Latest Dec 30, 2021 SSCP Brain Dump: A Study Guide with Tips & Tricks for passing Exam
SSCP Question Bank: Free PDF Download Recently Updated Questions
NEW QUESTION 537
A security evaluation report and an accreditation statement are produced in which of the following phases of the system development life cycle?
- A. development & documentation phase
- B. acceptance phase
- C. project initiation and planning phase
- D. system design specification phase
Answer: B
Explanation:
The answer: "acceptance phase". Note the question asks about an "evaluation report" - which details how the system evaluated, and an "accreditation statement" which describes the level the system is allowed to operate at. Because those two activities are a part of testing and testing is a part of the acceptance phase, the only answer above that can be correct is "acceptance phase".
The other answers are not correct because:
The "project initiation and planning phase" is just the idea phase. Nothing has been developed yet to be evaluated, tested, accredited, etc.
The "system design specification phase" is essentially where the initiation and planning phase is fleshed out. For example, in the initiation and planning phase, we might decide we want the system to have authentication. In the design specification phase, we decide that that authentication will be accomplished via username/password. But there is still nothing actually developed at this point to evaluate or accredit.
The "development & documentation phase" is where the system is created and documented. Part of the documentation includes specific evaluation and accreditation criteria. That is the criteria that will be used to evaluate and accredit the system during the "acceptance phase".
In other words - you cannot evaluate or accredit a system that has not been created yet. Of the four answers listed, only the acceptance phase is dealing with an existing system. The others deal with planning and creating the system, but the actual system isn't there yet.
Reference:
Official ISC2 Guide Page: 558 - 559
All in One Third Edition page: 832 - 833 (recommended reading)
NEW QUESTION 538
How many layers are defined within the US Department of Defense (DoD) TCP/IP Model?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
The TCP/IP protocol model is similar to the OSI model but it defines only four layers:
Application Host-to-host Internet Network access
Reference(s) used for this question:
http://www.novell.com/documentation/nw65/ntwk_ipv4_nw/data/hozdx4oj.html and KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 84). also see: http://en.wikipedia.org/wiki/Internet_Protocol_Suite#Layer_names_and_number_of_layers_ in_the_literature
NEW QUESTION 539
Which of the following is an advantage of prototyping?
- A. It ensures that functions or extras are not added to the intended system.
- B. Prototype systems can provide significant time and cost savings.
- C. Strong internal controls are easier to implement.
- D. Change control is often less complicated with prototype systems.
Answer: B
Explanation:
Explanation/Reference:
Prototype systems can provide significant time and cost savings, however they also have several disadvantages. They often have poor internal controls, change control becomes much more complicated and it often leads to functions or extras being added to the system that were not originally intended.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 306).
NEW QUESTION 540
Which of the following identifies the encryption algorithm selected by NIST for the new Advanced Encryption Standard?
- A. RC6
- B. Twofish
- C. Serpent
- D. Rijndael
Answer: D
Explanation:
Explanation/Reference:
Rijndael. Rijndael is the new approved method of encrypting sensitive but unclassified information for the U.S. government. It has been accepted by and is also widely used in the public arena as well. It has low memory requirements and has been constructed to easily defend against timing attacks.
The following answers are incorrect: Twofish. Twofish was among the final candidates chosen for AES, but was not selected.
Serpent. Serpent was among the final candidates chosen for AES, but was not selected.
RC6. RC6 was among the final candidates chosen for AES, but was not selected.
The following reference(s) were/was used to create this question:
ISC2 OIG, 2007 p. 622, 629-630
Shon Harris AIO, v.3 p 247-250
NEW QUESTION 541
Notifying the appropriate parties to take action in order to determine the extent of the severity of an incident and to remediate the incident's effects is part of:
- A. Incident Evaluation
- B. Incident Recognition
- C. Incident Response
- D. Incident Protection
Answer: C
Explanation:
Explanation/Reference:
These are core functions of the incident response process.
"Incident Evaluation" is incorrect. Evaluation of the extent and cause of the incident is a component of the incident response process.
"Incident Recognition" is incorrect. Recognition that an incident has occurred is the precursor to the initiation of the incident response process.
"Incident Protection" is incorrect. This is an almost-right-sounding nonsense answer to distract the unwary.
References
CBK, pp. 698 - 703
NEW QUESTION 542
In the context of network enumeration by an outside attacker and possible Distributed Denial of Service (DDoS) attacks, which of the following firewall rules is not appropriate to protect an organization's internal network?
- A. Drop echo request inbound
- B. Allow echo request outbound
- C. Allow echo reply outbound
- D. Allow echo reply inbound
Answer: C
Explanation:
Explanation/Reference:
Echo replies outbound should be dropped, not allowed. There is no reason for any internet users to send ICMP ECHO Request to your interal hosts from the internet. If they wish to find out if a service is available, they can use a browser to connect to your web server or simply send an email if they wish to test your mail service.
Echo replies outbound could be used as part of the SMURF amplification attack where someone will send ICMP echo requests to gateways broadcast addresses in order to amplify the request by X number of users sitting behind the gateway.
By allowing inbound echo requests and outbound echo replies, it makes it easier for attackers to learn about the internal network as well by performing a simply ping sweep. ICMP can also be used to find out which host has been up and running the longest which would indicates which patches are missing on the host if a critical patch required a reboot.
ICMP can also be use for DDoS attacks, so you should strictly limit what type of ICMP traffic would be allowed to flow through your firewall.
On top of all this, tools such as LOKI could be use as a client-server application to transfer files back and forward between the internat and some of your internal hosts. LOKI is a client/server program published in the online publication Phrack . This program is a working proof-of-concept to demonstrate that data can be transmitted somewhat secretly across a network by hiding it in traffic that normally does not contain payloads. The example code can tunnel the equivalent of a Unix RCMD/RSH session in either ICMP echo request (ping) packets or UDP traffic to the DNS port. This is used as a back door into a Unix system after root access has been compromised. Presence of LOKI on a system is evidence that the system has been compromised in the past.
The outbound echo request and inbound echo reply allow internal users to verify connectivity with external hosts.
The following answers are incorrect:
Allow echo request outbound The outbound echo request and inbound echo reply allow internal users to verify connectivity with external hosts.
Drop echo request inbound There is no need for anyone on the internet to attempt pinging your internal hosts.
Allow echo reply inbound The outbound echo request and inbound echo reply allow internal users to verify connectivity with external hosts.
Reference(s) used for this question:
http://www.phrack.org/issues.html?issue=49&id=6
STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 10: The Perfect Firewall.
NEW QUESTION 543
Which of the following is NOT true of the Kerberos protocol?
- A. It performs mutual authentication
- B. Only a single login is required per session.
- C. The initial authentication steps are done using public key algorithm.
- D. The KDC is aware of all systems in the network and is trusted by all of them
Answer: C
Explanation:
Kerberos is a network authentication protocol. It is designed to provide
strong authentication for client/server applications by using secret-key cryptography. It has
the following characteristics:
It is secure: it never sends a password unless it is encrypted.
Only a single login is required per session. Credentials defined at login are then passed
between resources without the need for additional logins.
The concept depends on a trusted third party - a Key Distribution Center (KDC). The KDC
is aware of all systems in the network and is trusted by all of them.
It performs mutual authentication, where a client proves its identity to a server and a server
proves its identity to the client.
Kerberos introduces the concept of a Ticket-Granting Server/Service (TGS). A client that
wishes to use a service has to receive a ticket from the TGS - a ticket is a time-limited
cryptographic message - giving it access to the server. Kerberos also requires an
Authentication Server (AS) to verify clients. The two servers combined make up a KDC.
Within the Windows environment, Active Directory performs the functions of the KDC. The
following figure shows the sequence of events required for a client to gain access to a
service using Kerberos authentication. Each step is shown with the Kerberos message
associated with it, as defined in RFC 4120 "The Kerberos Network Authorization Service
(V5)".
Kerberos Authentication Step by Step Step 1: The user logs on to the workstation and requests service on the host. The workstation sends a message to the Authorization Server requesting a ticket granting ticket (TGT).
Step 2: The Authorization Server verifies the user's access rights in the user database and creates a TGT and session key. The Authorization Sever encrypts the results using a key derived from the user's password and sends a message back to the user workstation.
The workstation prompts the user for a password and uses the password to decrypt the incoming message. When decryption succeeds, the user will be able to use the TGT to request a service ticket.
Step 3: When the user wants access to a service, the workstation client application sends a request to the Ticket Granting Service containing the client name, realm name and a timestamp. The user proves his identity by sending an authenticator encrypted with the session key received in Step 2.
Step 4: The TGS decrypts the ticket and authenticator, verifies the request, and creates a ticket for the requested server. The ticket contains the client name and optionally the client IP address. It also contains the realm name and ticket lifespan. The TGS returns the ticket
to the user workstation. The returned message contains two copies of a server session key
- one encrypted with the client password, and one encrypted by the service password.
Step 5: The client application now sends a service request to the server containing the
ticket received in Step 4 and an authenticator. The service authenticates the request by
decrypting the session key. The server verifies that the ticket and authenticator match, and
then grants access to the service. This step as described does not include the authorization
performed by the Intel AMT device, as described later.
Step 6: If mutual authentication is required, then the server will reply with a server
authentication message.
The Kerberos server knows "secrets" (encrypted passwords) for all clients and servers
under its control, or it is in contact with other secure servers that have this information.
These "secrets" are used to encrypt all of the messages shown in the figure above.
To prevent "replay attacks," Kerberos uses timestamps as part of its protocol definition. For
timestamps to work properly, the clocks of the client and the server need to be in synch as
much as possible. In other words, both computers need to be set to the same time and
date. Since the clocks of two computers are often out of synch, administrators can
establish a policy to establish the maximum acceptable difference to Kerberos between a
client's clock and server's clock. If the difference between a client's clock and the server's
clock is less than the maximum time difference specified in this policy, any timestamp used
in a session between the two computers will be considered authentic. The maximum
difference is usually set to five minutes.
Note that if a client application wishes to use a service that is "Kerberized" (the service is
configured to perform Kerberos authentication), the client must also be Kerberized so that it
expects to support the necessary message responses.
For more information about Kerberos, see http://web.mit.edu/kerberos/www/.
References:
Introduction to Kerberos Authentication from Intel
and
http://www.zeroshell.net/eng/kerberos/Kerberos-definitions/#1.3.5.3
and
http://www.ietf.org/rfc/rfc4120.txt
NEW QUESTION 544
Which of the following was designed to support multiple network types over the same serial link?
- A. PPP
- B. Ethernet
- C. PPTP
- D. SLIP
Answer: A
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
The Point-to-Point Protocol (PPP) was designed to support multiple network types over the same serial link, just as Ethernet supports multiple network types over the same LAN. PPP replaces the earlier Serial Line Internet Protocol (SLIP) that only supports IP over a serial link. PPTP is a tunneling protocol.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 3: TCP/IP from a Security Viewpoint.
NEW QUESTION 545
Which of the following is not a preventive login control?
- A. Account expiration
- B. Minimum password length
- C. Last login message
- D. Password aging
Answer: C
Explanation:
Section: Access Control
Explanation/Reference:
The last login message displays the last login date and time, allowing a user to discover if their account was used by someone else. Hence, this is rather a detective control.
Source: RUSSEL, Deborah & GANGEMI, G.T. Sr., Computer Security Basics, O'Reilly, July 1992 (page 63).
NEW QUESTION 546
What is the maximum allowable key size of the Rijndael encryption algorithm?
- A. 128 bits
- B. 192 bits
- C. 512 bits
- D. 256 bits
Answer: D
Explanation:
Section: Cryptography
Explanation/Reference:
The Rijndael algorithm, chosen as the Advanced Encryption Standard (AES) to replace DES, can be categorized as an iterated block cipher with a variable block length and key length that can be independently chosen as 128, 192 or 256 bits.
Below you have a summary of the differences between AES and Rijndael.
AES is the advanced encryption standard defined by FIPS 197. It is implemented differently than Rijndael:
FIPS-197 specifies that the block size must always be 128 bits in AES, and that the key size may be either 128,
192, or 256 bits. Therefore AES-128, AES-192, and AES-256 are actually:
Key Size (bits) Number of rounds
Block Size (bits)
AES-128
128 10 Rounds
128
AES-192
192 12 Rounds
128
AES-256
256 14 Rounds
128
Some book will say "up to 9 rounds will be done with a 128 bits keys". Really it is 10 rounds because you must include round zero which is the first round.
By contrast, the Rijndael specification per se is specified with block and key sizes that may be any multiple of
32 bits, both with a minimum of 128 and a maximum of 256 bits.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 153).
and
FIPS 197
and
https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
NEW QUESTION 547
In a hierarchical PKI the highest CA is regularly called Root CA, it is also referred to by which one of the following term?
- A. Master CA
- B. Big CA
- C. Top Level CA
- D. Subordinate CA
Answer: C
Explanation:
Section: Cryptography
Explanation/Reference: Arsenault, Turner, Internet X.509 Public Key Infrastructure: Roadmap, Chapter "Terminology".
Also note that sometimes other terms such as Certification Authority Anchor (CAA) might be used within some government organization, Top level CA is another common term to indicate the top level CA, Top Level Anchor could also be used.
NEW QUESTION 548
Which of the following is NOT an advantage that TACACS+ has over TACACS?
- A. Use of two-factor password authentication
- B. User has the ability to change his password
- C. Event logging
- D. Ability for security tokens to be resynchronized
Answer: C
Explanation:
Explanation/Reference:
Although TACACS+ provides better audit trails, event logging is a service that is provided with TACACS.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
121).
NEW QUESTION 549
What is the main concern with single sign-on?
- A. The security administrator's workload would increase.
- B. Maximum unauthorized access would be possible if a password is disclosed.
- C. User access rights would be increased.
- D. The users' password would be too hard to remember.
Answer: B
Explanation:
Explanation/Reference:
A major concern with Single Sign-On (SSO) is that if a user's ID and password are compromised, the intruder would have access to all the systems that the user was authorized for.
The following answers are incorrect:
The security administrator's workload would increase. Is incorrect because the security administrator's workload would decrease and not increase. The admin would not be responsible for maintaining multiple user accounts just the one.
The users' password would be too hard to remember. Is incorrect because the users would have less passwords to remember.
User access rights would be increased. Is incorrect because the user access rights would not be any different than if they had to log into systems manually.
NEW QUESTION 550
Which of the following are Unix / Linux based security tools?
- A. SATAN
- B. LogCheck
- C. Tiger
- D. TripWire
- E. All of the tools listed can work on theUnix platforms
- F. TCP Wrappers
Answer: E
NEW QUESTION 551
What is NOT an authentication method within IKE and IPsec?
- A. Pre shared key
- B. CHAP
- C. certificate based authentication
- D. Public key authentication
Answer: B
Explanation:
CHAP is not used within IPSEC or IKE. CHAP is an authentication scheme
used by Point to Point Protocol (PPP) servers to validate the identity of remote clients.
CHAP periodically verifies the identity of the client by using a three-way handshake. This
happens at the time of establishing the initial link (LCP), and may happen again at any time
afterwards. The verification is based on a shared secret (such as the client user's
password).
After the completion of the link establishment phase, the authenticator sends a "challenge"
message to the peer.
The peer responds with a value calculated using a one-way hash function on the challenge
and the secret combined.
The authenticator checks the response against its own calculation of the expected hash
value. If the values match, the authenticator acknowledges the authentication; otherwise it
should terminate the connection.
At random intervals the authenticator sends a new challenge to the peer and repeats steps
1 through 3.
The following were incorrect answers:
Pre Shared Keys
In cryptography, a pre-shared key or PSK is a shared secret which was previously shared
between the two parties using some secure channel before it needs to be used. To build a
key from shared secret, the key derivation function should be used. Such systems almost
always use symmetric key cryptographic algorithms. The term PSK is used in WiFi
encryption such as WEP or WPA, where both the wireless access points (AP) and all
clients share the same key.
The characteristics of this secret or key are determined by the system which uses it; some
system designs require that such keys be in a particular format. It can be a password like
'bret13i', a passphrase like 'Idaho hung gear id gene', or a hexadecimal string like '65E4
E556 8622 EEE1'. The secret is used by all systems involved in the cryptographic
processes used to secure the traffic between the systems.
Certificat Based Authentication
The most common form of trusted authentication between parties in the wide world of Web
commerce is the exchange of certificates. A certificate is a digital document that at a
minimum includes a Distinguished Name (DN) and an associated public key.
The certificate is digitally signed by a trusted third party known as the Certificate Authority
(CA). The CA vouches for the authenticity of the certificate holder. Each principal in the
transaction presents certificate as its credentials. The recipient then validates the
certificate's signature against its cache of known and trusted CA certificates. A "personal
certificate" identifies an end user in a transaction; a "server certificate" identifies the service
provider.
Generally, certificate formats follow the X.509 Version 3 standard. X.509 is part of the
Open Systems Interconnect
(OSI) X.500 specification.
Public Key Authentication
Public key authentication is an alternative means of identifying yourself to a login server,
instead of typing a password. It is more secure and more flexible, but more difficult to set
up.
In conventional password authentication, you prove you are who you claim to be by proving
that you know the correct password. The only way to prove you know the password is to
tell the server what you think the password is. This means that if the server has been
hacked, or spoofed an attacker can learn your password.
Public key authentication solves this problem. You generate a key pair, consisting of a
public key (which everybody is allowed to know) and a private key (which you keep secret
and do not give to anybody). The private key is able to generate signatures. A signature
created using your private key cannot be forged by anybody who does not have a copy of
that private key; but anybody who has your public key can verify that a particular signature
is genuine.
So you generate a key pair on your own computer, and you copy the public key to the
server. Then, when the server asks you to prove who you are, you can generate a
signature using your private key. The server can verify that signature (since it has your public key) and allow you to log in. Now if the server is hacked or spoofed, the attacker does not gain your private key or password; they only gain one signature. And signatures cannot be re-used, so they have gained nothing.
There is a problem with this: if your private key is stored unprotected on your own computer, then anybody who gains access to your computer will be able to generate signatures as if they were you. So they will be able to log in to your server under your account. For this reason, your private key is usually encrypted when it is stored on your local machine, using a passphrase of your choice. In order to generate a signature, you must decrypt the key, so you have to type your passphrase. References:
RFC 2409: The Internet Key Exchange (IKE); DORASWAMY, Naganand & HARKINS, Dan
Ipsec: The New Security Standard for the Internet, Intranets, and Virtual Private Networks, 1999, Prentice Hall PTR; SMITH, Richard E.
Internet Cryptography, 1997, Addison-Wesley Pub Co.; HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne, page 467.
http://en.wikipedia.org/wiki/Pre-shared_key http://www.home.umk.pl/~mgw/LDAP/RS.C4.JUN.97.pdf http://the.earth.li/~sgtatham/putty/0.55/htmldoc/Chapter8.html#S8.1
NEW QUESTION 552
Which of the following is an example of a passive attack?
- A. Smurfing
- B. Shoulder surfing
- C. Denying services to legitimate users
- D. Brute-force password cracking
Answer: B
Explanation:
Shoulder surfing is a form of a passive attack involving stealing passwords,
personal identification numbers or other confidential information by looking over someone's
shoulder. All other forms of attack are active attacks, where a threat makes a modification
to the system in an attempt to take advantage of a vulnerability.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-
Hill/Osborne, 2002, chapter 3: Security Management Practices (page 63).
NEW QUESTION 553
......
Topics Tested in SSCP
The (ISC)2 SSCP certification exam checks the candidates’ skills in seven domains. Each of them has a different weight in the total test questions, as follows:
- Applying and understanding communications and network security (16%);
- Understanding security administration and operations (15%);
- Implementation and maintenance of access controls and authentication methods (16%);
- Performing constant monitoring, risk identification, and analysis (15%);
- Incident response management and development of recovery methods (13%);
- Understanding and managing cryptography fundamental concepts (10%);
- Identifying and analyzing applications and systems security (15%).
New SSCP Exam Dumps with High Passing Rate: https://www.actual4dump.com/ISC/SSCP-actualtests-dumps.html
SSCP Certification Exam Dumps with 1074 Practice Test Questions: https://drive.google.com/open?id=1jsvx5bRMgJwT3GbJZ3rVUew8_oCIT3w6