Free Sales Ending Soon - 100% Valid SSCP Exam Dumps with 1074 Questions
Verified SSCP dumps Q&As on your ISC Certification Exam Questions Certain Success!
Conclusion
Becoming an (ISC)2 Systems Security Certified Practitioner is a matter of checking the exam blueprint carefully and understanding what’s expected from you. Passing the certification exam from the first attempt is achievable as long as the candidates enroll in (ISC)2 official training sessions and check the study guides available on Amazon along with other reliable sources.
NEW QUESTION 257
Which of the following statements pertaining to the maintenance of an IT contingency plan is incorrect?
- A. Copies of the plan should be provided to recovery personnel for storage offline at home and office.
- B. The Contingency Planning Coordinator should make sure that every employee gets an up-to-date copy of the plan.
- C. Strict version control should be maintained.
- D. The plan should be reviewed at least once a year for accuracy and completeness.
Answer: B
Explanation:
Explanation/Reference:
Because the contingency plan contains potentially sensitive operational and personnel information, its distribution should be marked accordingly and controlled. Not all employees would obtain a copy, but only those involved in the execution of the plan.
All other statements are correct.
NOTE FROM CLEMENT:
I have received multiple emails stating the explanations contradict the correct answer. It seems many people have a hard time with negative question. In this case the Incorrect choice (the one that is not true) is the correct choice. Be very carefull of such questions, you will get some on the real exam as well.
Reference(s) used for this question:
SWANSON, Marianne, & al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems
NEW QUESTION 258
What is the primary role of cross certification?
- A. set up direct trust to a second root CA
- B. Build an overall PKI hierarchy
- C. Creating trust between different PKIs
- D. Prevent the nullification of user certificates by CA certificate revocation
Answer: C
Explanation:
More and more organizations are setting up their own internal PKIs. When these independent PKIs need to interconnect to allow for secure communication to take place (either between departments or different companies), there must be a way for the two root CAs to trust each other.
These two CAs do not have a CA above them they can both trust, so they must carry out cross certification. A cross certification is the process undertaken by CAs to establish a trust relationship in which they rely upon each other's digital certificates and public keys as if they had issued them themselves.
When this is set up, a CA for one company can validate digital certificates from the other company and vice versa.
Reference(s) used for this question:
For more information and illustration on Cross certification: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/w s03qswp.mspx http://www.entrust.com/resources/pdf/cross_certification.pdf
also see:
Shon Harris, CISSP All in one book, 4th Edition, Page 727
and
RFC 2459: Internet X.509 Public Key Infrastructure Certificate and CRL Profile; FORD,
Warwick & BAUM, Michael S., Secure Electronic Commerce: Building the Infrastructure for
Digital Signatures and Encryption (2nd Edition), 2000, Prentice Hall PTR, Page 254.
NEW QUESTION 259
What is a characteristic of using the Electronic Code Book mode of DES encryption?
- A. A given block of plaintext and a given key will always produce the same ciphertext.
- B. Repetitive encryption obscures any repeated patterns that may have been present in the plaintext.
- C. The previous DES output is used as input.
- D. Individual characters are encoded by combining output from earlier encryption routines with plaintext.
Answer: A
Explanation:
A given message and key always produce the same ciphertext.
The following answers are incorrect:
Repetitive encryption obscures any repeated patterns that may have been present in the plaintext. Is incorrect because with Electronic Code Book a given 64 bit block of plaintext always produces the same ciphertext
Individual characters are encoded by combining output from earlier encryption routines with plaintext. This is incorrect because with Electronic Code Book processing 64 bits at a time until the end of the file was reached. This is a characteristic of Cipher Feedback. Cipher Feedback the ciphertext is run through a key-generating device to create the key for the next block of plaintext.
The previous DES output is used as input. Is incorrect because This is incorrect because with Electronic Code Book processing 64 bits at a time until the end of the file was reached . This is a characteristic of Cipher Block Chaining. Cipher Block Chaining uses the output from the previous block to encrypt the next block.
NEW QUESTION 260
Why is Network File System (NFS) used?
- A. It enables two different types of file systems to use IP/IPX.
- B. It enables two different types of file systems to share Sun applications.
- C. It enables two different types of file systems to interoperate.
- D. It enables two different types of file systems to emulate each other.
Answer: C
Explanation:
Explanation/Reference:
Network File System (NFS) is a TCP/IP client/server application developed by Sun that enables different types of file systems to interoperate regardless of operating system or network architecture.
Source: KRUTZ, Ronald L & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 88.
NEW QUESTION 261
In the context of Biometric authentication, what is a quick way to compare the accuracy of devices. In general, the device that have the lowest value would be the most accurate. Which of the following would be used to compare accuracy of devices?
- A. the FRR is used
- B. the FAR is used
- C. the FER is used
- D. the CER is used.
Answer: D
Explanation:
equal error rate or crossover error rate (EER or CER): the rate at which both accept and reject errors are equal. The value of the EER can be easily obtained from the ROC curve. The EER is a quick way to compare the accuracy of devices with different ROC curves. In general, the device with the lowest EER is most accurate.
In the context of Biometric Authentication almost all types of detection permit a system's sensitivity to be increased or decreased during an inspection process. If the system's sensitivity is increased, such as in an airport metal detector, the system becomes increasingly selective and has a higher False Reject Rate (FRR).
Conversely, if the sensitivity is decreased, the False Acceptance Rate (FAR) will increase. Thus, to have a valid measure of the system performance, the CrossOver Error Rate (CER) is used.
The following are used as performance metrics for biometric systems:
false accept rate or false match rate (FAR or FMR): the probability that the system incorrectly matches the input pattern to a non-matching template in the database. It measures the percent of invalid inputs which are incorrectly accepted. In case of similarity scale, if the person is imposter in real, but the matching score is higher than the threshold, then he is treated as genuine that increase the FAR and hence performance also depends upon the selection of threshold value.
false reject rate or false non-match rate (FRR or FNMR): the probability that the system fails to detect a match between the input pattern and a matching template in the database. It measures the percent of valid inputs which are incorrectly rejected.
failure to enroll rate (FTE or FER): the rate at which attempts to create a template from an input is unsuccessful. This is most commonly caused by low quality inputs.
failure to capture rate (FTC): Within automatic systems, the probability that the system fails to detect a biometric input when presented correctly.
template capacity: the maximum number of sets of data which can be stored in the system.
Reference(s) used for this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 37. and Wikipedia at: https://en.wikipedia.org/wiki/Biometrics
NEW QUESTION 262
What ensures that the control mechanisms correctly implement the security policy for the entire life cycle of an information system?
- A. Accountability controls
- B. Assurance procedures
- C. Mandatory access controls
- D. Administrative controls
Answer: B
Explanation:
Controls provide accountability for individuals accessing information.
Assurance procedures ensure that access control mechanisms correctly implement the
security policy for the entire life cycle of an information system.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control
systems (page 33).
NEW QUESTION 263
Total risk is defined as:
- A. Threats * Vulnerability * Asset Replacement Cost = Total Risk
- B. Total Risk = Asset Value * Exposure
- C. Threats * Estimated Downtime * Asset Value = Total Risk
- D. Threats * Vulnerability * Asset Value = Total Risk
- E. Threats * Vulnerability * Asset Control Gap = Total Risk
Answer: D
Explanation:
(Threats * Vulnerability * Asset Value = Total Risk) is the formula used to calculate risk.
NEW QUESTION 264
Packet Filtering Firewalls can also enable access for:
- A. only unauthorized application port or service numbers.
- B. only authorized application port or service numbers.
- C. only authorized application port or ex-service numbers.
- D. only authorized application port or service integers.
Answer: B
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
Firewall rules can be used to enable access for traffic to specific ports or services. "Service numbers" is rather stilted English but you may encounter these types of wordings on the actual exam -- don't let them confuse you.
"Only unauthorized application port or service numbers" is incorrect. Unauthorized ports/services would be blocked in a properly installed firewall rather than permitting access.
"Only authorized application port or ex-service numbers" is incorrect. "Ex-service" numbers is a nonsense term meant to distract you.
"Only authorized application port or service integers." While service numbers are in fact integers, the more usual (and therefore better) answer is either service or "service number." References CBK, p. 464 AIO3, pp. 482 - 484
NEW QUESTION 265
Which of the following NAT firewall translation modes offers no protection from hacking attacks to an internal host using this functionality?
- A. Load balancing translation
- B. Network redundancy translation
- C. Static translation
- D. Dynamic translation
Answer: C
Explanation:
Static translation (also called port forwarding), assigns a fixed address to a
specific internal network resource (usually a server).
Static NAT is required to make internal hosts available for connection from external hosts.
It merely replaces port information on a one-to-one basis. This affords no protection to
statistically translated hosts: hacking attacks will be just as efficiently translated as any
other valid connection attempt.
NOTE FROM CLEMENT:
Hiding Nat or Overloaded Nat is when you have a group of users behind a unique public IP
address. This will provide you with some security through obscurity where an attacker
scanning your network would see the unique IP address on the outside of the gateway but
could not tell if there is one user, ten users, or hundreds of users behind that IP.
NAT was NEVER built as a security mechanism.
In the case of Static NAT used for some of your servers for example, your web server
private IP is map to a valid external public IP on a one on one basis, your SMTP server
private IP is mapped to a static public IP, and so on.
If an attacker scan the IP address range on the external side of the gateway he would
discover every single one of your servers or any other hosts using static natting. Ports that
are open, services that are listening, and all of this info could be gathered just as if the
server was in fact using a public IP. It does not provide this security through obscurity
mentioned above.
All of the other answer are incorrect.
Reference used for this question:
STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 7:
Network Address Translation.
NEW QUESTION 266
Which SSL version offers client-side authentication?
- A. SSL v2
- B. SSL v1
- C. SSL v3
- D. SSL v4
Answer: C
Explanation:
Explanation/Reference:
Secure Sockets Layer (SSL) is the technology used in most Web-based applications. SSL version 2.0 supports strong authentication of the web server, but the authentication of the client side only comes with version 3.0. SSL v4 is not a defined standard.
Source: TIPTON, Harold F & KRAUSE, Micki, Information Security Management Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 3, Secured Connections to External Networks (page 54).
NEW QUESTION 267
Which of the following pairings uses technology to enforce access control policies?
- A. Preventive/Administrative
- B. Preventive/Physical
- C. Preventive/Technical
- D. Detective/Administrative
Answer: C
Explanation:
Section: Access Control
Explanation/Reference:
The preventive/technical pairing uses technology to enforce access control policies.
TECHNICAL CONTROLS
Technical security involves the use of safeguards incorporated in computer hardware, operations or applications software, communications hardware and software, and related devices. Technical controls are sometimes referred to as logical controls.
Preventive Technical Controls
Preventive technical controls are used to prevent unauthorized personnel or programs from gaining remote access to computing resources. Examples of these controls include:
Access control software.
Antivirus software.
Library control systems.
Passwords.
Smart cards.
Encryption.
Dial-up access control and callback systems.
Preventive Physical Controls
Preventive physical controls are employed to prevent unauthorized personnel from entering computing facilities (i.e., locations housing computing resources, supporting utilities, computer hard copy, and input data media) and to help protect against natural disasters. Examples of these controls include:
Backup files and documentation.
Fences.
Security guards.
Badge systems.
Double door systems.
Locks and keys.
Backup power.
Biometric access controls.
Site selection.
Fire extinguishers.
Preventive Administrative Controls
Preventive administrative controls are personnel-oriented techniques for controlling people's behavior to ensure the confidentiality, integrity, and availability of computing data and programs. Examples of preventive administrative controls include:
Security awareness and technical training.
Separation of duties.
Procedures for recruiting and terminating employees.
Security policies and procedures.
Supervision.
Disaster recovery, contingency, and emergency plans.
User registration for computer access.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 34.
NEW QUESTION 268
What are the two most critical aspects of risk analysis? (Choose two)
- A. Identifying vulnerabilities
- B. Identifying threats
- C. Identifying assets
- D. Identifying resources
Answer: B,C
NEW QUESTION 269
What is the highest amount a company should spend annually on countermeasures for protecting an asset valued at $1,000,000 from a threat that has an annualized rate of occurrence (ARO) of once every five years and an exposure factor (EF) of 30%?
- A. $60,000
- B. $1,500
- C. $300,000
- D. $150,000
Answer: A
Explanation:
Explanation/Reference:
The cost of a countermeasure should not be greater in cost than the risk it mitigates (ALE). For a quantitative risk assessment, the equation is ALE = ARO x SLE where the SLE is calculated as the product of asset value x exposure factor. An event that happen once every five years would have an ARO of .2 (1 divided by 5).
SLE = Asset Value (AV) x Exposure Fact (EF)
SLE = 1,000,000 x .30 = 300,000
ALE = SLE x Annualized Rate of Occurance (ARO)
ALE = 300,000 x .2 = 60,000
Know your acronyms:
ALE -- Annual loss expectancy
ARO -- Annual rate of occurrence
SLE -- Single loss expectancy
The following are incorrect answers:
$300,000 is incorrect. See the explanation of the correct answer for the correct calculation.
$150,000 is incorrect. See the explanation of the correct answer for the correct calculation.
$1,500 is incorrect. See the explanation of the correct answer for the correct calculation.
Reference(s) used for this question:
Mc Graw Hill, Shon Harris, CISSP All In One (AIO) book, Sixth Edition , Pages 87-88 and
Official ISC2 Guide to the CISSP Exam, (OIG), Pages 60-61
NEW QUESTION 270
What can be described as a measure of the magnitude of loss or impact on the value of an asset?
- A. Vulnerability
- B. Exposure factor
- C. Probability
- D. Threat
Answer: B
Explanation:
The exposure factor is a measure of the magnitude of loss or impact on the value of an asset.
The probability is the chance or likelihood, in a finite sample, that an event will occur or that
a specific loss value may be attained should the event occur.
A vulnerability is the absence or weakness of a risk-reducing safeguard.
A threat is event, the occurrence of which could have an undesired impact.
Source: ROTHKE, Ben, CISSP CBK Review presentation on domain 3, August 1999.
NEW QUESTION 271
Which property ensures that only the intended recipient can access the data and nobody else?
- A. Confidentiality
- B. Availability
- C. Integrity
- D. Capability
Answer: A
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Confidentiality is defined as the property that ensures that only the intended recipient can access the data and nobody else. It is usually achieve using cryptogrphic methods, tools, and protocols.
Confidentiality supports the principle of "least privilege" by providing that only authorized individuals, processes, or systems should have access to information on a need-to-know basis. The level of access that an authorized individual should have is at the level necessary for them to do their job. In recent years, much press has been dedicated to the privacy of information and the need to protect it from individuals, who may be able to commit crimes by viewing the information. Identity theft is the act of assuming one's identity through knowledge of confidential information obtained from various sources.
The following are incorrect answers:
Capability is incorrect. Capability is relevant to access control. Capability-based security is a concept in the design of secure computing systems, one of the existing security models. A capability (known in some systems as a key) is a communicable, unforgeable token of authority. It refers to a value that references an object along with an associated set of access rights. A user program on a capability-based operating system must use a capability to access an object. Capability-based security refers to the principle of designing user programs such that they directly share capabilities with each other according to the principle of least privilege, and to the operating system infrastructure necessary to make such transactions efficient and secure.
Integrity is incorrect. Integrity protects information from unauthorized modification or loss.
Availability is incorrect. Availability assures that information and services are available for use by authorized entities according to the service level objective.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 9345-9349). Auerbach Publications. Kindle Edition.
http://en.wikipedia.org/wiki/Capability-based_security
NEW QUESTION 272
......
SSCP Exam Dumps - 100% Marks In SSCP Exam: https://www.exam-killer.com/SSCP-valid-questions.html
Exam Dumps Use Real ISC Certification Dumps With 1074 Questions: https://drive.google.com/open?id=1I0EeuZ9kc8_BzZVV2R00ONWKqU03IEcq
