her actions is known as ____________.
- A. Accessibility
- B. Forensics
- C. Auditing
- D. Accountability
- E. Journaling
Answer: D
NEW QUESTION # 518
CORRECT TEXT
Symmetric = private key = secret ________ = public key = shared
Answer:
NEW QUESTION # 519
Which of the following results in the most devastating business interruptions?
- A. Loss of Data
- B. Loss of Applications
- C. Loss of Communication Links
- D. Loss of Hardware/Software
Answer: A
Explanation:
Explanation/Reference:
Source: Veritas eLearning CD - Introducing Disaster Recovery Planning, Chapter 1.
All of the others can be replaced or repaired. Data that is lost and was not backed up, cannot be restored.
NEW QUESTION # 520
Which of the following would constitute the best example of a password to use for access to a system by a network administrator?
- A. Jenny
- B. holiday
- C. GyN19Za!
- D. Christmas12
Answer: C
Explanation:
GyN19Za! would be the the best answer because it contains a mixture of upper and lower case characters, alphabetic and numeric characters, and a special character making it less vulnerable to password attacks.
All of the other answers are incorrect because they are vulnerable to brute force or dictionary attacks. Passwords should not be common words or names. The addition of a number to the end of a common word only marginally strengthens it because a common password attack would also check combinations of words:
Christmas23 Christmas123 etc...
NEW QUESTION # 521
What can be best defined as the examination of threat sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment?
- A. Risk management
- B. Threat analysis
- C. Due diligence
- D. Risk analysis
Answer: B
Explanation:
Threat analysis is the examination of threat sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment.
The following answers are incorrect:
Risk analysis is the process of identifying the risks to system security and determining the probability of occurrence, the resulting impact, and the additional safeguards that mitigate this impact.
Risk analysis is synonymous with risk assessment and part of risk management, which is the ongoing process of assessing the risk to mission/business as part of a risk-based approach used to determine adequate security for a system by analyzing the threats and vulnerabilities and selecting appropriate, cost-effective controls to achieve and maintain an acceptable level or risk.
Due Diligence is identifying possible risks that could affect a company based on best practices and standards.
Reference(s) used for this question:
STONEBURNER, Gary & al, National Institute of Standards and Technology (NIST), NIST Special Publication 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), June 2001 (page B-3).
NEW QUESTION # 522
The Data Encryption Algorithm performs how many rounds of substitution and permutation?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Explanation/Reference:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
NEW QUESTION # 523
To understand the 'whys' in crime, many times it is necessary to understand MOM. Which of the following is not a component of MOM?
- A. Means
- B. Methods
- C. Opportunities
- D. Motivation
Answer: B
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
To understand the whys in crime, many times it is necessary to understand the Motivations, Opportunities, and Means (MOM). Motivations are the who and why of a crime. Opportunities are the where and when of a crime, and Means pertains to the capabilities a criminal would need to be successful. Methods is not a component of MOM.
NEW QUESTION # 524
The following is NOT a security characteristic we need to consider while choosing a biometric identification systems:
- A. data acquisition process
- B. cost
- C. speed and user interface
- D. enrollment process
Answer: B
Explanation:
Cost is a factor when considering Biometrics but it is not a security
characteristic.
All the other answers are incorrect because they are security characteristics related to
Biometrics.
data acquisition process can cause a security concern because if the process is not fast
and efficient it can discourage individuals from using the process.
enrollment process can cause a security concern because the enrollment process has to
be quick and efficient. This process captures data for authentication.
speed and user interface can cause a security concern because this also impacts the users
acceptance rate of biometrics. If they are not comfortable with the interface and speed they
might sabotage the devices or otherwise attempt to circumvent them.
References:
OIG Access Control (Biometrics) (pgs 165-167)
From: TIPTON, Harold F. & KRAUSE, MICKI, Information Security Management
Handbook, 4th Edition, Volume 1, Pages 5-6.
in process of correction
NEW QUESTION # 525
......
SSCP Dumps 100 Pass Guarantee With Latest Demo: https://www.prep4sures.top/SSCP-exam-dumps-torrent.html
SSCP Dumps PDF - SSCP Real Exam Questions Answers: https://drive.google.com/open?id=1RWTvbuYEUTR_8pycHE05qYEjWZtvp91d