[Free] New Updated (October) ISC SSCP Real Exam 251-260

Ensurepass

 

QUESTION 251

According to private sector data classification levels, how would salary levels and medical information be classified?

 

A.

Public.

B.

Internal Use Only.

C.

Restricted.

D.

Confidential.

 

Correct Answer: D

Explanation:

Typically there are three to four levels of information classification used by most organizations:

Confidential: Information that,
if released or disclosed outside of the organization, would create severe problems for the organization. For example, information that provides a competitive advantage is important to the technical or financial success (like trade secrets, intellectual property, or research designs), or protects the privacy of individuals would be considered confidential. Information may include payroll information, health records, credit information, formulas, technical designs, restricted regulatory information, senior management internal correspondence, or business strategies or plans. These may also be called top secret, privileged, personal, sensitive, or highly confidential. In other words this information is ok within a defined group in the company such as marketing or sales, but is not suited for release to anyone else in the company without permission.

 

The following answers are incorrect:

 

Public: Information that may be disclosed to the general public without concern for harming the company, employees, or business partners. No special protections are required, and information in this category is sometimes referred to as unclassified. For example, information that is posted to a company’s public Internet site, publicly released announcements, marketing materials, cafeteria menus, and any internal documents that would not present harm to the company if they were disclosed would be classified as public. While there is little concern for confidentiality, integrity and availability should be considered.

 

Internal Use Only: Information that could be disclosed within the company, but could harm the company if disclosed externally. Information such as customer lists, vendor pricing, organizational policies, standards and procedures, and internal organization announcements would need baseline security protections, but do not rise to the level of protection as confidential information. In other words, the information may be used freely within the company but any unapproved use outside the company can pose a chance of harm.

 

Restricted: Information that requires the utmost protection or, if discovered by unauthorized personnel, would cause irreparable harm to the organization would have the highest level of classification. There may be very few pieces of information like this within an organization, but data classified at this level requires all the access control and protection mechanisms available to the organization. Even when information classified at this level exists, there will be few copies of it

 

Reference(s) Used for this question:

Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 952-976). Auerbach Publications. Kindle Edition.

 

 

QUESTION 252

Which of the following phases of a software development life cycle normally addresses Due Care and Due Diligence?

 

A.

Implementation

B.

System feasibility

C.

Product design

D.

Software plans and requirements

 

Correct Answer: D

Explanation:

The software plans and requirements phase addresses threats, vulnerabilities, security requirements, reasonable care, due diligence, legal liabilities, cost/benefit analysis, level of protection desired, test plans.

 

Implementation is incorrect because it deals with Installing security software, running the system, acceptance testing, security software testing, and complete documentation certification and accreditation (where necessary).

 

System Feasibility is incorrect because it deals with information security policy, standards, legal issues, and the early validation of concepts.

 

Product design is incorrect because it deals with incorporating security specifications, adjusting test plans and data,

determining access controls, design documentation, evaluating encryption options, and verification.

 

Sources:

KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 7: Applications and Systems Development (page 252).

KRUTZ, Ronald & VINES, Russel, The CISSP Prep Guide: Gold Edition, Wiley Publishing Inc., 2003, Chapter 7: Security Life Cycle Components, Figure 7.5 (page 346).

 

 

QUESTION 253

Which of the following rules is least likely to support the concept of least privilege?

 

A.

The number of administrative accounts should be kept to a minimum.

B.

Administrators should use regular accounts when performing routine operations like reading mail.

C.

Permissions on tools that
are likely to be used by hackers should be as restrictive as possible.

D.

Only data to and from critical systems and applications should be allowed through the firewall.

 

Correct Answer: D

Explanation:

Only data to and from critical systems and applications should be allowed through the firewall is a detractor. Critical systems or applications do not necessarily need to have traffic go through a firewall. Even if they did, only the minimum required services should be allowed. Systems that are not deemed critical may also need to have traffic go through the firewall.

 

Least privilege is a basic tenet of computer security that means users should be given only those rights required to do their jobs or tasks. Least privilege is ensuring that you have the minimum privileges necessary to do a task. An admin NOT using his admin account to check email is a clear example of this.

 

Reference(s) used for this question:

National Security Agency, Systems and Network Attack Center (SNAC), The 60 Minute Network Security Guide, February 2002, page 9.

 

 

QUESTION 254

Which of the following is commonly used for retrofitting multilevel security to a database management system?

 

A.

trusted front-end.

B.

trusted back-end.

C.

controller.

D.

kernel.

 

Correct Answer: A

Explanation:

If you are “retrofitting” that means you are adding to an existing database management system (DBMS). You could go back and redesign the entire DBMS but the cost of that could be expensive and there is no telling what the effect will be on existing applications, but that is redesigning and the question states retrofitting. The most cost effective way with the least effect on existing applications while adding a layer of security on top is through a trusted front-end.

 

Clark-Wilson is a synonym of that model as well. It was used to add more granular control or control to database that did not provide appropriate controls or no controls at all. It is one of the most popular model today. Any dynamic website with a back-end database is an example of this today.

 

Such a model would also introduce separation of duties by allowing the subject only specific rights on the objects they need to access.

 

The following answers are incorrect:

 

trusted back-end. Is incorrect because a trusted back-end would be the database management system (DBMS). Since the question stated “retrofitting” that eliminates this answer.

controller. Is incorrect because this is a distractor and has nothing to do with “retrofitting”.

kernel. Is incorrect because this is a distractor and has nothing to do with “retrofitting”. A security kernel would provide protection to devices and processes but would be inefficient in protecting rows or columns in a table.

 

 

QUESTION 255

The preliminary steps to security planning include all of the following EXCEPT which of the following?

 

A.

Establish objectives.

B.

List planning assumptions.

C.

Establish a security audit function.

D.

Determine alternate courses of a
ction

 

Correct Answer: C

Explanation:

The keyword within the question is: preliminary

 

This means that you are starting your effort, you cannot audit if your infrastructure is not even in place.

 

Reference used for this question:

TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

 

 

QUESTION 256

What is defined as the hardware, firmware and software elements of a trusted computing base that implement the reference monitor concept?

 

A.

The reference monitor

B.

Protection rings

C.

A security kernel

D.

A protection domain

 

Correct Answer: C

Explanation:

A security kernel is defined as the hardware, firmware and software elements of a trusted computing base that implement the reference monitor concept. A reference monitor is a system component that enforces access controls on an object. A protection domain consists of the execution and memory space assigned to each process. The use of protection rings is a scheme that supports multiple protection domains.

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architecture and Models (page 194).

 

 

QUESTION 257

External consistency ensures that the data stored in the database is:

 

A.

in-consistent with the real world.

B.

remains consistant when sent from one system to another.

C.

consistent with the logical world.

D.

consistent with the real world.

 

Correct Answer: D

Explanation:

External consistency ensures that the data stored in the database is consistent with the real world.

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, page 33.

 

 

QUESTION 258

Which of the following does not address Database Management Systems (DBMS) Security?

 

A.

Perturbation

B.

Cell suppression

C.

Padded cells

D.

Partitioning

 

Correct Answer: C

Explanation:

Padded cells complement Intrusion Detection Systems (IDSs) and are not related to DBMS security. Padded cells are simulated environments to which IDSs seamlessly transfer detected attackers and are designed to convince an attacker that the attack is going according to the plan. Cell suppression is a technique used against inference attacks by not revealing information in the case where a statistical query produces a very small result set. Perturbation also addresses inference attacks but involves making minor modifications to the results to a query. Partitioning involves splitting a database into two or more physical or logical parts; especially relevant for multilevel secure databases.

Source: LaROSA, Jeanette (domain leader), Application and System Development Security CISSP Open Study Guide, version 3.0, January 2002.

 

 

 

 

QUESTION 259

Which of the following best describes the purpose of debugging programs?

 

A.

To generate random data that can be used to test programs before implementing them.

B.

To ensure that program coding flaws are detected and corrected.

C.

To protect, during the programming phase, valid changes from being overwritten by other changes.

D.

To compare source code versions before transferring to the test environment

 

Correct Answer: B

Explanation:

Debugging provides the basis for the programmer to correct the logic errors in a program under development before it goes into production.

Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 298).

 

 

QUESTION 260

The Orange Book states that “Hardware and software features shall be provided that can be used to periodically validate the correct operation of the on-site hardware and firmware elements of the TCB [Trusted Computing Base].” This statement is the formal requirement for:

 

A.

Security Testing.

B.

Design Verification.

C.

System Integrity.

D.

System Architecture Specification.

 

Correct Answer: C

Explanation:

This is a requirement starting as low as C1 within the TCSEC rating.

 

The Orange book requires the following for System Integrity Hardware and/or software features shall be provided that can be used to periodically validate the correct operation of the on-site hardware and firmware elements of the TCB.

 

NOTE FROM CLEMENT:

This is a question that confuses a lot of people because most people take for granted that the orange book with its associated Bell LaPadula model has nothing to do with integrity. However you have to be careful about the context in which the word integrity is being used. You can have Data Integrity and you can have System Integrity which are two completely different things.

 

Yes, the Orange Book does not specifically address the Integrity requirements, however it has to run on top of systems that must meet some integrity requirements.

 

This is part of what they call operational assurance which is defined as a level of confidence of a trusted system’s architecture and implementation that enforces the system’s security policy. It includes:

 

System architecture

Covert channel analysis

System integrity

Trusted recovery

 

DATA INTEGRITY

 

Data Integrity is very different from System Integrity. When you have integrity of the data, there are three goals:

 

1. Prevent authorized users from making unauthorized modifications

2. Preven unauthorized users from making modifications

3. Maintaining internal and external consistancy of the data

 

Bell LaPadula which is based on the Orange Book address does not a
ddress Integrity, it addresses only Confidentiality.

Biba address only the first goal of integrity.

Clark-Wilson addresses the three goals of integrity.

 

In the case of this question, there is a system integrity requirement within the TCB. As mentioned above here is an extract of the requirements: Hardware and/or software features shall be provided that can be used to periodically validate the correct operation of the on-site hardware and firmware elements of the TCB.

 

The following answers are incorrect:

 

Security Testing. Is incorrect because Security Testing has no set of requirements in the Orange book.

 

Design Verification. Is incorrect because the Orange book’s requirements for Design Verification include: A formal model of the security policy must be clearly identified and documented, including a mathematical proof that the model is consistent with its axioms and is sufficient to support the security policy.

 

System Architecture Specification. Is incorrect because there are no requirements for System Architecture Specification in the Orange book.

 

The following reference(s) were used for this question:

 

Trusted Computer Security Evaluation Criteria (TCSEC), DoD 5200.28-STD, page 15, 18, 25, 31, 40, 50.

Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition, Security Architecture and Design, Page 392-397, for users with the Kindle Version see Kindle Locations 28504-28505.

DOD TCSEC – http://www.cerberussystems.com/INFOSEC/stds/d520028.htm

Free VCE & PDF File for ISC SSCP Real Exam

Instant Access to Free VCE Files: ISC | ISC | SAP …
Instant Access to Free PDF Files: ISC | ISC | SAP …

This entry was posted in SSCP Real Exam (October) and tagged , , , , , , . Bookmark the permalink.