[2022] Valid SSCP test answers & ISC SSCP exam pdf
Verified SSCP dumps Q&As - Pass Guarantee or Full Refund
How much SSCP Exam Cost
The price of the exam is 250 USD.
Exam Difficulty
When preparing for the SSCP certification exam, the real world experience is required to stand a reasonable chance of passing the SSCP exam using SSCP dumps. ISC recommended study material does not replace the requirement for experience. So, It is very difficult for the candidate to pass the SSCP exam without experience.
NEW QUESTION 48
Which of the following prevents, detects, and corrects errors so that the integrity, availability, and confidentiality of transactions over networks may be maintained?
- A. Client security management and techniques
- B. Server security management and techniques
- C. Communications security management and techniques
- D. Information security management and techniques
Answer: C
Explanation:
Communications security and techniques are the best area for addressing this objective.
"Information security management and techniques" is incorrect. While the overall information security program would include this objective, communications security is the more specific and better answer.
"Client security management and techniques" is incorrect. While client security plays a part in this overall objective, communications security is the more specific and better answer.
"Server security management and techniques" is incorrect. While server security plays a part in this overall objective, communications security is the more specific and better answer.
References: CBK, p. 408
NEW QUESTION 49
The __________ is the most dangerous part of a virus program.
- A. Strain
- B. Trojan
- C. Payload
- D. None of the above
- E. Code
Answer: C
NEW QUESTION 50
As per the Orange Book, what are two types of system assurance?
- A. Design Assurance and Implementation Assurance.
- B. Architectural Assurance and Implementation Assurance.
- C. Operational Assurance and Life-Cycle Assurance.
- D. Operational Assurance and Architectural Assurance.
Answer: C
Explanation:
Are the two types of assurance mentioned in the Orange book.
The following answers are incorrect:
Operational Assurance and Architectural Assurance. Is incorrect because Architectural Assurance is not a type of assurance mentioned in the Orange book.
Design Assurance and Implementation Assurance. Is incorrect because neither are types of assurance mentioned in the Orange book.
Architectural Assurance and Implementation Assurance. Is incorrect because neither are types of assurance mentioned in the Orange book.
NEW QUESTION 51
An Architecture where there are more than two execution domains or privilege levels is called:
- A. Ring Architecture.
- B. Ring Layering
- C. Security Models
- D. Network Environment.
Answer: A
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
In computer science, hierarchical protection domains, often called protection rings, are a mechanism to protect data and functionality from faults (fault tolerance) and malicious behavior (computer security). This approach is diametrically opposite to that of capability-based security.
Computer operating systems provide different levels of access to resources. A protection ring is one of two or more hierarchical levels or layers of privilege within the architecture of a computer system. This is generally hardware-enforced by some CPU architectures that provide different CPU modes at the hardware or microcode level. Rings are arranged in a hierarchy from most privileged (most trusted, usually numbered zero) to least privileged (least trusted, usually with the highest ring number). On most operating systems, Ring 0 is the level with the most privileges and interacts most directly with the physical hardware such as the CPU and memory.
Special gates between rings are provided to allow an outer ring to access an inner ring's resources in a predefined manner, as opposed to allowing arbitrary usage. Correctly gating access between rings can improve security by preventing programs from one ring or privilege level from misusing resources intended for programs in another. For example, spyware running as a user program in Ring 3 should be prevented from turning on a web camera without informing the user, since hardware access should be a Ring 1 function reserved for device drivers. Programs such as web browsers running in higher numbered rings must request access to the network, a resource restricted to a lower numbered ring.
Ring Architecture
All of the other answers are incorrect because they are detractors.
References:
OIG CBK Security Architecture and Models (page 311)
and
https://en.wikipedia.org/wiki/Ring_%28computer_security%29
NEW QUESTION 52
What does the (star) property mean in the Bell-LaPadula model?
- A. No write up
- B. No write down
- C. No read up
- D. No read down
Answer: B
Explanation:
Explanation/Reference:
The (star) property of the Bell-LaPadula access control model states that writing of information by a subject at a higher level of sensitivity to an object at a lower level of sensitivity is not permitted (no write down).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 202).
Also check out: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 5: Security Models and Architecture (page 242, 243).
NEW QUESTION 53
Which of the following encryption methods is known to be unbreakable?
- A. One-time pads.
- B. DES codebooks.
- C. Elliptic Curve Cryptography.
- D. Symmetric ciphers.
Answer: A
Explanation:
Explanation/Reference:
A One-Time Pad uses a keystream string of bits that is generated completely at random that is used only once. Because it is used only once it is considered unbreakable.
The following answers are incorrect:
Symmetric ciphers. This is incorrect because a Symmetric Cipher is created by substitution and transposition. They can and have been broken
DES codebooks. This is incorrect because Data Encryption Standard (DES) has been broken, it was replaced by Advanced Encryption Standard (AES).
Elliptic Curve Cryptography. This is incorrect because Elliptic Curve Cryptography or ECC is typically used on wireless devices such as cellular phones that have small processors. Because of the lack of processing power the keys used at often small. The smaller the key, the easier it is considered to be breakable. Also, the technology has not been around long enough or tested thourough enough to be considered truly unbreakable.
NEW QUESTION 54
Which of the following exemplifies proper separation of duties?
- A. Operators are not permitted modify the system time.
- B. Programmers are permitted to use the system console.
- C. Console operators are permitted to mount tapes and disks.
- D. Tape operators are permitted to use the system console.
Answer: A
Explanation:
Section: Access Control
Explanation/Reference:
This is an example of Separation of Duties because operators are prevented from modifying the system time which could lead to fraud. Tasks of this nature should be performed by they system administrators.
AIO defines Separation of Duties as a security principle that splits up a critical task among two or more individuals to ensure that one person cannot complete a risky task by himself.
The following answers are incorrect:
Programmers are permitted to use the system console. Is incorrect because programmers should not be permitted to use the system console, this task should be performed by operators. Allowing programmers access to the system console could allow fraud to occur so this is not an example of Separation of Duties..
Console operators are permitted to mount tapes and disks. Is incorrect because operators should be able to mount tapes and disks so this is not an example of Separation of Duties.
Tape operators are permitted to use the system console. Is incorrect because operators should be able to use the system console so this is not an example of Separation of Duties.
References:
OIG CBK Access Control (page 98 - 101)
AIOv3 Access Control (page 182)
NEW QUESTION 55
What is the main characteristic of a bastion host?
- A. It is located on the internal network.
- B. It is a firewall.
- C. It does packet filtering.
- D. It is a hardened computer implementation
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
A bastion host is a special purpose computer on a network specifically designed and configured to withstand attack. The computer hosts a single application, for example a proxy server, and all other services are removed or limited to reduce the threat to the computer. It is hardened in this manner primarily due to its location and purpose, which is either on the outside of the firewall or in the DMZ and usually involves access from untrusted networks or computers.
References:
http://en.wikipedia.org/wiki/Bastion_host
NEW QUESTION 56
A business continuity plan is an example of which of the following?
- A. Compensating control
- B. Detective control
- C. Preventive control
- D. Corrective control
Answer: D
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
Business Continuity Plans are designed to minimize the damage done by the event, and facilitate rapid restoration of the organization to its full operational capacity. They are for use "after the fact", thus are examples of corrective controls.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 8: Business Continuity Planning and Disaster Recovery Planning (page 273).
and
Conrad, Eric; Misenar, Seth; Feldman, Joshua (2012-09-01). CISSP Study Guide (Kindle Location 8069).
Elsevier Science (reference). Kindle Edition.
and
NEW QUESTION 57
What is called an automated means of identifying or authenticating the identity of a living person based on physiological or behavioral characteristics?
- A. Macrometrics
- B. MicroBiometrics
- C. Micrometrics
- D. Biometrics
Answer: D
Explanation:
Biometrics; Biometrics are defined as an automated means of identifying or authenticating the identity of a living person based on physiological or behavioral characteristics. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Pages 37,38.
NEW QUESTION 58
One of the following statements about the differences between PPTP and L2TP is NOT true
- A. L2TP supports AAA servers
- B. PPTP is an encryption protocol and L2TP is not.
- C. L2TP works well with all firewalls and network devices that perform NAT.
- D. PPTP can run only on top of IP networks.
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
L2TP is affected by packet header modification and cannot cope with firewalls and network devices that perform NAT.
"PPTP can run only on top of IP networks." is correct as PPTP encapsulates datagrams into an IP packet, allowing PPTP to route many network protocols across an IP network.
"PPTP is an encryption protocol and L2TP is not." is correct. When using PPTP, the PPP payload is encrypted with Microsoft Point-to-Point Encryption (MPPE) using MSCHAP or EAP-TLS.
"L2TP supports AAA servers" is correct as L2TP supports TACACS+ and RADIUS.
NOTE:
L2TP does work over NAT. It is possible to use a tunneled mode that wraps every packet into a UDP packet.
Port 4500 is used for this purpose. However this is not true of PPTP and it is not true as well that it works well with all firewalls and NAT devices.
References:
All in One Third Edition page 545
Official Guide to the CISSP Exam page 124-126
NEW QUESTION 59
Within the context of the CBK, which of the following provides a MINIMUM level of security ACCEPTABLE for an environment ?
- A. A procedure
- B. A guideline
- C. A baseline
- D. A standard
Answer: C
Explanation:
Explanation/Reference:
Baselines provide the minimum level of security necessary throughout the organization.
Standards specify how hardware and software products should be used throughout the organization.
Procedures are detailed step-by-step instruction on how to achieve certain tasks.
Guidelines are recommendation actions and operational guides to personnel when a specific standard does not apply.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter
3: Security Management Practices (page 94).
NEW QUESTION 60
Which of the following phases of a software development life cycle normally addresses Due Care and Due Diligence?
- A. Implementation
- B. Software plans and requirements
- C. Product design
- D. System feasibility
Answer: B
Explanation:
The software plans and requirements phase addresses threats, vulnerabilities, security requirements, reasonable care, due diligence, legal liabilities, cost/benefit analysis, level of protection desired, test plans.
Implementation is incorrect because it deals with Installing security software, running the system, acceptance testing, security software testing, and complete documentation certification and accreditation (where necessary).
System Feasibility is incorrect because it deals with information security policy, standards, legal issues, and the early validation of concepts.
Product design is incorrect because it deals with incorporating security specifications,
adjusting test plans and data,
determining access controls, design documentation, evaluating encryption options, and
verification.
Sources:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 7: Applications and
Systems Development (page 252).
KRUTZ, Ronald & VINES, Russel, The CISSP Prep Guide: Gold Edition, Wiley Publishing
Inc., 2003, Chapter 7: Security Life Cycle Components, Figure 7.5 (page 346).
NEW QUESTION 61
Who first described the DoD multilevel military security policy in abstract, formal terms?
- A. Whitfield Diffie and Martin Hellman
- B. Rivest, Shamir and Adleman
- C. David Bell and Leonard LaPadula
- D. David Clark and David Wilson
Answer: C
Explanation:
Explanation/Reference:
It was David Bell and Leonard LaPadula who, in 1973, first described the DoD multilevel military security policy in abstract, formal terms. The Bell-LaPadula is a Mandatory Access Control (MAC) model concerned with confidentiality. Rivest, Shamir and Adleman (RSA) developed the RSA encryption algorithm. Whitfield Diffie and Martin Hellman published the Diffie-Hellman key agreement algorithm in 1976. David Clark and David Wilson developed the Clark-Wilson integrity model, more appropriate for security in commercial activities.
Source: RUSSEL, Deborah & GANGEMI, G.T. Sr., Computer Security Basics, O'Reilly, July 1992 (pages
78,109).
NEW QUESTION 62
In biometrics, "one-to-many" search against database of stored biometric images is done in:
- A. Identities
- B. Identity-based access control
- C. Authentication
- D. Identification
Answer: D
Explanation:
In biometrics, identification is a "one-to-many" search of an individual's
characteristics from a database of stored images.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 38.
NEW QUESTION 63
Which of the following questions are least likely to help in assessing controls covering audit trails?
- A. Are incidents monitored and tracked until resolved?
- B. Is access to online logs strictly controlled?
- C. Does the audit trail provide a trace of user actions?
- D. Is there separation of duties between security personnel who administer the access control function and those who administer the audit trail?
Answer: A
Explanation:
Section: Analysis and Monitoring
Explanation/Reference:
Audit trails maintain a record of system activity by system or application processes and by user activity. In conjunction with appropriate tools and procedures, audit trails can provide individual accountability, a means to reconstruct events, detect intrusions, and identify problems. Audit trail controls are considered technical controls. Monitoring and tracking of incidents is more an operational control related to incident response capability.
Reference(s) used for this question:
SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-50 to A-51).
NOTE: NIST SP 800-26 has been superceded By: FIPS 200, SP 800-53, SP 800-53A You can find the new replacement at: http://csrc.nist.gov/publications/PubsSPs.html However, if you really wish to see the old standard, it is listed as an archived document at:
http://csrc.nist.gov/publications/PubsSPArch.html
NEW QUESTION 64
Which of the following best defines source routing?
- A. The packets hold the forwarding information so they don't need to let bridges and routers decide what is the best route or way to get to the destination.
- B. The packets hold information about redundant paths in order to provide a higher reliability.
- C. The packets hold source information in a fashion that source address cannot be forged.
- D. The packets are encapsulated to conceal source information.
Answer: A
Explanation:
With source routing, the packets hold the forwarding information so that they can find their way to the destination themselves without bridges and routers dictating their paths.
In computer networking, source routing allows a sender of a packet to specify the route the packet takes through the network.
With source routing the entire path to the destination is known to the sender and is included when sending data. Source routing differs from most other routing in that the source makes most or all of the routing decisions for each router along the way.
Source:
WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#2 Telecommunications and Network Security (page 5)
Wikipedia at http://en.wikipedia.org/wiki/Dynamic_Source_Routing
NEW QUESTION 65
Cryptography does not concern itself with which of the following choices?
- A. Integrity
- B. Availability
- C. Confidentiality
- D. Validation
Answer: D
Explanation:
Section: Cryptography
Explanation/Reference:
The cryptography domain addresses the principles, means, and methods of disguising information to ensure its integrity, confidentiality, and authenticity. Unlike the other domains, cryptography does not completely support the standard of availability.
Availability
Cryptography supports all three of the core principles of information security. Many access control systems use cryptography to limit access to systems through the use of passwords. Many token-based authentication systems use cryptographic-based hash algorithms to compute one-time passwords. Denying unauthorized access prevents an attacker from entering and damaging the system or network, thereby denying access to authorized users if they damage or currupt the data.
Confidentiality
Cryptography provides confidentiality through altering or hiding a message so that ideally it cannot be understood by anyone except the intended recipient.
Integrity
Cryptographic tools provide integrity checks that allow a recipient to verify that a message has not been altered. Cryptographic tools cannot prevent a message from being altered, but they are effective to detect either intentional or accidental modification of the message.
Additional Features of Cryptographic Systems In addition to the three core principles of information security listed above, cryptographic tools provide several more benefits.
Nonrepudiation
In a trusted environment, the authentication of the origin can be provided through the simple control of the keys. The receiver has a level of assurance that the message was encrypted by the sender, and the sender has trust that the message was not altered once it was received. However, in a more stringent, less trustworthy environment, it may be necessary to provide assurance via a third party of who sent a message and that the message was indeed delivered to the right recipient. This is accomplished through the use of digital signatures and public key encryption. The use of these tools provides a level of nonrepudiation of origin that can be verified by a third party.
Once a message has been received, what is to prevent the recipient from changing the message and contesting that the altered message was the one sent by the sender? The nonrepudiation of delivery prevents a recipient from changing the message and falsely claiming that the message is in its original state. This is also accomplished through the use of public key cryptography and digital signatures and is verifiable by a trusted third party.
Authentication
Authentication is the ability to determine if someone or something is what it declares to be. This is primarily done through the control of the keys, because only those with access to the key are able to encrypt a message.
This is not as strong as the nonrepudiation of origin, which will be reviewed shortly Cryptographic functions use several methods to ensure that a message has not been changed or altered. These include hash functions, digital signatures, and message authentication codes (MACs). The main concept is that the recipient is able to detect any change that has been made to a message, whether accidentally or intentionally.
Access Control
Through the use of cryptographic tools, many forms of access control are supported-from log-ins via passwords and passphrases to the prevention of access to confidential files or messages. In all cases, access would only be possible for those individuals that had access to the correct cryptographic keys.
NOTE FROM CLEMENT:
As you have seen this question was very recently updated with the latest content of the Official ISC2 Guide (OIG) to the CISSP CBK, Version 3.
Myself, I agree with most of you that cryptography does not help on the availability side and it is even the contrary sometimes if you loose the key for example. In such case you would loose access to the data and negatively impact availability. But the ISC2 is not about what I think or what you think, they have their own view of the world where they claim and state clearly that cryptography does address availability even thou it does not fully address it.
They look at crypto as the ever emcompassing tool it has become today. Where it can be use for authentication purpose for example where it would help to avoid corruption of the data through illegal access by an unauthorized user.
The question is worded this way in purpose, it is VERY specific to the CISSP exam context where ISC2 preaches that cryptography address availability even thou they state it does not fully address it. This is something new in the last edition of their book and something you must be aware of.
Best regards
Clement
The following terms are from the Software Development Security domain:
Validation: The assurance that a product, service, or system meets the needs of the customer and other identified stakeholders. It often involves acceptance and suitability with external customers. Contrast with verification below." Verification: The evaluation of whether or not a product, service, or system complies with a regulation, requirement, specification, or imposed condition. It is often an internal process. Contrast with validation." The terms above are from the Software Development Security Domain.
Reference(s) used for this question:
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Cryptography (Kindle Locations 227-244). . Kindle Edition.
and
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Cryptography (Kindle Locations 206-227). . Kindle Edition.
and
http://en.wikipedia.org/wiki/Verification_and_validation
NEW QUESTION 66
What is a common problem when using vibration detection devices for perimeter control?
- A. They are vulnerable to non-adversarial disturbances.
- B. Signal amplitude is affected by weather conditions.
- C. They can be defeated by electronic means.
- D. They must be buried below the frost line.
Answer: A
Explanation:
Vibration sensors are similar and are also implemented to detect forced entry. Financial institutions may choose to implement these types of sensors on exterior walls, where bank robbers may attempt to drive a vehicle through. They are also commonly used around the ceiling and flooring of vaults to detect someone trying to make an unauthorized bank withdrawal.
Such sensors are proned to false positive. If there is a large truck with heavy equipment
driving by it may trigger the sensor. The same with a storm with thunder and lighting, it may
trigger the alarm even thou there are no adversarial threat or disturbance.
The following are incorrect answers:
All of the other choices are incorrect.
Reference used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (pp. 495-496).
McGraw-Hill . Kindle Edition.
NEW QUESTION 67
What is the main focus of the Bell-LaPadula security model?
- A. Integrity
- B. Confidentiality
- C. Availability
- D. Accountability
Answer: B
Explanation:
Section: Access Control
Explanation/Reference:
The Bell-LaPadula model is a formal model dealing with confidentiality.
The Bell-LaPadula Model (abbreviated BLP) is a state machine model used for enforcing access control in government and military applications. It was developed by David Elliott Bell and Leonard J. LaPadula, subsequent to strong guidance from Roger R. Schell to formalize the U.S. Department of Defense (DoD) multilevel security (MLS) policy. The model is a formal state transition model of computer security policy that describes a set of access control rules which use security labels on objects and clearances for subjects.
Security labels range from the most sensitive (e.g."Top Secret"), down to the least sensitive (e.g.,
"Unclassified" or "Public").
The Bell-LaPadula model focuses on data confidentiality and controlled access to classified information, in contrast to the Biba Integrity Model which describes rules for the protection of data integrity. In this formal model, the entities in an information system are divided into subjects and objects.
The notion of a "secure state" is defined, and it is proven that each state transition preserves security by moving from secure state to secure state, thereby inductively proving that the system satisfies the security objectives of the model. The Bell-LaPadula model is built on the concept of a state machine with a set of allowable states in a computer network system. The transition from one state to another state is defined by transition functions.
A system state is defined to be "secure" if the only permitted access modes of subjects to objects are in accordance with a security policy. To determine whether a specific access mode is allowed, the clearance of a subject is compared to the classification of the object (more precisely, to the combination of classification and set of compartments, making up the security level) to determine if the subject is authorized for the specific access mode.
The clearance/classification scheme is expressed in terms of a lattice. The model defines two mandatory access control (MAC) rules and one discretionary access control (DAC) rule with three security properties:
The Simple Security Property - a subject at a given security level may not read an object at a higher security level (no read-up).
The -property (read "star"-property) - a subject at a given security level must not write to any object at a lower security level (no write-down). The -property is also known as the Confinement property.
The Discretionary Security Property - use of an access matrix to specify the discretionary access control.
The following are incorrect answers:
Accountability is incorrect. Accountability requires that actions be traceable to the user that performed them and is not addressed by the Bell-LaPadula model.
Integrity is incorrect. Integrity is addressed in the Biba model rather than Bell-Lapadula.
Availability is incorrect. Availability is concerned with assuring that data/services are available to authorized users as specified in service level objectives and is not addressed by the Bell-Lapadula model.
References:
CBK, pp. 325-326
AIO3, pp. 279 - 284
AIOv4 Security Architecture and Design (pages 333 - 336)
AIOv5 Security Architecture and Design (pages 336 - 338)
Wikipedia at https://en.wikipedia.org/wiki/Bell-La_Padula_model
NEW QUESTION 68
Which of the following is NOT a property of the Rijndael block cipher algorithm?
- A. The key sizes must be a multiple of 32 bits
- B. Maximum block size is 256 bits
- C. Maximum key size is 512 bits
- D. The key size does not have to match the block size
Answer: C
Explanation:
The above statement is NOT true and thus the correct answer. The
maximum key size on Rijndael is 256 bits.
There are some differences between Rijndael and the official FIPS-197 specification for
AES.
Rijndael specification per se is specified with block and key sizes that must be a multiple of
32 bits, both with a minimum of 128 and a maximum of 256 bits. Namely, Rijndael allows
for both key and block sizes to be chosen independently from the set of { 128, 160, 192,
224, 256 } bits. (And the key size does not in fact have to match the block size).
However, FIPS-197 specifies that the block size must always be 128 bits in AES, and that
the key size may be either 128, 192, or 256 bits. Therefore AES-128, AES-192, and AES-
256 are actually: Key Size (bits) Block Size (bits) AES-128 128 128 AES-192 192 128 AES-256 256 128
So in short:
Rijndael and AES differ only in the range of supported values for the block length and cipher key length.
For Rijndael, the block length and the key length can be independently specified to any multiple of 32 bits, with a minimum of 128 bits, and a maximum of 256 bits.
AES fixes the block length to 128 bits, and supports key lengths of 128, 192 or 256 bits only.
References used for this question:
http://blogs.msdn.com/b/shawnfa/archive/2006/10/09/the-differences-between-rijndael-andaes.aspx and http://csrc.nist.gov/CryptoToolkit/aes/rijndael/Rijndael.pdf
NEW QUESTION 69
Which cable technology refers to the CAT3 and CAT5 categories?
- A. Coaxial cables
- B. Axial cables
- C. Fiber Optic cables
- D. Twisted Pair cables
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
Twisted Pair cables currently have two categories in common usage. CAT3 and CAT5.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 72.
NEW QUESTION 70
In addition to the accuracy of the biometric systems, there are other factors that must also be considered:
- A. These factors include the enrollment time and the throughput rate, but not acceptability.
- B. These factors include the enrollment time, but not the throughput rate, neither the acceptability.
- C. These factors do not include the enrollment time, the throughput rate, and acceptability.
- D. These factors include the enrollment time, the throughput rate, and acceptability.
Answer: D
Explanation:
Section: Access Control
Explanation/Reference:
In addition to the accuracy of the biometric systems, there are other factors that must also be considered.
These factors include the enrollment time, the throughput rate, and acceptability.
Enrollment time is the time it takes to initially "register" with a system by providing samples of the biometric characteristic to be evaluated. An acceptable enrollment time is around two minutes.
For example, in fingerprint systems, the actual fingerprint is stored and requires approximately 250kb per finger for a high quality image. This level of information is required for one-to-many searches in forensics applications on very large databases.
In finger-scan technology, a full fingerprint is not stored-the features extracted from this fingerprint are stored using a small template that requires approximately 500 to 1000 bytes of storage. The original fingerprint cannot be reconstructed from this template.
Updates of the enrollment information may be required because some biometric characteristics, such as voice and signature, may change with time.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 37 & 38.
NEW QUESTION 71
Which of the following is NOT a common backup method?
- A. Daily backup method
- B. Incremental backup method
- C. Differential backup method
- D. Full backup method
Answer: A
Explanation:
A daily backup is not a backup method, but defines periodicity at which backups are made. There can be daily full, incremental or differential backups. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 69).
NEW QUESTION 72
......
Certification Path
The System Security Certified Practitioner (SSCP) certification path includes only one SSCP certification exam.
SSCP Exam Questions – Valid SSCP Dumps Pdf: https://www.actual4dumps.com/SSCP-study-material.html
SSCP PDF Dumps Recently Updated Questions: https://drive.google.com/open?id=1zFWkmK8376Q1lvg1BoftSSdPIhX3VJr9