[Free] New Updated (October) ISC SSCP Real Exam 131-140

Ensurepass

 

QUESTION 131

A network-based vulnerability assessment is a type of test also referred to as:

 

A.

An active vulnerability assessment.

B.

A routing vulnerability assessment.

C.

A host-based vulnerability assessment.

D.

A passive vulnerability assessment.

 

Correct Answer: A

Explanation:

A network-based vulnerability assessment tool/system either re-enacts system attacks, noting and recording responses to the attacks, or probes different targets to infer weaknesses from their responses.

 

Since the assessment is actively attacking or scanning targeted systems, network-based vulnerability assessment systems are also called active vulnerability systems.

 

There are mostly two main types of test:

 

PASSIVE: You don’t send any packet or interact with the remote target. You make use of public database and other techniques to gather information about your target.

 

ACTIVE: You do send packets to your target, you attempt to stimulate response which will help you in gathering information about hosts that are alive, services runnings, port state, and more.

 

See example below of both types of attacks:

Eavesdropping and sniffing data as it passes over a network are considered passive attacks because the attacker is not affecting the protocol, algorithm, key, message, or any parts of the encryption system. Passive attacks are hard to detect, so in most cases methods are put in place to try to prevent them rather than to detect and stop them.

 

Altering messages , modifying system files, and masquerading as another individual are acts that are considered active attacks because the attacker is actually doing something instead of sitting back and gathering data. Passive attacks are usually used to gain information prior to carrying out an active attack.

 

IMPORTANT NOTE:

On the commercial vendors will sometimes use different names for different types of scans. However, the exam is product agnostic. They do not use vendor terms but general terms. Experience could trick you into selecting the wrong choice sometimes. See feedback from Jason below:

 

“I am a system security analyst. It is my daily duty to perform system vulnerability analysis. We use Nessus and Retina (among other tools) to perform our network based vulnerability scanning. Both commercially available tools refer to a network based vulnerability scan as a “credentialed” scan. Without credentials, the scan tool cannot login to the system being scanned, and as such will only receive a port scan to see what ports are open and exploitable”

 

Reference(s) used for this question:

 

Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 865). McGraw- Hill. Kindle Edition.

And DUPUIS, Clement, Access Control Systems and Methodology CISSP Open Study Guide, version 1.0, march 2002 (page 97).

 

 

QUESTION 132

Detective/Technical measures:

 

< /tr>

A.

include intrusion detection systems and automatically-generated violation reports from audit trail information.

B.

do not include intrusion detection systems and automatically-generated violation reports from audit trail information.

C.

include intrusion detection systems but do not include automatically-generated violation reports from audit trail information.

D.

include intrusion detection systems and customised-generated violation reports from audit trail information.

 

Correct Answer: A

Explanation:

Detective/Technical measures include intrusion detection systems and automatically-generated violation reports from audit trail information. These reports can indicate variations from “normal” operation or detect known signatures of unauthorized access episodes. In order to limit the amount of audit information flagged and reported by automated violation analysis and reporting mechanisms, clipping levels can be set.

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 35.

 

 

QUESTION 133

What is Kerberos?

 

A.

A three-headed dog from the egyptian mythology.

B.

A trusted third-party authentication protocol.

C.

A security model.

D.

A remote authentication dial in user server.

 

Correct Answer: B

Explanation:

Is correct because that is exactly what Kerberos is.

 

The following answers are incorrect:

 

A three-headed dog from Egyptian mythology. Is incorrect because we are dealing with Information Security and not the Egyptian mythology but the Greek Mythology.

A security model. Is incorrect because Kerberos is an authentication protocol and not just a security model.

A remote authentication dial in user server. Is incorrect because Kerberos is not a remote authentication dial in user server that would be called RADIUS.

 

 

QUESTION 134

Which of the following is NOT a system-sensing wireless proximity card?

 

A.

magnetically striped card

B.

passive device

C.

field-powered device

D.

transponder

 

Correct Answer: A

Explanation:

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, page 342.

 

 

QUESTION 135

Which of the following statements pertaining to the Bell-LaPadula is TRUE if you are NOT making use of the strong star property?

 

A.

It allows “read up.”

B.

It addresses covert channels.

C.

It addresses management of access controls.

D.

It allows “write up.”

 

Correct Answer: D

Explanation:

Bell-LaPadula Confidentiality Model10 The Bell-LaPadula model is perhaps the most well-known and significant security model, in addition to being one of the oldest models used in the creation of modern secure computing systems. Like the Trusted Computer System Evaluation Criteria (or TCSEC), it was inspired by early U.S. Department of Defense security policies and the need to prove that confidentiality could be maintained. In other words, its primary goal is to prevent disclosure as the model system moves from one state (one point in time) to another.

 

When the strong star property is not being used it means that both the property and the Simple Security Property rules would be applied.

 

The Star (*) property rule of the Bell-LaPadula model says that subjects cannot write down, this would compromise the confidentiality of the information if someone at the secret layer would write the object down to a confidential container for example.

 

The Simple Security Property rule states that the subject cannot read up which means that a subject at the secret layer would not be able to access objects at Top Secret for example.

 

You must remember: The model tells you about are NOT allowed to do. Anything else would be allowed. For example within the Bell LaPadula model you would be allowed to write up as it does not compromise the security of the information. In fact it would upgrade it to the point that you could lock yourself out of your own information if you have only a secret security clearance.

 

The following are incorrect answers because they are all FALSE:

 

“It allows read up” is incorrect. The “simple security” property forbids read up. “It addresses covert channels” is incorrect. Covert channels are not addressed by the Bell- LaPadula model.

“It addresses management of access controls” is incorrect. Management of access controls are beyond the scope of the Bell-LaPadula model.

 

Reference(s) used for this question:

Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 17595-17600). Auerbach Publications. Kindle Edition.

 

 

QUESTION 136

Examples of types of physical access controls include all EXCEPT which of the following?

 

A.

badges

B.

locks

C.

guards

D.

passwords

 

Correct Answer: D

Explanation:

Passwords are considered a Preventive/Technical (logical) control.

 

The following answers are incorrect:

 

badges Badges are a physical control used to identify an individual. A badge can include a smart device which can be used for authentication and thus a Technical control, but the actual badge itself is primarily a physical control.

 

locks Locks are a Preventative Physical control and has no Technical association. guards Guards are a Preventative Physical control and has no Technical association.

 

The following reference(s) were/was used to create this question:

 

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 35).

 

 

QUESTION 137

Which of the following is an example of discretionary access control?

 

A.

Identity-based access control

B.

Task-based access control

C.

Role-based access control

D.

Rule-based access control

 

Correct Answer: A

Explanation:

An identity-based access control is an example of discretionary access control that is based on an individual’s identity. Identity-based access control (IBAC) is access control based on the identity of the user (typically relayed as a characteristic of the process acting on behalf of that user) where access authorizations to specific objects are assigned based on user identity.

 

Rule Based Access Control (RuBAC) and Role Based Access Control (RBAC) are examples of non-discretionary access controls.

 

Rule-based access control is a type of non-discretionary access control because this access is determined by rules and the subject does not decide what those rules will be, the rules are uniformly applied to ALL of the users or subjects.

 

In general, all access control policies other than DAC are grouped in the category of non- discretionary access control (NDAC). As the name implies, policies in this category have rules that are not established at the discretion of the user. Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action.

 

Both Role Based Access Control (RBAC) and Rule Based Access Control (RuBAC) fall within Non Discretionary Access Control (NDAC). If it is not DAC or MAC then it is most likely NDAC.

 

BELOW YOU HAVE A DESCRIPTION OF THE DIFFERENT CATEGORIES:

 

MAC = Mandatory Access Control

 

Under a mandatory access control environment, the system or security administrator will define what permissions subjects have on objects. The administrator does not dictate user’s access but simply configure the proper level of access as dictated by the Data Owner.

 

The MAC system will look at the Security Clearance of the subject and compare it with the object sensitivity level or classification level. This is what is called the dominance relationship.

The subject must DOMINATE the object sensitivity level. Which means that the subject must have a security clearance equal or higher than the object he is attempting to access.

 

MAC also introduce the concept of labels. Every objects will have a label attached to them indicating the classification of the object as well as categories that are used to impose the need to know (NTK) principle. Even thou a user has a security clearance of Secret it does not mean he would be able to access any Secret documents within the system. He would be allowed to access only Secret document for which he has a Need To Know, formal approval, and object where the user belong to one of the categories attached to the object.

 

If there is no clearance and no labels then IT IS NOT Mandatory Access Control.

 

Many of the other models can mimic MAC but none of them have labels and a dominance relationship so they are NOT in the MAC category.

 

DAC = Discretionary Access Control

 

DAC is also known as: Identity Based access control system.

 

The owner of an object is define as the person who created the object. As such the owner has the discretion to grant access to other users on the network. Access will be granted based solely on the identity of those users.

 

Such system is good for low level of security. One of the major problem is the fact that a user who has access to someone’s else file can further share the file with other users without the knowledge or permission of the owner of the file. Very quickly this could become the wild wild west as there is no control on the dissimination of the information.

 

RBAC = Role Based Access Control

 

RBAC is a form of Non-Discretionary access control. Role Based access control usually maps directly with the different types of jobs performed by employees within a company.

 

For example there might be 5 security administrator within your company. Instead of creating each of their profile one by one, you would simply create a role and assign the administrators to the role. Once an administrator has been assigned to a role, he will IMPLICITLY inherit the permissions of that role.

 

RBAC is great tool for environment where there is a a large rotation of employees on a daily basis such as a very large help desk for example.

 

RBAC or RuBAC = Rule Based Access Control

 

RuBAC is a form of Non-Discretionary access control.

 

A good example of a Rule Based access control device would be a Firewall. A single set of rules is imposed to all users attempting to connect through the firewall.

 

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 33.

NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316.pdf and

http://itlaw.wikia.com/wiki/Identity-based_access_control

 

 

QUESTION 138

Which of the following Operation Security controls is intended to prevent unauthorized intruders from internally or externally accessing the system, and to lower the amount and impact of unintentional errors that are entering the system?

 

A.

Detective Controls

B.

Preventative Controls

C.

Corrective Controls

D.

Directive Controls

 

Correct Answer: B

Explanation:

In the Operations Security domain, Preventative Controls are designed to prevent unauthorized intruders from internally or externally accessing the system, and to lower the amount and impact of unintentional errors that are entering the system.

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 217.

 

 

 

QUESTION 139

A timely review of system access audit records would be an example of which of the basic security functions?

 

A.

avoidance.

B.

deterrence.

C.

prevention.

D.

detection.

 

Correct Answer: D

Explanation:

By reviewing system logs you can detect events that have occured.

 

The following answers are incorrect:

 

avoidance. This is incorrect, avoidance is a distractor. By reviewing system logs you have not avoided anything.

deterrence. This is incorrect because system logs are a history of past events. You cannot deter something that has already occurred.

prevention. This is incorrect because system logs are a history of past events. You cannot prevent something that has already occurred.

 

 

QUESTION 140

Guards are appropriate whenever the function required by the security program involves which of the following?

 

A.

The use of discriminating judgment

B.

The use of physical force

C.

The operation of access control devices

D.

The need to detect unauthorized access

 

Correct Answer: A

Explanation:

The Correct Answer: The use of discriminating judgment, a guard can make the determinations that hardware or other automated security devices cannot make due to its ability to adjust to rapidly changing conditions, to learn and alter recognizable patterns, and to respond to various conditions in the environment. Guards are better at making value decisions at times of incidents. They are appropriate whenever immediate, discriminating judgment is required by the security entity.

 

The following answers are incorrect:

 

The use of physical force This is not the best answer. A gua
rd provides discriminating judgment, and the ability to discern the need for physical force.

The operation of access control devices A guard is often uninvolved in the operations of an automated access control device such as a biometric reader, a smart lock, mantrap, etc. The need to detect unauthorized access The primary function of a guard is not to detect unauthorized access, but to prevent unauthorized physical access attempts and may deter social engineering attempts.

 

The following reference(s) were/was used to create this question:

 

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 10: Physical security (page 339).

Source: ISC2 Offical Guide to the CBK page 288-289.

Free VCE & PDF File for ISC SSCP Real Exam

Instant Access to Free VCE Files: ISC | ISC | SAP …
Instant Access to Free PDF Files: ISC | ISC | SAP …

This entry was posted in SSCP Real Exam (October) and tagged , , , , , , . Bookmark the permalink.