ISC New 2021 SSCP Sample Questions Reliable SSCP Test Engine
Feel ISC SSCP Dumps PDF Will likely be The best Option
ISC2 SSCP Exam Certification Details:
| Exam Code | SSCP |
| Passing Score | 700/1000 |
| Duration | 180 mins |
| Schedule Exam | Pearson VUE |
NEW QUESTION 271
All of the following can be considered essential business functions that should be identified when creating a Business Impact Analysis (BIA) except one. Which of the following would not be considered an essential element of the BIA but an important TOPIC to include within the BCP plan:
- A. Public Relations
- B. IT Network Support
- C. Accounting
- D. Purchasing
Answer: A
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
Public Relations, although important to a company, is not listed as an essential business function that should be identified and have loss criteria developed for.
All other entries are considered essential and should be identified and have loss criteria developed.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 9:
Disaster Recovery and Business continuity (page 598).
NEW QUESTION 272
Good security is built on which of the following concept?
- A. The Concept of Defensive Controls
- B. The concept of a pass-through device that only allows certain traffic in and out
- C. The Concept of defense in depth
- D. The Concept of Preventative controls
Answer: C
Explanation:
Explanation/Reference:
This the best of the four answers as a defense that depends on multiple layers is superior to one where all protection is embedded in a single layer (e.g., a firewall). Defense in depth would include all categories of controls.
The Following answers are incorrect:
"Concept of a pass through device that only allows certain traffic in and out" is incorrect. This is one definition of a firewall which can be a component of a defense in depth strategy in combination with other measures.
"Concept of preventative controls" is incorrect. This is a component of a defense in depth strategy but the core concept is that there must be multiple layers of defenses.
"Concept of defensive controls" is incorrect. This is a component of a defense in depth strategy but the core concept is that there must be multiple layers of defenses.
References:
http://en.wikipedia.org/wiki/Defense_in_depth_(computing)
http://www.nsa.gov/snac/support/defenseindepth.pdf
NEW QUESTION 273
Which of the following can best be defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs?
- A. A chosen-plaintext attack
- B. A known-plaintext attack
- C. A known-algorithm attack
- D. A chosen-ciphertext attack
Answer: B
Explanation:
RFC2828 (Internet Security Glossary) defines a known-plaintext attack as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs (although the analyst may also have other clues, such as the knowing the cryptographic algorithm). A chosen-ciphertext attack is defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of plaintext that corresponds to ciphertext selected (i.e., dictated) by the analyst. A chosen-plaintext attack is a cryptanalysis technique in which the analyst tries to determine the key from knowledge of ciphertext that corresponds to plaintext selected (i.e., dictated) by the analyst. The other choice is a distracter.
The following are incorrect answers: A chosen-plaintext attacks The attacker has the plaintext and ciphertext, but can choose the plaintext that gets encrypted to see the corresponding ciphertext. This gives her more power and possibly a deeper understanding of the way the encryption process works so she can gather more information about the key being used. Once the key is discovered, other messages encrypted with that key can be decrypted.
A chosen-ciphertext attack In chosen-ciphertext attacks, the attacker can choose the ciphertext to be decrypted and has access to the resulting decrypted plaintext. Again, the goal is to figure out the key. This is a harder attack to carry out compared to the previously mentioned attacks, and the attacker may need to have control of the system that contains the cryptosystem.
A known-algorithm attack Knowing the algorithm does not give you much advantage without knowing the key. This is a bogus detractor. The algorithm should be public, which is the Kerckhoffs's Principle . The only secret should be the key.
Reference(s) used for this question:
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000. and Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 866). McGraw-Hill. Kindle Edition. and Kerckhoffs's Principle
NEW QUESTION 274
Integrity = ______________
- A. Ability to access data when requested
- B. All answers are correct
- C. Data being kept correct and current
- D. Data being delivered from the source to the intended receiver without being altered
- E. Protection of data from unauthorized users
Answer: D
NEW QUESTION 275
Passwords can be required to change monthly, quarterly, or at other intervals:
- A. depending on the criticality of the information needing protection
- B. depending on the password's frequency of use
- C. not depending on the criticality of the information needing protection but depending on the password's frequency of use
- D. depending on the criticality of the information needing protection and the password's frequency of use
Answer: D
Explanation:
Explanation/Reference:
Passwords can be compromised and must be protected. In the ideal case, a password should only be used once. The changing of passwords can also fall between these two extremes. Passwords can be required to change monthly, quarterly, or at other intervals, depending on the criticality of the information needing protection and the password's frequency of use. Obviously, the more times a password is used, the more chance there is of it being compromised.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 36 & 37.
NEW QUESTION 276
Which of the following are additional access control objectives?
- A. Consistency and utility
- B. Usefulness and utility
- C. Convenience and utility
- D. Reliability and utility
Answer: D
Explanation:
Availability assures that a system's authorized users have timely and uninterrupted access to the information in the system. The additional access control objectives are reliability and utility. These and other related objectives flow from the organizational security policy. This policy is a high-level statement of management intent regarding the control of access to information and the personnel who are authorized to receive that information. Three things that must be considered for the planning and implementation of access control mechanisms are the threats to the system, the system's vulnerability to these threats, and the risk that the threat may materialize Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 32.
NEW QUESTION 277
Risk reduction in a system development life-cycle should be applied:
- A. Mostly to the disposal phase.
- B. Mostly to the development phase.
- C. Equally to all phases.
- D. Mostly to the initiation phase.
Answer: C
Explanation:
Explanation/Reference:
Risk is defined as the combination of the probability that a particular threat source will exploit, or trigger, a particular information system vulnerability and the resulting mission impact should this occur. Previously, risk avoidance was a common IT security goal. That changed as the nature of the risk became better understood. Today, it is recognized that elimination of all risk is not cost-effective. A cost-benefit analysis should be conducted for each proposed control. In some cases, the benefits of a more secure system may not justify the direct and indirect costs. Benefits include more than just prevention of monetary loss; for example, controls may be essential for maintaining public trust and confidence. Direct costs include the cost of purchasing and installing a given technology; indirect costs include decreased system performance and additional training. The goal is to enhance mission/business capabilities by managing mission/ business risk to an acceptable level.
Source: STONEBURNER, Gary & al, National Institute of Standards and Technology (NIST), NIST Special Publication 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), June 2001 (page 8).
NEW QUESTION 278
A contingency plan should address:
- A. Identified risks.
- B. Potential risks.
- C. Residual risks.
- D. All answers are correct.
Answer: D
Explanation:
Explanation/Reference:
Because it is rarely possible or cost effective to eliminate all risks, an attempt is made to reduce risks to an acceptable level through the risk assessment process. This process allows, from a set of potential risks (whether likely or not), to come up with a set of identified, possible risks.
The implementation of security controls allows reducing the identified risks to a smaller set of residual risks. Because these residual risks represent the complete set of situations that could affect system performance, the scope of the contingency plan may be reduced to address only this decreased risk set.
As a result, the contingency plan can be narrowly focused, conserving resources while ensuring an effective system recovery capability.
Source: SWANSON, Marianne, & al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 7).
NEW QUESTION 279
What is Kerberos?
- A. A trusted third-party authentication protocol.
- B. A remote authentication dial in user server.
- C. A security model.
- D. A three-headed dog from the egyptian mythology.
Answer: A
Explanation:
Section: Access Control
Explanation/Reference:
Is correct because that is exactly what Kerberos is.
The following answers are incorrect:
A three-headed dog from Egyptian mythology. Is incorrect because we are dealing with Information Security and not the Egyptian mythology but the Greek Mythology.
A security model. Is incorrect because Kerberos is an authentication protocol and not just a security model.
A remote authentication dial in user server. Is incorrect because Kerberos is not a remote authentication dial in user server that would be called RADIUS.
NEW QUESTION 280
Volatile memory is referred to as ROM.
- A. Yes
- B. No
Answer: B
Explanation:
Volatile memory is Random Access Memory (RAM)
NEW QUESTION 281
Which of the following usually provides reliable, real-time information without consuming network or host resources?
- A. application-based IDS
- B. firewall-based IDS
- C. host-based IDS
- D. network-based IDS
Answer: D
Explanation:
Section: Analysis and Monitoring
Explanation/Reference:
A network-based IDS usually provides reliable, real-time information without consuming network or host resources.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 48.
NEW QUESTION 282
Which of the following questions are least likely to help in assessing controls covering audit trails?
- A. Are incidents monitored and tracked until resolved?
- B. Is access to online logs strictly controlled?
- C. Does the audit trail provide a trace of user actions?
- D. Is there separation of duties between security personnel who administer the access control function and those who administer the audit trail?
Answer: A
Explanation:
Audit trails maintain a record of system activity by system or application processes and by user activity. In conjunction with appropriate tools and procedures, audit trails can provide individual accountability, a means to reconstruct events, detect intrusions, and identify problems. Audit trail controls are considered technical controls. Monitoring and tracking of incidents is more an operational control related to incident response capability.
Reference(s) used for this question:
SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-50 to A-51).
NOTE: NIST SP 800-26 has been superceded By: FIPS 200, SP 800-53, SP 800-53A You can find the new replacement at: http://csrc.nist.gov/publications/PubsSPs.html However, if you really wish to see the old standard, it is listed as an archived document at: http://csrc.nist.gov/publications/PubsSPArch.html
NEW QUESTION 283
Hierarchical Storage Management (HSM) is commonly employed in:
- A. very small data retrieval systems
- B. very large data retrieval systems
- C. shorter data retrieval systems
- D. most data retrieval systems
Answer: B
Explanation:
Explanation/Reference:
Hierarchical Storage Management (HSM) is commonly employed in very large data retrieval systems.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 71.
NEW QUESTION 284
Which of the following is a token-passing scheme like token ring that also has a second ring that remains dormant until an error condition is detected on the primary ring?
- A. Broadband
- B. Fast Ethernet
- C. Fiber Distributed Data Interface (FDDI).
- D. Ethernet
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
FDDI is a token-passing ring scheme like a token ring, yet it also has a second ring that remains dormant until an error condition is detected on the primary ring.
Fiber Distributed Data Interface (FDDI) provides a 100 Mbit/s optical standard for data transmission in a local area network that can extend in range up to 200 kilometers (124 miles). Although FDDI logical topology is a ring-based token network, it does not use the IEEE 802.5 token ring protocol as its basis; instead, its protocol is derived from the IEEE 802.4 token bus timed token protocol. In addition to covering large geographical areas, FDDI local area networks can support thousands of users. As a standard underlying medium it uses optical fiber, although it can use copper cable, in which case it may be refer to as CDDI (Copper Distributed Data Interface). FDDI offers both a Dual-Attached Station (DAS), counter-rotating token ring topology and a Single-Attached Station (SAS), token bus passing ring topology.
Ethernet is a family of frame-based computer networking technologies for local area networks (LANs). The name came from the physical concept of the ether. It defines a number of wiring and signaling standards for the Physical Layer of the OSI networking model as well as a common addressing format and Media Access Control at the Data Link Layer.
In computer networking, Fast Ethernet is a collective term for a number of Ethernet standards that carry traffic at the nominal rate of 100 Mbit/s, against the original Ethernet speed of 10 Mbit/s. Of the fast Ethernet standards 100BASE-TX is by far the most common and is supported by the vast majority of Ethernet hardware currently produced. Fast Ethernet was introduced in 1995 and remained the fastest version of Ethernet for three years before being superseded by gigabit Ethernet.
Broadband in data can refer to broadband networks or broadband Internet and may have the same meaning as above, so that data transmission over a fiber optic cable would be referred to as broadband as compared to a telephone modem operating at 56,000 bits per second. However, a worldwide standard for what level of bandwidth and network speeds actually constitute Broadband have not been determined.[1] Broadband in data communications is frequently used in a more technical sense to refer to data transmission where multiple pieces of data are sent simultaneously to increase the effective rate of transmission, regardless of data signaling rate. In network engineering this term is used for methods where two or more signals share a medium.[Broadband Internet access, often shortened to just broadband, is a high data rate Internet access- typically contrasted with dial-up access using a 56k modem.
Dial-up modems are limited to a bitrate of less than 56 kbit/s (kilobits per second) and require the full use of a telephone line-whereas broadband technologies supply more than double this rate and generally without disrupting telephone use.
Source:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 72.
also see:
http://en.wikipedia.org/
NEW QUESTION 285
Which of the following statements pertaining to VPN protocol standards is false?
- A. L2TP operates at the network layer.
- B. PPTP uses native PPP authentication and encryption services.
- C. L2TP is a combination of PPTP and L2F.
- D. L2TP and PPTP were designed for single point-to-point client to server communication.
Answer: A
Explanation:
Explanation/Reference:
L2TP and PPTP were both designed for individual client to server connections; they enable only a single point-to-point connection per session. Dial-up VPNs use L2TP often. Both L2TP and PPTP operate at the data link layer (layer 2) of the OSI model. PPTP uses native PPP authentication and encryption services and L2TP is a combination of PPTP and Layer 2 Forwarding protocol (L2F).
Source: KRUTZ, Ronald L & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
95).
NEW QUESTION 286
What does the simple security (ss) property mean in the Bell-LaPadula model?
- A. No write up
- B. No read up
- C. No write down
- D. No read down
Answer: B
Explanation:
Section: Access Control
Explanation/Reference:
The ss (simple security) property of the Bell-LaPadula access control model states that reading of information by a subject at a lower sensitivity level from an object at a higher sensitivity level is not permitted (no read up).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 202).
NEW QUESTION 287
Which of the following remote access authentication systems is the most robust?
- A. TACACS+
- B. PAP
- C. RADIUS
- D. TACACS
Answer: A
Explanation:
Explanation/Reference:
TACACS+ is a proprietary Cisco enhancement to TACACS and is more robust than RADIUS. PAP is not a remote access authentication system but a remote node security protocol.
Source: KRUTZ, Ronald L & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
122).
NEW QUESTION 288
Which of the following is best provided by symmetric cryptography?
- A. Integrity
- B. Confidentiality
- C. Availability
- D. Non-repudiation
Answer: B
Explanation:
Section: Cryptography
Explanation/Reference:
When using symmetric cryptography, both parties will be using the same key for encryption and decryption.
Symmetric cryptography is generally fast and can be hard to break, but it offers limited overall security in the fact that it can only provide confidentiality.
Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 2).
NEW QUESTION 289
Which of the following is not a security goal for remote access?
- A. Reliable authentication of users and systems
- B. Protection of confidential data
- C. Automated login for remote users
- D. Easy to manage access control to systems and network resources
Answer: C
Explanation:
An automated login function for remote users would imply a weak authentication, thus certainly not a security goal. Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management Handbook, 4th edition, volume 2, 2001, CRC Press, Chapter 5: An Introduction to Secure Remote Access (page 100).
NEW QUESTION 290
Due care is not related to:
- A. Best interest
- B. Profit
- C. Prudent man
- D. Good faith
Answer: B
Explanation:
Officers and directors of a company are expected to act carefully in fulfilling their tasks. A director shall act in good faith, with the care an ordinarily prudent person in a like position would exercise under similar circumstances and in a manner he reasonably believes is in the best interest of the enterprise. The notion of profit would tend to go against the due care principle.
Source: ANDRESS, Mandy, Exam Cram CISSP, Coriolis, 2001, Chapter 10: Law, Investigation, and Ethics (page 186).
NEW QUESTION 291
Of the reasons why a Disaster Recovery plan gets outdated, which of the following is not true?
- A. Large plans can take a lot of work to maintain
- B. Continous auditing makes a Disaster Recovery plan irrelevant
- C. Infrastructure and environment changes
- D. Personnel turnover
Answer: B
Explanation:
Explanation/Reference:
Although a auditing is a part of corporate security, it in no way supercedes the requirments for a disaster recovery plan. All others can be blamed for a plan going out of date.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter
9: Disaster Recovery and Business continuity (page 609).
NEW QUESTION 292
A DMZ is also known as a
- A. bastion host
- B. a place to attract hackers
- C. screened subnet
- D. three legged firewall
Answer: C
Explanation:
Explanation/Reference:
This is another name for the demilitarized zone (DMZ) of a network.
"Three legged firewall" is incorrect. While a DMZ can be implemented on one leg of such a device, this is not the best answer.
"A place to attract hackers" is incorrect. The DMZ is a way to provide limited public access to an organization's internal resources (DNS, EMAIL, public web, etc) not as an attractant for hackers.
"Bastion host" is incorrect. A bastion host serves as a gateway between trusted and untrusted network.
References:
CBK, p. 434
AIO3, pp. 495 - 496
NEW QUESTION 293
......
Use Valid New SSCP Test Notes & SSCP Valid Exam Guide: https://www.vceengine.com/SSCP-vce-test-engine.html
SSCP exam torrent ISC study guide: https://drive.google.com/open?id=10j587eD-SjLWB62ShdOyOTcBd-JdIiCI
