SSCP Dumps for Pass Guaranteed - Pass SSCP Exam 2022
SSCP Exam Dumps - Try Best SSCP Exam Questions from Training Expert PracticeDump
NEW QUESTION 183
Which of the following floors would be most appropriate to locate information processing facilities in a 6-stories building?
- A. Ground floor
- B. Third floor
- C. Basement
- D. Sixth floor
Answer: B
Explanation:
You data center should be located in the middle of the facility or the core of a building to provide protection from natural disasters or bombs and provide easier access to emergency crewmembers if necessary. By being at the core of the facility the external wall would act as a secondary layer of protection as well.
Information processing facilities should not be located on the top floors of buildings in case of a fire or flooding coming from the roof. Many crimes and theft have also been conducted by simply cutting a large hole on the roof.
They should not be in the basement because of flooding where water has a natural tendancy to flow down :-) Even a little amount of water would affect your operation considering the quantity of electrical cabling sitting directly on the cement floor under under your raise floor.
The data center should not be located on the first floor due to the presence of the main entrance where people are coming in and out. You have a lot of high traffic areas such as the elevators, the loading docks, cafeteria, coffee shopt, etc.. Really a bad location for a data center.
So it was easy to come up with the answer by using the process of elimination where the top, the bottom, and the basement are all bad choices. That left you with only one possible answer which is the third floor. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 5th Edition, Page
425.
NEW QUESTION 184
One of these statements about the key elements of a good configuration process is NOT true
- A. Accommodate the reuse of proven standards and best practices
- B. Control modifications to system hardware in order to prevent resource changes
- C. Ensure changes, standards, and requirements are communicated promptly and precisely
- D. Ensure that all requirements remain clear, concise, and valid
Answer: B
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Configuration management isn't about preventing change but ensuring the integrity of IT resources by preventing unauthorised or improper changes.
According to the Official ISC2 guide to the CISSP exam, a good CM process is one that can:
(1) accommodate change;
(2) accommodate the reuse of proven standards and best practices;
(3) ensure that all requirements remain clear, concise, and valid;
(4) ensure changes, standards, and requirements are communicated promptly and precisely; and (5) ensure that the results conform to each instance of the product.
Configuration management
Configuration management (CM) is the detailed recording and updating of information that describes an enterprise's computer systems and networks, including all hardware and software components. Such information typically includes the versions and updates that have been applied to installed software packages and the locations and network addresses of hardware devices. Special configuration management software is available. When a system needs a hardware or software upgrade, a computer technician can accesses the configuration management program and database to see what is currently installed. The technician can then make a more informed decision about the upgrade needed.
An advantage of a configuration management application is that the entire collection of systems can be reviewed to make sure any changes made to one system do not adversely affect any of the other systems Configuration management is also used in software development, where it is called Unified Configuration Management (UCM). Using UCM, developers can keep track of the source code, documentation, problems, changes requested, and changes made.
Change management
In a computer system environment, change management refers to a systematic approach to keeping track of the details of the system (for example, what operating system release is running on each computer and which fixes have been applied).
NEW QUESTION 185
Risk reduction in a system development life-cycle should be applied:
- A. Mostly to the disposal phase.
- B. Mostly to the development phase.
- C. Equally to all phases.
- D. Mostly to the initiation phase.
Answer: C
Explanation:
Explanation/Reference:
Risk is defined as the combination of the probability that a particular threat source will exploit, or trigger, a particular information system vulnerability and the resulting mission impact should this occur. Previously, risk avoidance was a common IT security goal. That changed as the nature of the risk became better understood. Today, it is recognized that elimination of all risk is not cost-effective. A cost-benefit analysis should be conducted for each proposed control. In some cases, the benefits of a more secure system may not justify the direct and indirect costs. Benefits include more than just prevention of monetary loss; for example, controls may be essential for maintaining public trust and confidence. Direct costs include the cost of purchasing and installing a given technology; indirect costs include decreased system performance and additional training. The goal is to enhance mission/business capabilities by managing mission/ business risk to an acceptable level.
Source: STONEBURNER, Gary & al, National Institute of Standards and Technology (NIST), NIST Special Publication 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), June 2001 (page 8).
NEW QUESTION 186
What level of assurance for a digital certificate verifies a user's name, address, social security number, and other information against a credit bureau database?
- A. Level 4/Class 4
- B. Level 1/Class 1
- C. Level 2/Class 2
- D. Level 3/Class 3
Answer: C
Explanation:
Users can obtain certificates with various levels of assurance. Here is a list that describe each of them:
-
Class 1/Level 1 for individuals, intended for email, no proof of identity For example, level 1 certificates verify electronic mail addresses. This is done through the use of a personal information number that a user would supply when asked to register. This level of certificate may also provide a name as well as an electronic mail address; however, it may or may not be a genuine name (i.e., it could be an alias). This proves that a human being will reply back if you send an email to that name or email address.
-
Class 2/Level 2 is for organizations and companies for which proof of identity is required Level 2 certificates verify a user's name, address, social security number, and other information against a credit bureau database.
-
Class 3/Level 3 is for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing certificate authority Level 3 certificates are available to companies. This level of certificate provides photo identification to accompany the other items of information provided by a level 2 certificate.
-
Class 4 for online business transactions between companies
-
Class 5 for private organizations or governmental security
References:
http://en.wikipedia.org/wiki/Digital_certificate veriSign introduced the concept of classes of
digital certificates:
Also see:
Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management
Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 3, Secured Connections to
External Networks (page 54).
NEW QUESTION 187
Which of the following was developed by the National Computer Security Center (NCSC) for the US Department of Defense ?
- A. ITSEC
- B. NIACAP
- C. DIACAP
- D. TCSEC
- E. Explanation:
The
Answer: D
Explanation:
; The TCSEC, frequently referred to as the Orange
Book, is the centerpiece of the DoD Rainbow Series publications.
Initially issued by the National Computer Security Center (NCSC) an arm of the National
Security Agency in 1983 and then updated in 1985, TCSEC was replaced with the
development of the Common Criteria international standard originally published in 2005.
References:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, pages 197-199.
Wikepedia
http://en.wikipedia.org/wiki/TCSEC
NEW QUESTION 188
Which approach to a security program ensures people responsible for protecting the company's assets are DRIVING the program?
- A. The top-down approach
- B. The technology approach
- C. The Delphi approach
- D. The bottom-up approach
Answer: A
Explanation:
Explanation/Reference:
A security program should use a top-down approach, meaning that the initiation, support, and direction come from top management; work their way through middle management; and then reach staff members.
In contrast, a bottom-up approach refers to a situation in which staff members (usually IT ) try to develop a security program without getting proper management support and direction. A bottom-up approach is commonly less effective, not broad enough to address all security risks, and doomed to fail.
A top-down approach makes sure the people actually responsible for protecting the company's assets (senior management) are driving the program.
The following are incorrect answers:
The Delphi approach is incorrect as this is for a brainstorming technique.
The bottom-up approach is also incorrect as this approach would be if the IT department tried to develop a security program without proper support from upper management.
The technology approach is also incorrect as it does not fit into the category of best answer.
Reference(s) used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 63). McGraw-Hill. Kindle Edition.
NEW QUESTION 189
A group of independent servers, which are managed as a single system, that provides higher availability, easier manageability, and greater scalability is:
- A. host cluster
- B. client cluster
- C. guest cluster
- D. server cluster
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
A server cluster is a group of independent servers, which are managed as a single system, that provides higher availability, easier manageability, and greater scalability.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 67.
NEW QUESTION 190
Which of the following packets should NOT be dropped at a firewall protecting an organization's internal network?
- A. Router information exchange protocols
- B. Outbound packets with an external destination IP address
- C. Inbound packets with an internal address as the source IP address
- D. Inbound packets with Source Routing option set
Answer: B
Explanation:
Normal outbound traffic has an internal source IP address and an external destination IP address.
Traffic with an internal source IP address should only come from an internal interface. Such packets coming from an external interface should be dropped.
Packets with the source-routing option enabled usually indicates a network intrusion attempt.
Router information exchange protocols like RIP and OSPF should be dropped to avoid having internal routing equipment being reconfigured by external agents.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 10: The Perfect Firewall.
NEW QUESTION 191
SMTP can best be described as:
- A. an email retrieval protocol.
- B. a standard defining the format of e-mail messages.
- C. a web-based e-mail reading protocol.
- D. a host-to-host email protocol.
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
Simple Mail Transfer Protocol (SMTP) is a host-to-host email protocol. An SMTP server accepts email messages from other systems and stores them for the addressees. Stored email can be read in various ways.
Users with interactive accounts on the email server machine can read the email using local email applications.
Users on other systems can download their email via email clients using POP or IMAP email retrieval protocols. Sometimes mail can also be read through a web-based interface (using HTTP or HTTPS). MIME is a standard defining the format of e-mail messages, as stated in RFC2045.
Source: GUTTMAN, Barbara & BAGWILL, Robert, NIST Special Publication 800-xx, Internet Security Policy: A Technical Guide, Draft Version, May 25, 2000 (pages 91-92).
NEW QUESTION 192
Which of the following statements pertaining to packet filtering is incorrect?
- A. It is based on ACLs.
- B. It operates at the network layer.
- C. It is not application dependant.
- D. It keeps track of the state of a connection.
Answer: D
Explanation:
Explanation/Reference:
Packet filtering is used in the first generation of firewalls and does not keep track of the state of a connection. Stateful packet filtering does.
Source: WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#2 Telecommunications and Network Security (page 6)
NEW QUESTION 193
Why would a memory dump be admissible as evidence in court?
- A. Because of the exclusionary rule.
- B. Because it is used to demonstrate the truth of the contents.
- C. Because the state of the memory cannot be used as evidence.
- D. Because it is used to identify the state of the system.
Answer: D
Explanation:
A memory dump can be admitted as evidence if it acts merely as a statement of fact. A system dump is not considered hearsay because it is used to identify the state of the system, not the truth of the contents. The exclusionary rule mentions that evidence must be gathered legally or it can't be used. This choice is a distracter.
Source: ANDRESS, Mandy, Exam Cram CISSP, Coriolis, 2001, Chapter 10: Law, Investigation, and Ethics (page 187).
NEW QUESTION 194
You are running a packet sniffer on a network and see a packet containing a long string of "0x90 0x90 0x90
0x90...." in the middle of it traveling to an x86-based machine as a target. This could be indicative of what activity being attempted?
- A. A source quench packet.
- B. A FIN scan.
- C. Over-subscription of the traffic on a backbone.
- D. A buffer overflow attack.
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
A series of the same control characters, hexadecimal code, imbedded in the string is usually an indicator of a buffer overflow attack.
The Intel x86 processors use the hexadecimal number 90 to represent NOP (no operation). Many buffer overflow attacks use long strings of control characters and this is representative of that type of attack.
A buffer overflow takes place when too much data are accepted as input to a specific process. A buffer is an allocated segment of memory. A buffer can be overflowed arbitrarily with too much data, but for it to be of any use to an attacker, the code inserted into the buffer must be of a specific length, followed up by commands the attacker wants executed. So, the purpose of a buffer overflow may be either to make a mess, by shoving arbitrary data into various memory segments, or to accomplish a specific task, by pushing into the memory segment a carefully crafted set of data that will accomplish a specific task. This task could be to open a command shell with administrative privilege or execute malicious code.
Common threats to system availability, integrity, and confidentiality include hardware failure, misuse of system privileges, buffer overflows and other memory attacks, denial of service, reverse engineering, and system hacking.
Since many vulnerabilities result from insecure design and most threats are well known, it is the responsibility of the security architect to ensure that their designs are addressing security requirements appropriately while also ensuring that the system can continue to perform its intended function.
The following answers are incorrect:
Over-subscription of the traffic on a backbone. Is incorrect because if there was Over-subscription of the traffic on a backbone, that would typically result in not being able to send or receive any packets, more commonly known as Denial of Service or DoS.
A source quench packet. This is incorrect because a source quench packet is an ICMP message that contains the internet header plus 64 bits of the original datagram.
A FIN scan. This is incorrect because a FIN scan is when a packet with the FIN flag set is sent to a specific port and the results are then analyzed.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition, Security Architecture and Design, Page
332, for people using the Kindle edition you will find it at Kindle Locations 7310-7315.
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Security Architecture and Design (Kindle Locations 1403-1407). . Kindle Edition.
Wikipedia http://en.wikipedia.org/wiki/Port_scanner
ICMP http://security.maruhn.com/iptables-tutorial/x1078.html
Wikipedia http://en.wikipedia.org/wiki/Buffer_overflow
NEW QUESTION 195
Which of the following computer design approaches is based on the fact that in earlier technologies, the instruction fetch was the longest part of the cycle?
- A. Scalar processors
- B. Complex Instruction Set Computers (CISC)
- C. Reduced Instruction Set Computers (RISC)
- D. Pipelining
Answer: B
Explanation:
Section: Security Operation Adimnistration
Explanation
Explanation/Reference:
Complex Instruction Set Computer (CISC) uses instructions that perform many operations per instruction. It was based on the fact that in earlier technologies, the instruction fetch was the longest part of the cycle.
Therefore, by packing more operations into an instruction, the number of fetches could be reduced. Pipelining involves overlapping the steps of different instructions to increase the performance in a computer. Reduced Instruction Set Computers (RISC) involve simpler instructions that require fewer clock cycles to execute. Scalar processors are processors that execute one instruction at a time.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 188).
NEW QUESTION 196
Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?
- A. Public Key Infrastructure (PKI)
- B. Symmetric Ciphers
- C. Single Sign-On (SSO)
- D. Smart cards
Answer: C
Explanation:
The advantages of SSO include having the ability to use stronger passwords,
easier administration as far as changing or deleting the passwords, minimize the risks of
orphan accounts, and requiring less time to access resources.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 39.
NEW QUESTION 197
Which of the following is most concerned with personnel security?
- A. Human resources controls
- B. Operational controls
- C. Technical controls
- D. Management controls
Answer: B
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Many important issues in computer security involve human users, designers, implementers, and managers.
A broad range of security issues relates to how these individuals interact with computers and the access and authorities they need to do their jobs. Since operational controls address security methods focusing on mechanisms primarily implemented and executed by people (as opposed to systems), personnel security is considered a form of operational control.
Operational controls are put in place to improve security of a particular system (or group of systems). They often require specialized expertise and often rely upon management activities as well as technical controls.
Implementing dual control and making sure that you have more than one person that can perform a task would fall into this category as well.
Management controls focus on the management of the IT security system and the management of risk for a system. They are techniques and concerns that are normally addressed by management.
Technical controls focus on security controls that the computer system executes. The controls can provide automated protection for unauthorized access of misuse, facilitate detection of security violations, and support security requirements for applications and data.
Reference use for this question:
NIST SP 800-53 Revision 4 http://dx.doi.org/10.6028/NIST.SP.800-53r4
You can get it as a word document by clicking HERE
NIST SP 800-53 Revision 4 has superseded the document below:
SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Page A-18).
NEW QUESTION 198
Which of the following best allows risk management results to be used knowledgeably?
- A. An uncertainty analysis
- B. A threat identification
- C. A likelihood assessment
- D. A vulnerability analysis
Answer: A
Explanation:
Explanation/Reference:
Risk management consists of two primary and one underlying activity; risk assessment and risk mitigation are the primary activities and uncertainty analysis is the underlying one. After having performed risk assessment and mitigation, an uncertainty analysis should be performed. Risk management must often rely on speculation, best guesses, incomplete data, and many unproven assumptions. A documented uncertainty analysis allows the risk management results to be used knowledgeably. A vulnerability analysis, likelihood assessment and threat identification are all parts of the collection and analysis of data part of the risk assessment, one of the primary activities of risk management.
Source: SWANSON, Marianne & GUTTMAN, Barbara, National Institute of Standards and Technology (NIST), NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, September 1996 (pages 19-21).
NEW QUESTION 199
What is the greatest danger from DHCP?
- A. Having the organization's mail server unreachable.
- B. Having multiple clients on the same LAN having the same IP address.
- C. An intruder on the network impersonating a DHCP server and thereby misconfiguring the DHCP clients.
- D. Having the wrong router used as the default gateway.
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
The greatest danger from BootP or DHCP (Dynamic Host Control Protocol) is from an intruder on the network impersonating a DHCP server and thereby misconfiguring the DHCP clients. Other choices are possible consequences of DHCP impersonation.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 4: Sockets and Services from a Security Viewpoint.
NEW QUESTION 200
Which protocol of the TCP/IP suite addresses reliable data transport?
- A. Internet protocol (IP)
- B. User datagram protocol (UDP)
- C. Internet control message protocol (ICMP)
- D. Transmission control protocol (TCP)
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
TCP provides a full-duplex, connection-oriented, reliable, virtual circuit. It handles the sequencing and retransmission of lost packets.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
85).
NEW QUESTION 201
The principle of least privilege is effective in helping prevent security breaches, however, prevention works best when applied with _______ and ______. Together, these three complete a security triad. (Choose two)
- A. Detection
- B. Attack
- C. Response
- D. Footprinting
- E. Scanning
Answer: A,C
Explanation:
Prevention, detection, and response form the basis of an effective security stance. Least privilege helps provides prevention. Detection is needed because program bugs or human errors have the potential to cause security breaches. Security policy must be monitored for violations to determine an adequate response.
NEW QUESTION 202
......
Advantage in the Career after to pass the Certification Exam
Having a System Security Certified Practitioner (SSCP) certification will certainly give you an advantage when hiring managers to look at your resume. If you have certification is a significant advantage in jobs competition as compared to those who do not have one. If you have the certificate then you can move up the corporate ladder or into a better, higher-paying job in your company. You can also join a unique group of certified and skilled professionals. There are many companies that support their employees in earning these certifications that may even lead to promotions and raises as well. Many companies have requirements by their professional recertify every two to three years.
Details of SSCP Certification Exam
The (ISC)2 SSCP designation is dedicated to IT managers, administrators, network security specialists, or directors who are responsible for the operational security in the company they are working for. Also, this certificate can be a great achievement for System Administrators, Security Analysts, Network Security Engineers, or System Engineers. Besides, the Security Specialists, System Analysts, Database, or Security Administrators will also find this certification helpful for their career path. The candidates who want to take the SSCP certification exam should demonstrate that they have at least one year of paid work experience in at least one of the domains tested in the final exam. Also, in case the candidates have a bachelor's or master’s degree in one cybersecurity program, then the prerequisite for one year of experience will be compensated. In case the candidates cannot demonstrate that they have one year of experience, then they can take the certification test and become an (ISC)2 Associate. Thus, they will have two years to earn the required one-year experience and be eligible for getting the designation. As for the SSCP certification exam, it has a duration of 3 hours and includes 125 questions. All of them are multiple-choice items. The candidates can pass it if they manage to obtain 700 points out of a maximum of 1000. Also, the official test is available in different languages. The exam-takers can choose between English, Brazilian, and Japanese languages. Another important aspect that the candidates should know is that this is a proctored exam. This means that they should enter on the Pearson VUE platform and follow the steps for registration. Once the enrollment process is complete, then examinees will have to choose an available testing center and start preparing for the test.
Latest 100% Passing Guarantee - Brilliant SSCP Exam Questions PDF: https://certkingdom.practicedump.com/SSCP-practice-dumps.html