Pass ISC System Security Certified Practitioner (SSCP) Exam in First Attempt Guaranteed Updated Dump from RealVCE!
Pass SSCP Exam with 1074 Questions - Verified By RealVCE
Learn about the Threats
Targets of Phishing/DNS/ARIN DNS records, Social engineering attacks; scammers are using social engineering methods to do wrong and gain access into networks, which are vulnerable to these types of attacks. The Cybercriminal will release an email to the user, pretending to be the system administrator, asking them to perform a procedure or change their password. If the user follows through with these changes, it may expose the network and allow cybercriminals access.
Certification topics of ISC SSCP Exam
ISC SSCP Dumps of ISC SSCP Certification Exam covers the following topics:
- Documenting all security-relevant activities within an organization.
- Risk management: considerations in selecting the appropriate controls, keeping them in place, monitoring them across an organization's network infrastructure.
- Managing the cybersecurity of the organization including compliance with laws and regulations (federal, state, and international).
- Using tools such as ethical hacking to assess network vulnerabilities.
- Using tools such as penetration testing to assess security controls and vulnerabilities.
SSCP Dumps covers the following Domains of the exam ISC SSCP:
- Security Administration and Operations hold 15% of the exam
- Understanding of Cryptography hold 10%
- In the SSCP exam, Application Security and Systems holds 15% of the syllabus
- Incident Response and Recovery 13%
NEW QUESTION 173
The control of communications test equipment should be clearly addressed by security policy for which of the following reasons?
- A. Test equipment must always be available for the maintenance personnel.
- B. Test equipment can be used to browse information passing on a network.
- C. Test equipment is easily damaged.
- D. Test equipment is difficult to replace if lost or stolen.
Answer: B
Explanation:
Test equipment must be secured. There are equipment and other tools that if
in the wrong hands could be used to "sniff" network traffic and also be used to commit
fraud. The storage and use of this equipment should be detailed in the security policy for
this reason.
The following answers are incorrect:
Test equipment is easily damaged. Is incorrect because it is not the best answer, and from
a security point of view not relevent.
Test equipment is difficult to replace if lost or stolen. Is incorrect because it is not the best
answer, and from a security point of view not relevent.
Test equipment must always be available for the maintenance personnel. Is incorrect
because it is not the best answer, and from a security point of view not relevent.
References:
OIG CBK Operations Security (pages 642 - 643)
NEW QUESTION 174
Which of the following would be used to detect and correct errors so that integrity and confidentiality of transactions over networks may be maintained while preventing unauthorize interception of the traffic?
- A. Client security
- B. Server security
- C. Communications security
- D. Information security
Answer: C
Explanation:
Explanation/Reference:
Communications security is the discipline of preventing unauthorized interceptors from accessing telecommunications in an intelligible form, while still delivering content to the intended recipients. In the United States Department of Defense culture, it is often referred to by the abbreviation COMSEC. The field includes cryptosecurity, transmission security, emission security, traffic-flow security and physical security of COMSEC equipment.
All of the other answers are incorrect answers:
Information security
Information security would be the overall program but communications security is the more specific and better answer. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction.
The terms information security, computer security and information assurance are frequently incorrectly used interchangeably. These fields are interrelated often and share the common goals of protecting the confidentiality, integrity and availability of information; however, there are some subtle differences between them.
These differences lie primarily in the approach to the subject, the methodologies used, and the areas of concentration. Information security is concerned with the confidentiality, integrity and availability of data regardless of the form the data may take: electronic, print, or other forms. Computer security can focus on ensuring the availability and correct operation of a computer system without concern for the information stored or processed by the computer.
Server security
While server security plays a part in the overall information security program, communications security is a better answer when talking about data over the network and preventing interception. See publication 800-
123 listed in the reference below to learn more.
Client security
While client security plays a part in the overall information security program, communications security is a better answer. Securing the client would not prevent interception of data or capture of data over the network. Today people referred to this as endpoint security.
References:
http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf
and
https://en.wikipedia.org/wiki/Information_security
and
https://en.wikipedia.org/wiki/Communications_security
NEW QUESTION 175
Access Control techniques do not include which of the following?
- A. Rule-Based Access Controls
- B. Mandatory Access Control
- C. Role-Based Access Control
- D. Random Number Based Access Control
Answer: D
Explanation:
Explanation/Reference:
Access Control Techniques
Discretionary Access Control
Mandatory Access Control
Lattice Based Access Control
Rule-Based Access Control
Role-Based Access Control
Source: DUPUIS, Clement, Access Control Systems and Methodology, Version 1, May 2002, CISSP Open Study Group Study Guide for Domain 1, Page 13.
NEW QUESTION 176
Which of the following Intrusion Detection Systems (IDS) uses a database of attacks, known system vulnerabilities, monitoring current attempts to exploit those vulnerabilities, and then triggers an alarm if an attempt is found?
- A. Application-Based ID System
- B. Network-Based ID System
- C. Host-Based ID System
- D. Knowledge-Based ID System
Answer: D
Explanation:
Explanation/Reference:
Knowledge-based Intrusion Detection Systems use a database of previous attacks and known system vulnerabilities to look for current attempts to exploit their vulnerabilities, and trigger an alarm if an attempt is found.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 87.
Application-Based ID System - "a subset of HIDS that analyze what's going on in an application using the transaction log files of the application." Source: Official ISC2 CISSP CBK Review Seminar Student Manual Version 7.0 p. 87
Host-Based ID System - "an implementation of IDS capabilities at the host level. Its most significant difference from NIDS is intrusion detection analysis, and related processes are limited to the boundaries of the host." Source: Official ISC2 Guide to the CISSP CBK - p. 197
Network-Based ID System - "a network device, or dedicated system attached to teh network, that monitors traffic traversing teh network segment for which it is integrated." Source: Official ISC2 Guide to the CISSP CBK - p. 196
NEW QUESTION 177
Packet Filtering Firewalls can also enable access for:
- A. only authorized application port or ex-service numbers.
- B. only unauthorized application port or service numbers.
- C. only authorized application port or service integers.
- D. only authorized application port or service numbers.
Answer: D
Explanation:
Firewall rules can be used to enable access for traffic to specific ports or services. "Service numbers" is rather stilted English but you may encounter these types of wordings on the actual exam -- don't let them confuse you.
"Only unauthorized application port or service numbers" is incorrect. Unauthorized ports/services would be blocked in a properly installed firewall rather than permitting access.
"Only authorized application port or ex-service numbers" is incorrect. "Ex-service" numbers is a nonsense term meant to distract you.
"Only authorized application port or service integers." While service numbers are in fact integers, the more usual (and therefore better) answer is either service or "service number."
References
CBK, p. 464 AIO3, pp. 482 - 484
NEW QUESTION 178
Which integrity model defines a constrained data item, an integrity verification procedure and a transformation procedure?
- A. The Bell-LaPadula integrity model
- B. The Clark Wilson integrity model
- C. The Take-Grant model
- D. The Biba integrity model
Answer: B
Explanation:
Explanation/Reference:
The Clark Wilson integrity model addresses the three following integrity goals: 1) data is protected from modification by unauthorized users; 2) data is protected from unauthorized modification by authorized users; and 3) data is internally and externally consistent. It also defines a Constrained Data Item (CDI), an Integrity Verification Procedure (IVP), a Transformation Procedure (TP) and an Unconstrained Data item.
The Bell-LaPadula and Take-Grant models are not integrity models.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architecture and Models (page 205).
NEW QUESTION 179
Which of the following test makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems?
- A. Recovery testing
- B. Security testing
- C. Interface testing
- D. Stress/volume testing
Answer: B
Explanation:
Explanation/Reference:
Security testing makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems.
Recovery testing checks the system's ability to recover after a software or hardware failure.
Stress/volume testing involves testing an application with large quantities of data in order to evaluate performance during peak hours.
Interface testing evaluates the connection of two or more components that pass information from one area to another.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 300).
NEW QUESTION 180
Which of the following results in the most devastating business interruptions?
- A. Loss of Data
- B. Loss of Communication Links
- C. Loss of Applications
- D. Loss of Hardware/Software
Answer: A
Explanation:
Source: Veritas eLearning CD - Introducing Disaster Recovery Planning,
Chapter 1.
All of the others can be replaced or repaired. Data that is lost and was not backed up,
cannot be restored.
NEW QUESTION 181
When a security violation occurs, what important information should be logged? (Choose all that apply)
- A. User's first and last name
- B. Timestamp
- C. All of the items listed
- D. Computer / Terminal ID
- E. User ID
Answer: B,D,E
NEW QUESTION 182
Which of the following is required in order to provide accountability?
- A. Audit trails
- B. Confidentiality
- C. Authentication
- D. Integrity
Answer: A
Explanation:
Accountability can actually be seen in two different ways:
1) Although audit trails are also needed for accountability, no user can be accountable for their actions unless properly authenticated.
2) Accountability is another facet of access control. Individuals on a system are responsible for their actions. This accountability property enables system activities to be traced to the proper individuals. Accountability is supported by audit trails that record events on the
system and network. Audit trails can be used for intrusion detection and for the
reconstruction of past events. Monitoring individual activities, such as keystroke monitoring,
should be accomplished in accordance with the company policy and appropriate laws.
Banners at the log-on time should notify the user of any monitoring that is being conducted.
The point is that unless you employ an appropriate auditing mechanism, you don't have
accountability. Authorization only gives a user certain permissions on the network.
Accountability is far more complex because it also includes intrusion detection,
unauthorized actions by both unauthorized users and authorized users, and system faults.
The audit trail provides the proof that unauthorized modifications by both authorized and
unauthorized users took place. No proof, No accountability.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, John Wiley & Sons, 2001, Page 50.
The Shon Harris AIO book, 4th Edition, on Page 243 also states:
Auditing Capabilities ensures users are accountable for their actions, verify that the secutiy
policies are enforced,
and can be used as investigation tools. Accountability is tracked by recording user, system,
and application activities.
This recording is done through auditing functions and mechanisms within an operating
sytem or application.
Audit trail contain information about operating System activities, application events, and
user actions.
NEW QUESTION 183
During the testing of the business continuity plan (BCP), which of the following methods of results analysis provides the BEST assurance that the plan is workable?
- A. Evaluation of the observed test results
- B. Measurement of accuracy
- C. Quantitatively measuring the results of the test
- D. Elapsed time for completion of critical tasks
Answer: C
Explanation:
It is important to have ways to measure the success of the plan and tests against the stated objectives. Therefore, results must be quantitatively gauged as opposed to an evaluation based only on observation. Quantitatively measuring the results of the test involves a generic statement measuring all the activities performed during BCP, which gives the best assurance of an effective plan. Although choices A and B are also quantitative, they relate to specific areas, or an analysis of results from one viewpoint, namely the accuracy of the results and the elapsed time. Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 5: Disaster Recovery and Business Continuity (page 269).
NEW QUESTION 184
The IP header contains a protocol field. If this field contains the value of 51, what type of data is contained within the ip datagram?
- A. Internet Control Message Protocol (ICMP)
- B. User datagram protocol (UDP)
- C. Transmission Control Protocol (TCP)
- D. Authentication Header (AH)
Answer: D
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
TCP has the value of 6
UDP has the value of 17
ICMP has the value of 1
Reference:
SANS http://www.sans.org/resources/tcpip.pdf?ref=3871
NEW QUESTION 185
Which of the following is a disadvantage of a statistical anomaly-based intrusion detection system?
- A. it may loosely detect a non-attack event that had caused a momentary anomaly in the system.
- B. it may falsely detect a non-attack event that had caused a momentary anomaly in the system.
- C. it may truly detect a non-attack event that had caused a momentary anomaly in the system.
- D. it may correctly detect a non-attack event that had caused a momentary anomaly in the system.
Answer: B
Explanation:
Some disadvantages of a statistical anomaly-based ID are that it will not detect an attack that does not significantly change the system operating characteristics, or it may falsely detect a non-attack event that had caused a momentary anomaly in the system.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 49.
NEW QUESTION 186
Which of the following is most appropriate to notify an internal user that session monitoring is being conducted?
- A. Wall poster
- B. Employee Handbook
- C. Written agreement
- D. Logon Banners
Answer: C
Explanation:
Section: Access Control
Explanation/Reference:
This is a tricky question, the keyword in the question is Internal users.
There are two possible answers based on how the question is presented, this question could either apply to internal users or ANY anonymous/external users.
Internal users should always have a written agreement first, then logon banners serve as a constant reminder.
Banners at the log-on time should be used to notify external users of any monitoring that is being conducted. A good banner will give you a better legal stand and also makes it obvious the user was warned about who should access the system, who is authorized and unauthorized, and if it is an unauthorized user then he is fully aware of trespassing. Anonymous/External users, such as those logging into a web site, ftp server or even a mail server; their only notification system is the use of a logon banner.
References used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 50.
and
Shon Harris, CISSP All-in-one, 5th edition, pg 873
NEW QUESTION 187
Which of the following can best be defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs?
- A. A known-plaintext attack
- B. A known-algorithm attack
- C. A chosen-ciphertext attack
- D. A chosen-plaintext attack
Answer: A
Explanation:
Section: Cryptography
Explanation/Reference:
RFC2828 (Internet Security Glossary) defines a known-plaintext attack as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs (although the analyst may also have other clues, such as the knowing the cryptographic algorithm). A chosen-ciphertext attack is defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of plaintext that corresponds to ciphertext selected (i.e., dictated) by the analyst. A chosen-plaintext attack is a cryptanalysis technique in which the analyst tries to determine the key from knowledge of ciphertext that corresponds to plaintext selected (i.e., dictated) by the analyst. The other choice is a distracter.
The following are incorrect answers:
A chosen-plaintext attacks
The attacker has the plaintext and ciphertext, but can choose the plaintext that gets encrypted to see the corresponding ciphertext. This gives her more power and possibly a deeper understanding of the way the encryption process works so she can gather more information about the key being used. Once the key is discovered, other messages encrypted with that key can be decrypted.
A chosen-ciphertext attack
In chosen-ciphertext attacks, the attacker can choose the ciphertext to be decrypted and has access to the resulting decrypted plaintext. Again, the goal is to figure out the key. This is a harder attack to carry out compared to the previously mentioned attacks, and the attacker may need to have control of the system that contains the cryptosystem.
A known-algorithm attack
Knowing the algorithm does not give you much advantage without knowing the key. This is a bogus detractor.
The algorithm should be public, which is the Kerckhoffs's Principle . The only secret should be the key.
Reference(s) used for this question:
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
and
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 866). McGraw-Hill. Kindle Edition.
and
Kerckhoffs's Principle
NEW QUESTION 188
What term describes the amount of risk that remains after the countermeasures have been deployed and the vulnerabilities classified?
- A. Residual risk
- B. Infinite risk
- C. Imminent risk
- D. Terminal risk
Answer: A
NEW QUESTION 189
......
Penetration testers simulate SSCP exam: https://www.realvce.com/SSCP_free-dumps.html
Free Test Engine For System Security Certified Practitioner (SSCP) Certification Exams: https://drive.google.com/open?id=13FRa0FQzcnOHknFbEra9wGICUTWi_EYd