[Free] New Updated (October) ISC SSCP Real Exam 341-350





Which of the following is not appropriate in addressing object reuse?



Degaussing magnetic tapes when they’re no longer needed.


Deleting files on disk before reusing the space.


Clearing memory blocks before they are allocated to a program or data.


Clearing buffered pages, documents, or screens from the local memory of a terminal or printer.


Correct Answer: B


Object reuse requirements, applying to systems rated TCSEC C2 and above, are used to protect files, memory, and other objects in a trusted system from being accidentally accessed by users who are not authorized to access them. Deleting files on disk merely erases file headers in a directory structure. It does not clear data from the disk surface, thus making files still recoverable. All other options involve clearing used space, preventing any unauthorized access.

Source: RUSSEL, Deborah & GANGEMI, G.T. Sr., Computer Security Basics, O’Reilly, July 1992 (page 119).




Which of the following refers to the data left on the media after the media has been erased?







sticky bits




Correct Answer:


Actually the term “remanence” comes from electromagnetism, the study of the electromagnetics. Originally referred to (and still does in that field of study) the magnetic flux that remains in a magnetic circuit after an applied magnetomotive force has been removed. Absolutely no way a candidate will see anywhere near that much detail on any similar CISSP question, but having read this, a candidate won’t be likely to forget it either.


It is becoming increasingly commonplace for people to buy used computer equipment, such as a hard drive, or router, and find information on the device left there by the previous owner; information they thought had been deleted. This is a classic example of data remanence: the remains of partial or even the entire data set of digital information. Normally, this refers to the data that remain on media after they are written over or degaussed. Data remanence is most common in storage systems but can also occur in memory.


Specialized hardware devices known as degaussers can be used to erase data saved to magnetic media. The measure of the amount of energy needed to reduce the magnetic field on the media to zero is known as coercivity.


It is important to make sure that the coercivity of the degausser is of sufficient strength to meet object reuse requirements when erasing data. If a degausser is used with insufficient coercivity, then a remanence of the data will exist. Remanence is the measure of the existing magnetic field on the media; it is the residue that remains after an object is degaussed or written over.

Data is still recoverable even when the remanence is small. While data remanence exists, there is no assurance of safe object reuse.


Reference(s) used for this question:


Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 4207-4210). Auerbach Publications. Kindle Edition.

Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 19694-19699). Auerbach Publications. Kindle Edition.




Which of the following embodies all the detailed actions that personnel are required to follow?











Correct Answer: C


Procedures are step-by-step instructions in support of of the policies, standards, guidelines and baselines. The procedure indicates how the policy will be implemented and who does what to accomplish the tasks.”


Standards is incorrect. Standards are a “Mandatory statement of minimum requirements that support some part of a policy, the standards in this case is your own company standards and not standards such as the ISO standards”


Guidelines is incorrect. “Guidelines are discretionary or optional controls used to enable individuals to make judgments with respect to security actions.”


Baselines is incorrect. Baselines “are a minimum acceptable level of security. This minimum is implemented using specific rules necessary to implement the security controls in support of the policy and standards.” For example, requiring a password of at leat 8 character would be an example. Requiring all users to have a minimun of an antivirus, a personal firewall, and an anti spyware tool could be another example.



CBK, pp. 12 – 16. Note especially the discussion of the “hammer policy” on pp. 16-17 for the differences between policy, standard, guideline and procedure.

AIO3, pp. 88-93.




Making sure that the data has not been changed unintentionally, due to an accident or malice is:











Correct Answer: A


Integrity refers to the protection of information from unauthorized modification or deletion.


Confidentiality is incorrect. Confidentiality refers to the protection of information from unauthorized disclosure.


Availability is incorrect. Availability refers to the assurance that information and services will be available to authorized users in accordance with the service level objective.


Auditability is incorrect. Auditability refers to the ability to trace an action to the identity that performed it and identify the date and time at which it occurred.



CBK, pp. 5 – 6

AIO3, pp. 56 – 57




What can be described as an imaginary line that separates the trusted components of the TCB from those elements that are NOT trusted?



The security kernel


The reference monitor


The security perimeter


The reference perimeter


Correct Answer: C


The security perimeter is the imaginary line that separates the trusted components of the kernel and the Trusted Computing Base (TCB) from those elements that are not trusted. The reference monitor is an abstract machine that mediates all accesses to objects by subjects. The security kernel can be software, firmware or hardware components in a trusted system and is the actual instantiation of the reference monitor. The reference perimeter is not defined and is a distracter.

Source: HARE, Chris, Security Architecture and Models, Area 6 CISSP Open Study Guide, January 2002.



TION 346

Which of the following are required for Life-Cycle Assurance?



System Architecture and Design specification.


Security Testing and Covert Channel Analysis.


Security Testing and Trusted distribution.


Configuration Management and Trusted Facility Management.


Correct Answer: C


Security testing and trusted distribution are required for Life-Cycle Assurance.


The following answers are incorrect:


System Architecture and Design specification. Is incorrect because System Architecture is not requried for Life-Cycle Assurance.

Security Testing and Covert Channel Analysis. Is incorrect because Covert Channel

Analysis is not requried for Life-Cycle Assurance.

Configuration Management and Trusted Facility Management. Is incorrect because Trusted Facility Management. is not requried for Life-Cycle Assurance.


Within the context of the CBK, which of the following provides a MINIMUM level of security ACCEPTABLE for an environment ?



A baseline


A standard


A procedure


A guideline


Correct Answer: A


Baselines provide the minimum level of security necessary throughout the organization.


Standards specify how hardware and software products should be used throughout the organization.


Procedures are detailed step-by-step instruction on how to achieve certain tasks.


Guidelines are recommendation actions and operational guides to personnel when a specific standard does not apply.


Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw- Hill/Osborne, 2002, chapter 3: Security Management Practices (page 94).




The property of a system or a system resource being accessible and usable upon demand by an authorized system entity, according to performance specifications for the system is referred to as?











Correct Answer: B


An company security program must:


1) assure that systems and applications operate effectively and provide appropriate confidentiality, integrity, and availability;


2) protect informationcommensurate with the level of risk and magnitude ofharmresulting fromloss, misuse, unauthorized access, or modification.


The property of a system or a system resource being accessible and usable upon demand by an authorized system entity, according to performance specifications for the system; i.e., a system is available if it provides services according to the system design whenever users request them.


The following are incorrect answers:


Confidentiality – The information requires protection from unauthorized disclosure and only the INTENDED recipient should have access to the meaning of the data either in storage or in transit.


Integrity – The information must be protected from unauthorized, unanticipated, or unintentional modification. This includes, but is not limited to:


Authenticity – A third party must be able to verify that the content of a message has not been changed in transit.


Non-repudiation – The origin or the receipt of a specific message must be verifiable by a third party.


Accountability – A security goal that generates the requirement for actions of an entity to be traced uniquely to that entity.


Reference used for this question:


RFC 2828

SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (page 5).




During which phase of an IT system life cycle are security requirements developed?







Functional design analysis and Planning




Correct Answer: C


The software development life cycle (SDLC) (sometimes referred to as the System Development Life Cycle) is the process of creating or altering software systems, and the models and methodologies that people use to develop these systems.


The NIST SP 800-64 revision 2 has within the description section of para 3.2.1:


This section addresses security considerations unique to the second SDLC phase. Key security activities for this phase include:


Conduct the risk assessment and use the results to supplement the baseline security controls;

Analyze security requirements;

Perform functional and security testing;

Prepare initial documents for system certification and accreditation; and ?Design security architecture.


Reviewing this publication you may want to pick development/acquisition. Although initiation would be a decent choice, it is correct to say during this phase you would only brainstorm the idea of security requirements. Once you start to develop and acquire hardware/software components then you would also develop the security controls for these. The Shon Harris reference below is correct as well.


Shon Harris’ Book (All-in-One CISSP Certification Exam Guide) divides the SDLC differently:


Project initiation

Functional design analysis and planning

System design specifications

Software development


Maintenance support

Revision and replacement


According to the author (Shon Harris), security requirements should be developed during the functional design analysis and planning phase.





SDLC Positioning in the enterprise

Information system security processes and activities provide valuable input into managing IT systems and their development, enabling risk identification, planning and mitigation. A risk management approach involves continually balancing the protection of agency information and assets with the cost of security controls and mitigation strategies throughout the complete information system development life cycle (see Figure 2-1 above). The most effective way to implement risk management is to identify critical assets and operations, as well as systemic vulnerabilities across the agency. Risks are shared and not bound by organ
ization, revenue source, or topologies. Identification and verification of critical assets and operations and their interconnections can be achieved through the system security planning process, as well as through the compilation of information from the Capital Planning and Investment Control (CPIC) and Enterprise Architecture (EA) processes to establish insight into the agency’s vital business operations, their supporting assets, and existing interdependencies and relationships.


With critical assets and operations identified, the organization can and should perform a business impact analysis (BIA). The purpose of the BIA is to relate systems and assets with the critical services they provide and assess the consequences of their disruption. By identifying these systems, an agency can manage security effectively by establishing priorities. This positions the security office to facilitate the IT program’s cost-effective performance as well as articulate its business impact and value to the agency.



SDLC Overview from NIST 800-64 Revision 2




NIST 800-64 Revision 2 is one publication within the NISTstandards that I would recommend you look at for more details about the SDLC. It describe in great details what activities would take place and they have a nice diagram for each of the phases of the SDLC. You will find a copy at:





Different sources present slightly different info as far as the phases names are concerned.


People sometimes gets confused with some of the NIST standards. For example NIST 800-64 Security Considerations in the Information System Development Life Cycle has slightly different names, the activities mostly remains the same.


NIST clearly specifies that Security requirements would be considered throughout ALL of the phases. The keyword here is considered, if a question is about which phase they would be developed than Functional Design Analysis would be the correct choice.


Within the NIST standard they use different phase, howeverr under the second phase you will see that they talk specifically about Security Functional requirements analysis which confirms it is not at the initiation stage so it become easier to come out with the answer to this question. Here is what is stated:


The security functional requirements analysis considers the system security environment, including the enterprise information security policy and the enterprise security architecture. The analysis should address all requirements for confidentiality, integrity, and availability of information, and should include a review of all legal, functional, and other security requirements contained in applicable laws, regulations, and guidance.


At the initiation step you would NOT have enough detailed yet to produce the Security Requirements. You are mostly brainstorming on all of the issues listed but you do not develop them all at that stage.


By considering security early in the information system development life cycle (SDLC), you may be able to avoid higher costs later on and develop a more secure system from the start.


NIST says:

NIST`s Information Technology Laboratory recently issued Special Publication (SP) 800- 64, Security Considerations in the Information System Development Life Cycle, by Tim Grance, Joan Hash, and Marc Stevens, to help organizations include security requirements in their planning for every phase of the system life cycle, and to select, acquire, and use appropriate and cost-effective security controls.


I must admit this is all very tricky but reading skills and paying attention to KEY WORDS is a must for this exam.



HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, Fifth Edition, Page 956

NIST S-64 Revision 2 at http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64- Revision2.pdf





Which of the following is an unintended communication path that is NOT protected by the system’s normal security mechanisms?



A trusted path


A protection domain


A covert channel


A maintenance hook


Correct Answer: C


A covert channel is an unintended communication path within a system, therefore it is not protected by the system’s normal security mechanisms. Covert channels are a secret way to convey information.


Covert channels are addressed from TCSEC level B2.


The following are incorrect answers:


A trusted path is the protected channel that allows a user to access the Trusted Computing Base (TCB) without being compromised by other processes or users.


A protection domain consists of the execution and memory space assigned to each process.


A maintenance hook is a hardware or software mechanism that was installed to permit system maintenance and to bypass the system’s security protections.


Reference used for this question:

KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 6: Operations Security (page 219).

Free VCE & PDF File for ISC SSCP Real Exam

Instant Access to Free VCE Files: ISC | ISC | SAP …
Instant Access to Free PDF Files: ISC | ISC | SAP …

This entry was posted in SSCP Real Exam (October) and tagged , , , , , , . Bookmark the permalink.