[Free] New Updated (October) ISC SSCP Real Exam 51-60

Ensurepass

 

QUESTION 51

Which is the last line of defense in a physical security sense?

 

A.

people

B.

interior barriers

C.

exterior barriers

D.

perimeter barriers

 

Correct Answer: A

Explanation:

“Ultimately, people are the last line of defense for your company’s assets” (Pastore & Dulaney, 2006, p. 529).

Pastore, M.and Dulaney, E.(2006). CompTIA Security+ study guide
: Exam SY0-101. Indianapolis, IN: Sybex.

 

 

QUESTION 52

Rule-Based Access Control (RuBAC) access is determined by rules. Such rules would fit within what category of access control ?

 

A.

Discretionary Access Control (DAC)

B.

Mandatory Access control (MAC)

C.

Non-Discretionary Access Control (NDAC)

D.

Lattice-based Access control

 

Correct Answer: C

Explanation:

Rule-based access control is a type of non-discretionary access control because this access is determined by rules and the subject does not decide what those rules will be, the rules are uniformly applied to ALL of the users or subjects.

 

In general, all access control policies other than DAC are grouped in the category of non- discretionary access control (NDAC). As the name implies, policies in this category have rules that are not established at the discretion of the user. Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action.

 

Both Role Based Access Control (RBAC) and Rule Based Access Control (RuBAC) fall within Non Discretionary Access Control (NDAC). If it is not DAC or MAC then it is most likely NDAC.

 

IT IS NOT ALWAYS BLACK OR WHITE

The different access control models are not totally exclusive of each others. MAC is making use of Rules to be implemented. However with MAC you have requirements above and beyond having simple access rules. The subject would get formal approval from management, the subject must have the proper security clearance, objects must have labels/sensitivity levels attached to them, subjects must have the proper security clearance.

If all of this is in place then you have MAC.

 

BELOW YOU HAVE A DESCRIPTION OF THE DIFFERENT CATEGORIES:

 

MAC = Mandatory Access Control

Under a mandatory access control environment, the system or security administrator will define what permissions subjects have on objects. The administrator does not dictate user’s access but simply configure the proper level of access as dictated by the Data Owner.

 

The MAC system will look at the Security Clearance of the subject and compare it with the object sensitivity level or classification level. This is what is called the dominance relationship.

 

The subject must DOMINATE the object sensitivity level. Which means that the subject must have a security clearance equal or higher than the object he is attempting to access.

 

MAC also introduce the concept of labels. Every objects will have a label attached to them indicatin
g the classification of the object as well as categories that are used to impose the need to know (NTK) principle. Even thou a user has a security clearance of Secret it does not mean he would be able to access any Secret documents within the system. He would be allowed to access only Secret document for which he has a Need To Know, formal approval, and object where the user belong to one of the categories attached to the object.

 

If there is no clearance and no labels then IT IS NOT Mandatory Access Control.

 

Many of the other models can mimic MAC but none of them have labels and a dominance relationship so they are NOT in the MAC category.

 

NISTR-7316 Says:

Usually a labeling mechanism and a set of interfaces are used to determine access based on the MAC policy; for example, a user who is running a process at the Secret classification should not be allowed to read a file with a label of Top Secret. This is known as the “simple security rule,” or “no read up.” Conversely, a user who is running a process with a label of Secret should not be allowed to write to a file with a label of Confidential. This rule is called the “*-property” (pronounced “star property”) or “no write down.” The *- property is required to maintain system security in an automated environment. A variation on this rule called the “strict *-property” requires that information can be written at, but not above, the subject’s clearance level. Multilevel security models such as the Bell-La Padula Confidentiality and Biba Integrity models are used to formally specify this kind of MAC policy.

 

DAC = Discretionary Access Control

 

DAC is also known as: Identity Based access control system. The owner of an object is define as the person who created the object. As such the owner has the discretion to grant access to other users on the network. Access will be granted based solely on the identity of those users.

 

Such system is good for low level of security. One of the major problem is the fact that a user who has access to someone’s else file can further share the file with other users without the knowledge or permission of the owner of the file. Very quickly this could become the wild wild west as there is no control on the dissimination of the information.

 

RBAC = Role Based Access Control

 

RBAC is a form of Non-Discretionary access control. Role Based access control usually maps directly with the different types of jobs performed by employees within a company.

 

For example there might be 5 security administrator within your company. Instead of creating each of their profile one by one, you would simply create a role and assign the administrators to the role. Once an administrator has been assigned to a role, he will IMPLICITLY inherit the permissions of that role.

 

RBAC is great tool for environment where there is a a large rotation of employees on a daily basis such as a very large help desk for example.

 

RBAC or RuBAC = Rule Based Access Control

RuBAC is a form of Non-Discretionary access control.

 

A good example of a Rule Based access control device would be a Firewall. A single set of rules is imposed to all users attempting to connect through the firewall.

 

NOTE FROM CLEMENT:

Lot of people tend to confuse MAC and Rule Based Access Control.

 

Mandatory Access Control must make use of LABELS. If there is only rules and no label, it cannot be Mandatory Access Control. This is why they call it Non Discretionary Access control (NDAC).

 

There are even books out there that are WRONG on this subject. Books are sometimes opiniated and not strictly based on facts.

 

In MAC subjects must have clearance to access sensitive objects. Objects have labels that contain the classification to indicate the sensitivity of the object and the label also has categories to enforce the need to know.

 

Today the best example of rule based access control would be a firewall. All rules are imposed globally to any user attempting to connect through the device. This is NOT the case with MAC.

 

I strongly recommend you read carefully the following document:

 

NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316.pdf

 

It is one of the best Access Control Study document to prepare for the exam. Usually I tell people not to worry about the hundreds of NIST documents and other reference. This document is an exception. Take some time to read it.

 

Reference(s) used for this question:

KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 33.

NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316.pdf and

Conrad, Eric; Misenar, Seth; Feldman, Joshua (2012-09-01). CISSP Study Guide (Kindle Locations 651-652). Elsevier Science (reference). Kindle Edition.

 

QUESTION 53

What is called a password that is the same for each log-on session?

 

A.

“one-time password”

B.

“two-time password”

< font style="font-size: 10pt" color="#000000">C.

static password

D.

dynamic password

 

Correct Answer: C

Explanation:

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 36.

 

 

QUESTION 54

An attack initiated by an entity that is authorized to access system resources but uses them in a way not approved by those who granted the authorization is known as a(n):

 

A.

active attack

B.

outside attack

C.

inside attack

D.

passive attack

 

Correct Answer: C

Explanation:

An inside attack is an attack initiated by an entity inside the security perimeter, an entity that is authorized to access system resources but uses them in a way not approved by those who granted the authorization whereas an outside attack is initiated from outside the perimeter, by an unauthorized or illegitimate user of the system. An active attack attempts to alter system resources to affect their operation and a passive attack attempts to learn or make use of the information from the system but does not affect system resources.

Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

 

 

QUESTION 55

What security model is dependent on security labels?

 

A.

Discretionary access control

B.

Label-based access control

C.

Mandatory access control

D.

Non-discretionary access control

 

Correct Answer: C

Explanation:

With mandatory access control (MAC), the authorization of a subject’s access to an object is dependant upon labels, which indicate the subject’s clearance, and the classification or sensitivity of the object. Label-based access control is not defined.

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 33).

 

 

 

 

QUESTION 56

Which of the following forms of authentication would most likely apply a digital signature algorithm to every bit of data that is sent from the claimant to the verifier?

 

A.< /font>

Dynamic authentication

B.

Continuous authentication

C.

Encrypted authentication

D.

Robust authentication

 

Correct Answer: B

Explanation:

Continuous authentication is a type of authentication that provides protection against impostors who can see, alter, and insert information passed between the claimant and verifier even after the claimant/verifier authentication is complete. These are typically referred to as active attacks, since they assume that the imposter can actively influence the connection between claimant and verifier. One way to provide this form of authentication is to apply a digital signature algorithm to every bit of data that is sent from the claimant to the verifier. There are other combinations of cryptography that can provide this form of authentication but current strategies rely on applying some type of cryptography to every bit of data sent. Otherwise, any unprotected bit would be suspect. Robust authentication relies on dynamic authentication data that changes with each authenticated session between a claimant and a verifier, but does not provide protection against active attacks. Encrypted authentication is a distracter.

Source: GUTTMAN, Barbara & BAGWILL, Robert, NIST Special Publication 800-xx, Internet Security Policy: A Technical Guide, Draft Version, May 25, 2000 (page 34).

 

 

QUESTION 57

Which of the following biometric devices has the lowest user acceptance level?

 

A.

Retina Scan

B.

Fingerprint scan

C.

Hand geometry

D.

Signature recognition

 

Correct Answer: A

Explanation:

According to the cited reference, of the given options, the Retina scan has the lowest user acceptance level as it is needed for the user to get his eye close to a device and it is not user friendly and very intrusive.

 

However, retina scan is the most precise with about one error per 10 millions usage.

 

Look at the 2 tables below. If necessary right click on the image and save it on your desktop for a larger view or visit the web site directly at https://sites.google.com/site/biometricsecuritysolutions/crossover-accuracy.

 

Biometric Comparison Chart

 

clip_image002

clip_image004

 

Biometric Aspect Descriptions

 

Reference(s) used for this question:

RHODES, Keith A., Chief Technologist, United States General Accounting Office, National Preparedness, Technologies to Secure Federal Buildings, April 2002 (page 10).

https://sites.google.com/site/biometricsecuritysolutions/crossover-accuracy

 

 

QUESTION 58

Which of the following is most relevant to determining the maximum effective cost of access control?

 

A.

the value of inf
ormation that is protected

B.

management’s perceptions regarding data importance

C.

budget planning related to base versus incremental spending.

D.

the cost to replace lost data

 

Correct Answer: A

Explanation:

The cost of access control must be commensurate with the value of the information that is being protected.

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 49.

 

QUESTION 59

An access system that grants users only those rights necessary for them to perform their work is operating on which security principle?

 

A.

Discretionary Access

B.

Least Privilege

C.

Mandatory Access

D.

Separation of Duties

 

Correct Answer: B

Explanation:

Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

 

 

QUESTION 60

Which type of password provides maximum security because a new password is required for each new log-on?

 

A.

One-time or dynamic password

B.

Congnitive password

C.

Static password

D.

Passphrase

 

Correct Answer: A

Explanation:

“one-time password” provides maximum security because a new password is required for each new log-on.

Source: KRUTZ, Ronald L.& VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 36.

Free VCE & PDF File for ISC SSCP Real Exam

Instant Access to Free VCE Files: ISC | ISC | SAP …
Instant Access to Free PDF Files: ISC | ISC | SAP …

This entry was posted in SSCP Real Exam (October) and tagged , , , , , , . Bookmark the permalink.