Jul-2024 Pass Your SSCP Exam at the First Try with 100% Real Exam
Get Real Exam Questions for SSCP with New Questions
Training Materials for SSCP Exam
Obtaining the (ISC)2 SSCP validation can be obtained if the candidates manage to find the right mix between the training classes delivered by (ISC)2 expert trainers and the self-paced materials that they find on verified sources. The candidates who want to get certified can try the following:
- (ISC)2 SSCP Study Guide and SSCP Practice Test Kit
This is the second edition available for this kit that provides comprehensive information to candidates who want to get SSCP certified. The kit is available on Amazon in paperback format. Its author is Mike Wills. As it combines both the study guide and practice tests workbook, this kit becomes an all-inclusive official exam preparation material. Also, this kit is approved by the vendor, which means that it comes with verified and updated information on the topics tested during the certification exam. The second edition was created based on the best practices and experience from past real tests. Thus, it includes an in-depth look at each of the domains assessed in the SSCP certification exam, following (ISC)2 guidelines and principles. Thanks to the expert content included in these materials, the exam-takers will pass the official exam faster and smarter. Besides, the practice questions are permanently updated to help the candidates understand how the exam is structured and check their preparedness level.
- Instructor-led Online Training for Systems Security Certified Practitioner
This is one of the official training classes delivered by the vendor. It is organized either in a session that lasts for 8 weeks during which the exam-takers will have classes 2 times per week while the second delivery method will be during 5 consecutive days. Irrespective of the method candidates choose, the (ISC)2 authorized trainer will deliver the class by following the exam topics and offering comprehensive details on different information security concepts. The trainers will organize the course by combining different methods to help the attendees improve their knowledge retention and reinforce the topics in which they were not so experienced. Apart from the instructor-led training, the attendees will also get additional materials from (ISC)2. Therefore, they will receive the official (ISC)2 courseware and the student’s handbook, available in electronic format. Also, examinees will receive interactive flashcards and access to post-course assessment that will help them consolidate their knowledge.
- (ISC)2 SSCP Actual Exam Questions and Answers
This book was published by Exam Boost and it is available on Amazon. The exam-takers can buy it in Kindle format for $19.99. It contains more than 500 real exam questions that help the candidates check their preparedness level and get used to the exam difficulty. All answers are displayed at the end of the book and they are organized in a table. Therefore, the readers are not spoiled with answers after each chapter. In addition, the author follows the chapters tested in the SSCP exam. So, all questions are extracted from past real validations. This means that all information provided in this book is 100% verified and should be considered a reliable source of training. Finally, the answers help the readers understand which topics they should focus on more and help them get the necessary information to get certified easier and faster.
NEW QUESTION # 566
An effective information security policy should not have which of the following characteristic?
- A. Be designed with a short- to mid-term focus
- B. Include separation of duties
- C. Specify areas of responsibility and authority
- D. Be understandable and supported by all stakeholders
Answer: A
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
An effective information security policy should be designed with a long-term focus. All other characteristics apply.
Source: ALLEN, Julia H., The CERT Guide to System and Network Security Practices, Addison-Wesley, 2001, Appendix B, Practice-Level Policy Considerations (page 397).
NEW QUESTION # 567
What kind of certificate is used to validate a user identity?
- A. Code signing certificate
- B. Root certificate
- C. Attribute certificate
- D. Public key certificate
Answer: D
Explanation:
In cryptography, a public key certificate (or identity certificate) is an electronic document which incorporates a digital signature to bind together a public key with an identity - information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual.
In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). In a web of trust scheme, the signature is of either the user (a self-signed certificate) or other users ("endorsements"). In either case, the signatures on a certificate are attestations by the certificate signer that the identity information and the public key belong together.
In computer security, an authorization certificate (also known as an attribute certificate) is a digital document that describes a written permission from the issuer to use a service or a resource that the issuer controls or has access to use. The permission can be delegated.
Some people constantly confuse PKCs and ACs. An analogy may make the distinction clear. A PKC can be considered to be like a passport: it identifies the holder, tends to last for a long time, and should not be trivial to obtain. An AC is more like an entry visa: it is typically issued by a different authority and does not last for as long a time. As acquiring an entry visa typically requires presenting a passport, getting a visa can be a simpler process.
A real life example of this can be found in the mobile software deployments by large service providers and are typically applied to platforms such as Microsoft Smartphone (and related), Symbian OS, J2ME, and others.
In each of these systems a mobile communications service provider may customize the mobile terminal client distribution (ie. the mobile phone operating system or application environment) to include one or more root certificates each associated with a set of capabilities or permissions such as "update firmware", "access address book", "use radio interface", and the most basic one, "install and execute". When a developer wishes to enable distribution and execution in one of these controlled environments they must acquire a certificate from an appropriate CA, typically a large commercial CA, and in the process they usually have their identity verified using out-of-band mechanisms such as a combination of phone call, validation of their legal entity through government and commercial databases, etc., similar to the high assurance SSL certificate vetting process, though often there are additional specific requirements imposed on would-be developers/publishers.
Once the identity has been validated they are issued an identity certificate they can use to sign their software; generally the software signed by the developer or publisher's identity
certificate is not distributed but rather it is submitted to processor to possibly test or profile
the content before generating an authorization certificate which is unique to the particular
software release. That certificate is then used with an ephemeral asymmetric key-pair to
sign the software as the last step of preparation for distribution. There are many
advantages to separating the identity and authorization certificates especially relating to
risk mitigation of new content being accepted into the system and key management as well
as recovery from errant software which can be used as attack vectors.
References:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne,
page 540.
http://en.wikipedia.org/wiki/Attribute_certificate
http://en.wikipedia.org/wiki/Public_key_certificate
NEW QUESTION # 568
Which of the following criteria is used to determine the proper classification of a data object?<br>(Choose three)
- A. Age
- B. Value
- C. Useful life
- D. Sensitivity
- E. Storage cost
Answer: A,B,C
Explanation:
The criterion used to value information includes: personal association, useful life, value, and age.
NEW QUESTION # 569
EDI (Electronic Data Interchange) differs from e-Commerce in that ___________________.
- A. E-Commerce involves only computer to computer transactions
- B. EDI involves only computer to computer transactions
- C. EDI allows companies to take credit cards directly to consumers via the web
- D. None of the items listed accurately reflect the differences between EDI and e-Commerce
Answer: B
NEW QUESTION # 570
Which of the following is best at defeating frequency analysis?
- A. Ceasar Cipher
- B. Transposition cipher
- C. Polyalphabetic cipher
- D. Substitution cipher
Answer: C
Explanation:
Simple substitution and transposition ciphers are vulnerable to attacks that
perform frequency analysis.
In every language, there are words and patterns that are used more than others.
Some patterns common to a language can actually help attackers figure out the
transformation between plaintext and ciphertext, which enables them to figure out the key
that was used to perform the transformation. Polyalphabetic ciphers use different alphabets
to defeat frequency analysis.
The ceasar cipher is a very simple substitution cipher that can be easily defeated and it
does show repeating letters.
Out of list presented, it is the Polyalphabetic cipher that would provide the best protection
against simple frequency analysis attacks.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-
Hill/Osborne, 2002, Chapter 8: Cryptography (page 507).
And : DUPUIS, Clement, CISSP Open Study Guide on domain 5, cryptography, April 1999.
NEW QUESTION # 571
Which of the following would be LESS likely to prevent an employee from reporting an incident?
- A. They are afraid of being accused of something they didn't do.
- B. They are afraid of being pulled into something they don't want to be involved with.
- C. They are unaware of the company's security policies and procedures.
- D. The process of reporting incidents is centralized.
Answer: D
Explanation:
Explanation/Reference:
The reporting process should be centralized else employees won't bother.
The other answers are incorrect because :
They are afraid of being pulled into something they don't want to be involved with is incorrect as most of the employees fear of this and this would prevent them to report an incident.
They are afraid of being accused of something they didn't do is also incorrect as this also prevents them to report an incident.
They are unaware of the company's security policies and procedures is also incorrect as mentioned above.
Reference : Shon Harris AIO v3 , Ch-10 : Laws , Investigatio & Ethics , Page : 675.
NEW QUESTION # 572
Which of the following is most appropriate to notify an external user that session monitoring is being conducted?
- A. Logon Banners
- B. Written agreement
- C. Wall poster
- D. Employee Handbook
Answer: A
Explanation:
Explanation/Reference:
Banners at the log-on time should be used to notify external users of any monitoring that is being conducted. A good banner will give you a better legal stand and also makes it obvious the user was warned about who should access the system and if it is an unauthorized user then he is fully aware of trespassing.
This is a tricky question, the keyword in the question is External user.
There are two possible answers based on how the question is presented, this question could either apply to internal users or ANY anonymous user.
Internal users should always have a written agreement first, then logon banners serve as a constant reminder.
Anonymous users, such as those logging into a web site, ftp server or even a mail server; their only notification system is the use of a logon banner.
References used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 50.
and
Shon Harris, CISSP All-in-one, 5th edition, pg 873
NEW QUESTION # 573
Which of the following is a problem regarding computer investigation issues?
- A. Information is tangible.
- B. In many instances, an expert or specialist is not required.
- C. Computer-generated records are only considered secondary evidence, thus are not as reliable as best evidence.
- D. Evidence is easy to gather.
Answer: C
Explanation:
Because computer-generated records normally fall under the category of hearsay evidence because they cannot be proven accurate and reliable this can be a problem.
Under the U.S. Federal Rules of Evidence, hearsay evidence is generally not admissible in court. This inadmissibility is known as the hearsay rule, although there are some exceptions for how, when, by whom and in what circumstances data was collected. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 9: Law, Investigation, and Ethics (page 310).
IMPORTANT NOTE: For the purpose of the exam it is very important to remember the Business Record exemption to the Hearsay Rule. For example: if you create log files and review them on a regular basis as part of a business process, such files would be admissable in court and they would not be considered hearsay because they were made in the course of regular business and it is part of regular course of business to create such record.
Here is another quote from the HISM book:
Business Record Exemption to the Hearsay Rule Federal Rules of Evidence 803(6) allow a court to admit a report or other business document made at or near the time by or from information transmitted by a person with knowledge, if kept in the course of regularly conducted business activity, and if it was the regular practice of that business activity to make the [report or document], all as shown by testimony of the custodian or other qualified witness, unless the source of information or the method or circumstances of preparation indicate lack of trustworthiness.
To meet Rule 803(6) the witness must:
Have custody of the records in question on a regular basis.
Rely on those records in the regular course of business.
Know that they were prepared in the regular course of business.
Audit trails meet the criteria if they are produced in the normal course of business. The process to produce the output will have to be proven to be reliable. If computer-generated evidence is used and admissible, the court may order disclosure of the details of the computer, logs, and maintenance records in respect to the system generating the printout, and then the defense may use that material to attack the reliability of the evidence. If the audit trails are not used or reviewed - at least the exceptions (e.g., failed log-on attempts)
- in the regular course of business, they do not meet the criteria for admissibility.
Federal Rules of Evidence 1001(3) provide another exception to the hearsay rule. This rule
allows a memory or disk dump to be admitted as evidence, even though it is not done in
the regular course of business. This dump merely acts as statement of fact. System dumps
(in binary or hexadecimal) are not hearsay because they are not being offered to prove the
truth of the contents, but only the state of the computer.
BUSINESS RECORDS LAW EXAMPLE:
The business records law was enacted in 1931 (PA No. 56). For a document to be
admissible under the statute, the proponent must show: (1) the document was made in the
regular course of business; (2) it was the regular course of business to make the record;
and (3) the record was made when the act, transaction, or event occurred, or shortly
thereafter (State v. Vennard, 159 Conn. 385, 397 (1970); Mucci v. LeMonte, 157 Conn.
566, 570 (1969). The failure to establish any one of these essential elements renders the
document inadmissible under the statute (McCahill v. Town and Country Associates, Ltd. ,
185 Conn. 37 (1981); State v. Peary, 176 Conn. 170 (1978); Welles v. Fish Transport Co. ,
, 123 Conn. 49 (1937).
The statute expressly provides that the person who made the business entry does not have
to be unavailable as a witness and the proponent does not have to call as a witness the
person who made the record or show the person to be unavailable (State v. Jeustiniano,
172 Conn. 275 (1977).
The person offering the business records as evidence does not have to independently
prove the trustworthiness of the record. But, there is no presumption that the record is
accurate; the record's accuracy and weight are issues for the trier of fact (State v. Waterman, 7 Conn. App. 326 (1986); Handbook of Connecticut Evidence, Second Edition, $ 11. 14. 3).
Reference: http://search.cga.state.ct.us/dtsearch_lpa.asp?cmd=getdoc&DocId=16833&Index=I%3A%5 Czindex%5C1995&HitCount=0&hits=&hc=0&req=&Item=712
NEW QUESTION # 574
Which of the following cryptographic attacks describes when the attacker has a copy of the plaintext and the corresponding ciphertext?
- A. brute force
- B. known plaintext
- C. chosen plaintext
- D. ciphertext only
Answer: B
Explanation:
The goal to this type of attack is to find the cryptographic key that was used to encrypt the message. Once the key has been found, the attacker would then be able to decrypt all messages that had been encrypted using that key.
The known-plaintext attack (KPA) or crib is an attack model for cryptanalysis where the attacker has samples of both the plaintext and its encrypted version (ciphertext), and is at liberty to make use of them to reveal further secret information such as secret keys and code books. The term "crib" originated at Bletchley Park, the British World War II decryption operation
In cryptography, a brute force attack or exhaustive key search is a strategy that can in theory be used against any encrypted data by an attacker who is unable to take advantage of any weakness in an encryption system that would otherwise make his task easier. It involves systematically checking all possible keys until the correct key is found. In the worst case, this would involve traversing the entire key space, also called search space.
In cryptography, a ciphertext-only attack (COA) or known ciphertext attack is an attack model for cryptanalysis where the attacker is assumed to have access only to a set of ciphertexts.
The attack is completely successful if the corresponding plaintexts can be deduced, or even better, the key. The ability to obtain any information at all about the underlying plaintext is still considered a success. For example, if an adversary is sending ciphertext continuously to maintain traffic-flow security, it would be very useful to be able to distinguish real messages from nulls. Even making an informed guess of the existence of real messages would facilitate traffic analysis.
In the history of cryptography, early ciphers, implemented using pen-and-paper, were routinely broken using ciphertexts alone. Cryptographers developed statistical techniques for attacking ciphertext, such as frequency analysis. Mechanical encryption devices such as Enigma made these attacks much more difficult (although, historically, Polish cryptographers were able to mount a successful ciphertext-only cryptanalysis of the Enigma by exploiting an insecure protocol for indicating the message settings).
Every modern cipher attempts to provide protection against ciphertext-only attacks. The vetting process for a new cipher design standard usually takes many years and includes exhaustive testing of large quantities of ciphertext for any statistical departure from random noise. See: Advanced Encryption Standard process. Also, the field of steganography evolved, in part, to develop methods like mimic functions that allow one piece of data to adopt the statistical profile of another. Nonetheless poor cipher usage or reliance on homegrown proprietary algorithms that have not been subject to thorough scrutiny has resulted in many computer-age encryption systems that are still subject to ciphertext-only attack. Examples include:
Early versions of Microsoft's PPTP virtual private network software used the same RC4 key for the sender and the receiver (later versions had other problems). In any case where a stream cipher like RC4 is used twice with the same key it is open to ciphertext-only attack. See: stream cipher attack Wired Equivalent Privacy (WEP), the first security protocol for Wi-Fi, proved vulnerable to several attacks, most of them ciphertext-only.
A chosen-plaintext attack (CPA) is an attack model for cryptanalysis which presumes that the attacker has the capability to choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts. The goal of the attack is to gain some further information which reduces the security of the encryption scheme. In the worst case, a chosen-plaintext attack could reveal the scheme's secret key.
This appears, at first glance, to be an unrealistic model; it would certainly be unlikely that an attacker could persuade a human cryptographer to encrypt large amounts of plaintexts of the attacker's choosing. Modern cryptography, on the other hand, is implemented in software or hardware and is used for a diverse range of applications; for many cases, a chosen-plaintext attack is often very feasible. Chosen-plaintext attacks become extremely important in the context of public key cryptography, where the encryption key is public and attackers can encrypt any plaintext they choose.
Any cipher that can prevent chosen-plaintext attacks is then also guaranteed to be secure against known-plaintext and ciphertext-only attacks; this is a conservative approach to security.
Two forms of chosen-plaintext attack can be distinguished:
Batch chosen-plaintext attack, where the cryptanalyst chooses all plaintexts before any of them are encrypted. This is often the meaning of an unqualified use of "chosen-plaintext attack".
Adaptive chosen-plaintext attack, where the cryptanalyst makes a series of interactive queries, choosing subsequent plaintexts based on the information from the previous encryptions.
References:
Source: TIPTON, Harold, Official (ISC)2 Guide to the CISSP CBK (2007), page 271. and Wikipedia at the following links: http://en.wikipedia.org/wiki/Chosen-plaintext_attack http://en.wikipedia.org/wiki/Known-plaintext_attack http://en.wikipedia.org/wiki/Ciphertext-only_attack http://en.wikipedia.org/wiki/Brute_force_attack
NEW QUESTION # 575
Which of the following best describes remote journaling?
- A. Real-time capture of transactions to multiple storage devices.
- B. Send hourly tapes containing transactions off-site.
- C. Real time transmission of copies of the entries in the journal of transactions to an alternate site.
- D. Send daily tapes containing transactions off-site.
Answer: C
Explanation:
Remote Journaling is a technology to facilitate sending copies of the journal of transaction entries from a production system to a secondary system in realtime. The remote nature of such a connection is predicated upon having local journaling already established. Local journaling on the production side allows each change that ensues for a journal-eligible object e.g., database physical file, SQL table, data area, data queue, byte stream file residing within the IFS) to be recorded and logged. It's these local images that flow to the remote system. Once there, the journal entries serve a variety of purposes, from feeding a high availability software replay program or data warehouse to offering an offline, realtime vault of the most recent database changes.
NEW QUESTION # 576
In what way could Java applets pose a security threat?
- A. Their transport can interrupt the secure distribution of World Wide Web pages over the Internet by removing SSL and S-HTTP
- B. Java does not check the bytecode at runtime or provide other safety mechanisms for program isolation from the client system.
- C. Java interpreters do not provide the ability to limit system access that an applet could have on a client system.
- D. Executables from the Internet may attempt an intentional attack when they are downloaded on a client system.
Answer: D
Explanation:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
Topic 3, Analysis and Monitoring
NEW QUESTION # 577
The type of discretionary access control (DAC) that is based on an individual's identity is also called:
- A. Identity-based Access control
- B. Non-Discretionary Access Control
- C. Rule-based Access control
- D. Lattice-based Access control
Answer: A
Explanation:
An identity-based access control is a type of Discretionary Access Control (DAC) that is based on an individual's identity.
DAC is good for low level security environment. The owner of the file decides who has access to the file.
If a user creates a file, he is the owner of that file. An identifier for this user is placed in the file header and/or in an access control matrix within the operating system.
Ownership might also be granted to a specific individual. For example, a manager for a certain department might be made the owner of the files and resources within her department. A system that uses discretionary access control (DAC) enables the owner of the resource to specify which subjects can access specific resources.
This model is called discretionary because the control of access is based on the discretion of the owner. Many times department managers, or business unit managers , are the owners of the data within their specific department. Being the owner, they can specify who should have access and who should not.
NEW QUESTION # 578
Which of the following statements pertaining to software testing approaches is correct?
- A. A bottom-up approach allows interface errors to be detected earlier.
- B. The test plan and results should be retained as part of the system's permanent documentation.
- C. Black box testing is predicated on a close examination of procedural detail.
- D. A top-down approach allows errors in critical modules to be detected earlier.
Answer: B
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
A bottom-up approach to testing begins testing of atomic units, such as programs or modules, and works upwards until a complete system testing has taken place. It allows errors in critical modules to be found early.
A top-down approach allows for early detection of interface errors and raises confidence in the system, as programmers and users actually see a working system. White box testing is predicated on a close examination of procedural detail. Black box testing examines some aspect of the system with little regard for the internal logical structure of the software.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 300).
Top Down Testing: An approach to integration testing where the component at the top of the component hierarchy is tested first, with lower level components being simulated by stubs. Tested components are then used to test lower level components. The process is repeated until the lowest level components have been tested.
Bottom Up Testing: An approach to integration testing where the lowest level components are tested first, then used to facilitate the testing of higher level components. The process is repeated until the component at the top of the hierarchy is tested.
Black Box Testing: Testing based on an analysis of the specification of a piece of software without reference to its internal workings. The goal is to test how well the component conforms to the published requirements for the component.
NEW QUESTION # 579
What kind of Encryption technology does SSL utilize?
- A. Public Key
- B. Hybrid (both Symmetric and Asymmetric)
- C. Secret or Symmetric key
- D. Private key
Answer: B
Explanation:
Section: Cryptography
Explanation/Reference:
SSL use public-key cryptography to secure session key, while the session key (secret key) is used to secure the whole session taking place between both parties communicating with each other.
The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0." SSL version 3.0, released in 1996, was a complete redesign of the protocol produced by Paul Kocher working with Netscape engineers Phil Karlton and Alan Freier.
All of the other answers are incorrect
NEW QUESTION # 580
Which of the following rules pertaining to a Business Continuity Plan/Disaster Recovery Plan is incorrect?
- A. There should be requirements to form a committee to decide a course of action. These decisions should be made ahead of time and incorporated into the plan.
- B. In its procedures and tasks, the plan should refer to functions, not specific individuals.
- C. Critical vendors should be contacted ahead of time to validate equipment can be obtained in a timely manner.
- D. In order to facilitate recovery, a single plan should cover all locations.
Answer: D
Explanation:
The first documentation rule when it comes to a BCP/DRP is "one plan, one building". Much of the plan revolves around reconstructing a facility and replenishing it with production contents. If more than one facility is involved, then the reader of the plan will find it difficult to identify quantities and specifications of replacement resource items. It is possible to have multiple plans for a single building, but those plans must be linked so that the identification and ordering of resource items is centralized. All other statements are correct.
Source: BARNES, James C. & ROTHSTEIN, Philip J., A Guide to Business Continuity Planning, John Wiley & Sons, 2001 (page 162).
NEW QUESTION # 581
Which of the following is not a form of passive attack?
- A. Scavenging
- B. Data diddling
- C. Shoulder surfing
- D. Sniffing
Answer: B
Explanation:
Data diddling involves alteration of existing data and is extremely common. It is one of the easiest types of crimes to prevent by using access and accounting controls, supervision, auditing, separation of duties, and authorization limits. It is a form of active attack. All other choices are examples of passive attacks, only affecting confidentiality.
NEW QUESTION # 582
......
Updated SSCP Certification Exam Sample Questions: https://www.examboosts.com/ISC/SSCP-practice-exam-dumps.html
Get Unlimited Access to SSCP Certification Exam Cert Guide: https://drive.google.com/open?id=1oxclYpZ-kj_17jOh3_on23w7M8D6Aur8