Online Questions - Valid Practice To your SSCP Exam (Updated 1074 Questions)
Practice To SSCP - Remarkable Practice On your System Security Certified Practitioner (SSCP) Exam
What is the duration of the SSCP Exam
The duration of this exam is 3 hours.
Exam Content
The SSCP certification exam is 3 hours long and consists of 125 multiple-choice questions. The test is administered through any Pearson VUE center, and you can choose to take it in English, Brazilian Portuguese, or Japanese. To ace this exam and earn the certificate, the applicants must get at least 700 points.
NEW QUESTION 174
How can an individual/person best be identified or authenticated to prevent local masquarading attacks?
- A. Smart card and PIN code
- B. Two-factor authentication
- C. Biometrics
- D. UserId and password
Answer: C
Explanation:
The only way to be truly positive in authenticating identity for access is to base the authentication on the physical attributes of the persons themselves (i.e., biometric identification). Physical attributes cannot be shared, borrowed, or duplicated. They ensure that you do identify the person, however they are not perfect and they would have to be supplemented by another factor.
Some people are getting thrown off by the term Masquarade. In general, a masquerade is a disguise. In terms of communications security issues, a masquerade is a type of attack where the attacker pretends to be an authorized user of a system in order to gain access to it or to gain greater privileges than they are authorized for. A masquerade may be attempted through the use of stolen logon IDs and passwords, through finding security gaps in programs, or through bypassing the authentication mechanism. Spoofing is another term used to describe this type of attack as well.
A UserId only provides for identification.
A password is a weak authentication mechanism since passwords can be disclosed, shared, written down, and more.
A smart card can be stolen and its corresponding PIN code can be guessed by an intruder. A smartcard can be borrowed by a friend of yours and you would have no clue as to who is really logging in using that smart card.
Any form of two-factor authentication not involving biometrics cannot be as reliable as a biometric system to identify the person.
Biometric identifying verification systems control people. If the person with the correct hand, eye, face, signature, or voice is not present, the identification and verification cannot take place and the desired action (i.e., portal passage, data, or resource access) does not occur.
As has been demonstrated many times, adversaries and criminals obtain and successfully use access cards, even those that require the addition of a PIN. This is because these systems control only pieces of plastic (and sometimes information), rather than people. Real asset and resource protection can only be accomplished by people, not cards and
information, because unauthorized persons can (and do) obtain the cards and information.
Further, life-cycle costs are significantly reduced because no card or PIN administration
system or personnel are required. The authorized person does not lose physical
characteristics (i.e., hands, face, eyes, signature, or voice), but cards and PINs are
continuously lost, stolen, or forgotten. This is why card access systems require systems
and people to administer, control, record, and issue (new) cards and PINs. Moreover, the
cards are an expensive and recurring cost.
NOTE FROM CLEMENT:
This question has been generating lots of interest. The keyword in the question is:
Individual (the person) and also the authenticated portion as well.
I totally agree with you that Two Factors or Strong Authentication would be the strongest
means of authentication. However the question is not asking what is the strongest mean of
authentication, it is asking what is the best way to identify the user (individual) behind the
technology. When answering questions do not make assumptions to facts not presented in
the question or answers.
Nothing can beat Biometrics in such case. You cannot lend your fingerprint and pin to
someone else, you cannot borrow one of my eye balls to defeat the Iris or Retina scan.
This is why it is the best method to authenticate the user.
I think the reference is playing with semantics and that makes it a bit confusing. I have
improved the question to make it a lot clearer and I have also improve the explanations
attached with the question.
The reference mentioned above refers to authenticating the identity for access. So the
distinction is being made that there is identity and there is authentication. In the case of
physical security the enrollment process is where the identity of the user would be validated
and then the biometrics features provided by the user would authenticate the user on a one
to one matching basis (for authentication) with the reference contained in the database of
biometrics templates. In the case of system access, the user might have to provide a
username, a pin, a passphrase, a smart card, and then provide his biometric attributes.
Biometric can also be used for Identification purpose where you do a one to many match.
You take a facial scan of someone within an airport and you attempt to match it with a large
database of known criminal and terrorists. This is how you could use biometric for
Identification.
There are always THREE means of authentication, they are:
Something you know (Type 1) Something you have (Type 2) Something you are (Type 3)
Reference(s) used for this question:
TIPTON, Harold F. & KRAUSE, Micki, Information Security Management Handbook, 4th edition (volume 1) , 2000, CRC Press, Chapter 1, Biometric Identification (page 7). and Search Security at http://searchsecurity.techtarget.com/definition/masquerade
NEW QUESTION 175
Which of the following is related to physical security and is not considered a technical control?
- A. Intrusion Detection Systems
- B. Firewalls
- C. Access control Mechanisms
- D. Locks
Answer: D
Explanation:
Explanation/Reference:
All of the above are considered technical controls except for locks, which are physical controls.
Administrative, Technical, and Physical Security Controls
Administrative security controls are primarily policies and procedures put into place to define and guide employee actions in dealing with the organization's sensitive information. For example, policy might dictate (and procedures indicate how) that human resources conduct background checks on employees with access to sensitive information. Requiring that information be classified and the process to classify and review information classifications is another example of an administrative control. The organization security awareness program is an administrative control used to make employees cognizant of their security roles and responsibilities. Note that administrative security controls in the form of a policy can be enforced or verified with technical or physical security controls. For instance, security policy may state that computers without antivirus software cannot connect to the network, but a technical control, such as network access control software, will check for antivirus software when a computer tries to attach to the network.
Technical security controls (also called logical controls) are devices, processes, protocols, and other measures used to protect the C.I.A. of sensitive information. Examples include logical access systems, encryptions systems, antivirus systems, firewalls, and intrusion detection systems.
Physical security controls are devices and means to control physical access to sensitive information and to protect the availability of the information. Examples are physical access systems (fences, mantraps, guards), physical intrusion detection systems (motion detector, alarm system), and physical protection systems (sprinklers, backup generator). Administrative and technical controls depend on proper physical security controls being in place. An administrative policy allowing only authorized employees access to the data center do little good without some kind of physical access control.
From the GIAC.ORG website
NEW QUESTION 176
Which of the following services relies on UDP?
- A. SMTP
- B. Telnet
- C. DNS
- D. FTP
Answer: C
Explanation:
DNS relies on connectionless UDP whereas services like FTP, Telnet and SMTP rely on TCP.
Source: ROTHKE, Ben, CISSP CBK Review presentation on domain 2, August 1999.
NEW QUESTION 177
Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?
- A. 172.15.42.5
- B. 172.140.42.5
- C. 172.12.42.5
- D. 172.31.42.5
Answer: D
Explanation:
This is a valid Class B reserved address. For Class B networks, the reserved addresses are 172.16.0.0 - 172.31.255.255.
The private IP address ranges are defined within RFC 1918: RFC 1918 private ip address range
The following answers are incorrect:
172.12.42.5 Is incorrect because it is not a Class B reserved address.
172.140.42.5 Is incorrect because it is not a Class B reserved address.
172.15.42.5 Is incorrect because it is not a Class B reserved address.
NEW QUESTION 178
Which of the following would best define a digital envelope?
- A. A message encrypted with a secret key attached with the message. The secret key is encrypted with the public key of the receiver.
- B. A message that is encrypted and signed with a digital certificate.
- C. A message that is encrypted with the recipient's public key and signed with the sender's private key.
- D. A message that is signed with a secret key and encrypted with the sender's private key.
Answer: A
Explanation:
Section: Cryptography
Explanation/Reference:
A digital envelope for a recipient is a combination of encrypted data and its encryption key in an encrypted form that has been prepared for use of the recipient.
It consists of a hybrid encryption scheme in sealing a message, by encrypting the data and sending both it and a protected form of the key to the intended recipient, so that one else can open the message.
In PKCS #7, it means first encrypting the data using a symmetric encryption algorithm and a secret key, and then encrypting the secret key using an asymmetric encryption algorithm and the public key of the intended recipient.
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
NEW QUESTION 179
Which of the following offers confidentiality to an e-mail message?
- A. The sender encrypting it with its private key.
- B. The sender encrypting it with the receiver's private key.
- C. The sender encrypting it with the receiver's public key.
- D. The sender encrypting it with its public key.
Answer: C
Explanation:
An e-mail message's confidentiality is protected when encrypted with the receiver's public key, because he is the only one able to decrypt the message. The sender is not supposed to have the receiver's private key. By encrypting a message with its private key, anybody possessing the corresponding public key would be able to read the message. By encrypting the message with its public key, not even the receiver would be able to read the message.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 8: Cryptography (page 517).
NEW QUESTION 180
Which of the following steps are involved in a basic risk assessment?
- A. All of the items listed
- B. Evaluate who are the potential threats
- C. Determine the chances of a disaster or risk related event occurring
- D. None of the items listed
- E. Investigate potential legal, financial, and regulatory issues
- F. Determine what data and systems need to be protected
Answer: A
NEW QUESTION 181
An intrusion detection system is an example of what type of countermeasure?
- A. Subjective
- B. Preventative
- C. Postulative
- D. Corrective
- E. Detective
Answer: E
NEW QUESTION 182
The general philosophy for DMZ's is that:
- A. any system on the DMZ cannot be compromized because it's not accessible from the Internet.
- B. any system on the DMZ can be compromized because it's accessible from the Internet.
- C. some systems on the DMZ can be compromized because they are accessible from the Internet.
- D. any system on the DMZ cannot be compromized because it's by definition 100 percent safe and not accessible from the Internet.
Answer: B
Explanation:
Because the DMZ systems are accessible from the Internet, they are more at risk for attacka nd compromise and must be hardened appropriately.
"Any system on the DMZ cannot be compromised because it's not accessible from the Internet" is incorrect. The reason a system is placed in the DMZ is so it can be accessible from the Internet.
"Some systems on the DMZ can be compromised because they are accessible from the Internet" is incorrect. All systems in the DMZ face an increased risk of attack and compromise because they are accessible from the Internet.
"Any system on the DMZ cannot be compromised because it's by definition 100 percent safe and not accessible from the Internet" is incorrect. Again, a system is placed in the DMZ because it must be accessible from the Internet.
References:
CBK, p. 434 AIO3, p. 483
NEW QUESTION 183
What can be defined as a table of subjects and objects indicating what actions individual subjects can take upon individual objects?
- A. A capability table
- B. An access control matrix
- C. An access control list
- D. A capacity table
Answer: B
Explanation:
The matrix lists the users, groups and roles down the left side and the
resources and functions across the top. The cells of the matrix can either indicate that
access is allowed or indicate the type of access. CBK pp 317 - 318.
AIO3, p. 169 describes it as a table if subjects and objects specifying the access rights a
certain subject possesses pertaining to specific objects.
In either case, the matrix is a way of analyzing the access control needed by a population
of subjects to a population of objects. This access control can be applied using rules,
ACL's, capability tables, etc.
"A capacity table" is incorrect.
This answer is a trap for the unwary -- it sounds a little like "capability table" but is just there
to distract you.
"An access control list" is incorrect.
"It [ACL] specifies a list of users [subjects] who are allowed access to each object" CBK, p. 188 Access control lists (ACL) could be used to implement the rules identified by an access control matrix but is different from the matrix itself.
"A capability table" is incorrect.
"Capability tables are used to track, manage and apply controls based on the object and rights, or capabilities of a subject. For example, a table identifies the object, specifies access rights allowed for a subject, and permits access based on the user's posession of a capability (or ticket) for the object." CBK, pp. 191-192. To put it another way, as noted in AIO3 on p. 169, "A capabiltiy table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL."
Again, a capability table could be used to implement the rules identified by an access control matrix but is different from the matrix itself.
References:
CBK pp. 191-192, 317-318 AIO3, p. 169
NEW QUESTION 184
When a station communicates on the network for the first time, which of the following protocol would search for and find the Internet Protocol (IP) address that matches with a known Ethernet address?
- A. Address Resolution Protocol (ARP).
- B. Reverse Address Resolution Protocol (RARP).
- C. Internet Control Message protocol (ICMP).
- D. User Datagram Protocol (UDP).
Answer: B
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
The RARP protocol sends out a packet, which includes its MAC address and a request to be informed of the IP address that should be assigned to that MAC address.
ARP does the opposite by broadcasting a request to find the Ethernet address that matches a known IP address.
ICMP supports packets containing error, control, and informational messages (e.g. PING).
UDP runs over IP and is used primarily for broadcasting messages over a network.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 87.
NEW QUESTION 185
Which of the following is an unintended communication path that is NOT protected by the system's normal security mechanisms?
- A. A trusted path
- B. A protection domain
- C. A covert channel
- D. A maintenance hook
Answer: C
Explanation:
A covert channel is an unintended communication path within a system,
therefore it is not protected by the system's normal security mechanisms. Covert channels
are a secret way to convey information.
Covert channels are addressed from TCSEC level B2.
The following are incorrect answers:
A trusted path is the protected channel that allows a user to access the Trusted Computing
Base (TCB) without being compromised by other processes or users.
A protection domain consists of the execution and memory space assigned to each
process.
A maintenance hook is a hardware or software mechanism that was installed to permit
system maintenance and to bypass the system's security protections.
Reference used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 6: Operations Security
(page 219).
NEW QUESTION 186
Making sure that the data is accessible when and where it is needed is which of the following?
- A. availability
- B. integrity
- C. confidentiality
- D. acceptability
Answer: A
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Availability is making sure that the data is accessible when and where it is needed.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 59.
NEW QUESTION 187
What can be defined as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire?
- A. Untrusted certificate list
- B. Certificate revocation tree
- C. Authority revocation list
- D. Certificate revocation list
Answer: C
Explanation:
Explanation/Reference:
The Internet Security Glossary (RFC2828) defines the Authority Revocation List (ARL) as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire.
Do not to confuse with an ARL with a Certificate Revocation List (CRL). A certificate revocation list is a mechanism for distributing notices of certificate revocations. The question specifically mentions "issued to CAs" which makes ARL a better answer than CRL.
http://rfclibrary.hosting.com/rfc/rfc2828/rfc2828-29.asp
$ certificate revocation list (CRL)
(I) A data structure that enumerates digital certificates that have been invalidated by their issuer prior to when they were
scheduled to expire. (See: certificate expiration, X.509 certificate revocation list.)
http://rfclibrary.hosting.com/rfc/rfc2828/rfc2828-17.asp
$ authority revocation list (ARL)
(I) A data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire. (See: certificate expiration, X.509 authority revocation list.)
In a few words: We use CRL's for end-user cert revocation and ARL's for CA cert revocation - both can be placed in distribution points.
NEW QUESTION 188
What attribute is included in a X.509-certificate?
- A. secret key of the issuing CA
- B. Distinguished name of the subject
- C. the key pair of the certificate holder
- D. Telephone number of the department
Answer: B
Explanation:
Section: Cryptography
Explanation/Reference:
RFC 2459 : Internet X.509 Public Key Infrastructure Certificate and CRL Profile; GUTMANN, P., X.509 style guide; SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.
NEW QUESTION 189
Which of the following is the primary reason why a user would choose a dial-up modem connection to the Internet when they have a faster, secure Internet connection through the organization's network?
- A. To circumvent the organization's security policy.
- B. To check their personal e-mail.
- C. To access web sites that blocked by the organization's proxy server.
- D. To set up public services using the organization's resources.
Answer: A
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
All the choices above represent examples of circumventing the organization's security policy, which is the primary reason why a user would be using a dial-up Internet connection when a secure connection is available through the organization's network.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 1: Understanding Firewalls.
NEW QUESTION 190
......
True SSCP Exam Extraordinary Practice For the Exam: https://www.dumpsking.com/SSCP-testking-dumps.html
Get 100% Passing Success With True SSCP Exam: https://drive.google.com/open?id=1Fy0gjx3NOxXOeRh7LIS4ySilpPLSSoHA
