Current SSCP Exam Dumps [2023] Complete ISC Exam Smoothly
SSCP Premium PDF & Test Engine Files with 1074 Questions & Answers
How much is the cost of the ISC SSCP Exam
The ISC SSCP certification is one of the most widely recognized certifications in the penetration testing field. You can purchase its premium at a price of $249, which can be paid with a bank debit or credit card or via PayPal.
Here are the formats of the ISC SSCP certification exam:
SSCP includes seven Domains, In SSCP Dumps these are named as follows:
Domain 1. Access Controls
- Apply and maintain authentication methods
- Participate in the identity management lifecycle
- Encourage internetwork trust architectures
- Execute access controls
Domain 2. Security Administration and Operations
- Participate in security awareness and training
- Participate in asset management
- Comply with codes of ethics
- Participate in change management
Domain 3. Monitoring, Analysis, and Risk Identification
- Understand the risk management process
- Perform security assessment activities
- Operate and maintain monitoring systems (e.g., continuous monitoring)
- Analyze monitoring results
Domain 4. Incident Response and Recovery
- Support incident life cycle
- Understand and support Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) activities
- Understand and support forensic investigations
Domain 5. Cryptography
- Understand and support secure protocols
- Understand reasons and requirements for cryptography
- Understand Public Key Infrastructure (PKI) systems
- Know fundamental concepts of cryptography
Domain 6. Intimation and Network Security
- Operate and configure network-based security devices
- Operate and configure wireless technologies For example NFC, Wi-Fi, Bluetooth.
- Manage network access controls
Domain 7. System and Application Security
- Operate and secure virtual environments
- Execute and operate endpoint device security
- Operate and configure cloud security
- Identify and analyze evil code and activity
NEW QUESTION 390
In a stateful inspection firewall, data packets are captured by an inspection engine that is operating at the:
- A. Network or Transport Layer.
- B. Application Layer.
- C. Data Link Layer.
- D. Inspection Layer.
Answer: A
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
Most stateful packet inspection firewalls work at the network or transport layers. For the TCP/IP protcol, this allows the firewall to make decisions both on IP addresses, protocols and TCP/UDP port numbers Application layer is incorrect. This is too high in the OSI stack for this type of firewall.
Inspection layer is incorrect. There is no such layer in the OSI stack.
"Data link layer" is incorrect. This is too low in the OSI stack for this type of firewall.
References:
CBK, p. 466
AIO3, pp. 485 - 486
NEW QUESTION 391
Which auditing practice relates to the controlling of hardware, software, firmware, and documentation to insure it has not been improperly modified?
- A. System Control
- B. Consequence Assessment
- C. Configuration Control
- D. Certification / Accreditation
Answer: C
NEW QUESTION 392
One purpose of a security awareness program is to modify:
- A. corporate attitudes about safeguarding data
- B. attitudes of employees with sensitive data
- C. management's approach towards enterprise's security posture
- D. employee's attitudes and behaviors towards enterprise's security posture
Answer: D
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
The Answer: security awareness training is to modify employees behaviour and attitude towards towards enterprise's security posture.
Security-awareness training is performed to modify employees' behavior and attitude toward security. This can best be achieved through a formalized process of security-awareness training.
It is used to increase the overall awareness of security throughout the company. It is targeted to every single employee and not only to one group of users.
Unfortunately you cannot apply a patch to a human being, the only thing you can do is to educate employees and make them more aware of security issues and threats. Never underestimate human stupidity.
Reference(s) used for this question:
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
also see:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 130). McGraw-Hill. Kindle Edition.
NEW QUESTION 393
Which protocol is used to send email?
- A. Simple Mail Transfer Protocol (SMTP).
- B. Network File System (NFS).
- C. File Transfer Protocol (FTP).
- D. Post Office Protocol (POP).
Answer: A
Explanation:
Simple Mail Transfer Protocol (SMTP) is a protocol for sending e-mail messages between servers. POP is a protocol used to retrieve e-mail from a mail server. NFS is a TCP/IP client/server application developed by Sun that enables different types of file systems to interoperate regardless of operating system or network architecture. FTP is the protocol that is used to facilitate file transfer between two machines.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 88.
NEW QUESTION 394
Related to information security, the guarantee that the message sent is the message received with the assurance that the message was not intentionally or unintentionally altered is an example of which of the following?
- A. confidentiality
- B. availability
- C. integrity
- D. identity
Answer: C
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
Integrity is the guarantee that the message sent is the message received, and that the message was not intentionally or unintentionally altered.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 60.
NEW QUESTION 395
Which of the following tasks is NOT usually part of a Business Impact Analysis (BIA)?
- A. Develop a mission statement.
- B. Calculate how long these functions can survive without these resources.
- C. Calculate the risk for each different business function.
- D. Identify the company's critical business functions.
Answer: A
Explanation:
The Business Impact Analysis is critical for the development of a business
continuity plan (BCP). It identifies risks, critical processes and resources needed in case of
recovery and quantifies the impact a disaster will have upon the organization. The
development of a mission statement is normally performed before the BIA.
A BIA (business impact analysis ) is considered a functional analysis, in which a team
collects data through interviews and documentary sources; documents business functions,
activities, and transactions ; develops a hierarchy of business functions; and finally applies
a classification scheme to indicate each individual function's criticality level.
BIA Steps
The more detailed and granular steps of a BIA are outlined here:
1.Select individuals to interview for data gathering.
2.Create data-gathering techniques (surveys, questionnaires, qualitative and quantitative approaches).
3.Identify the company's critical business functions.
4.Identify the resources these functions depend upon.
5.Calculate how long these functions can survive without these resources.
6.Identify vulnerabilities and threats to these functions.
7.Calculate the risk for each different business function.
8.Document findings and report them to management.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Location 21076). Auerbach Publications. Kindle Edition.
and
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 905-910).
McGraw-Hill. Kindle Edition.
NEW QUESTION 396
What does the simple security (ss) property mean in the Bell-LaPadula model?
- A. No write up
- B. No write down
- C. No read down
- D. No read up
Answer: D
Explanation:
Explanation/Reference:
The ss (simple security) property of the Bell-LaPadula access control model states that reading of information by a subject at a lower sensitivity level from an object at a higher sensitivity level is not permitted (no read up).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 202).
NEW QUESTION 397
Which type of firewall can be used to track connectionless protocols such as UDP and RPC?
- A. Stateful inspection firewalls
- B. Circuit level firewalls
- C. Packet filtering firewalls
- D. Application level firewalls
Answer: A
Explanation:
Packets in a stateful inspection firewall are queued and then analyzed at all OSI layers, providing a more complete inspection of the data. By examining the state and context of the incoming data packets, it helps to track the protocols that are considered "connectionless", such as UDP-based applications and Remote Procedure Calls (RPC). Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 91).
NEW QUESTION 398
What is the greatest danger from DHCP?
- A. Having multiple clients on the same LAN having the same IP address.
- B. Having the organization's mail server unreachable.
- C. Having the wrong router used as the default gateway.
- D. An intruder on the network impersonating a DHCP server and thereby misconfiguring the DHCP clients.
Answer: D
Explanation:
The greatest danger from BootP or DHCP (Dynamic Host Control Protocol)
is from an intruder on the network impersonating a DHCP server and thereby
misconfiguring the DHCP clients. Other choices are possible consequences of DHCP
impersonation.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000,
Chapter 4: Sockets and Services from a Security Viewpoint.
NEW QUESTION 399
Which of the following could be BEST defined as the likelihood of a threat agent taking advantage of a vulnerability?
- A. A countermeasure
- B. A risk
- C. A residual risk
- D. An exposure
Answer: B
Explanation:
Explanation/Reference:
Risk is the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact. If a firewall has several ports open , there is a higher likelihood that an intruder will use one to access the network in an unauthorized method.
The following answers are incorrect :
Residual Risk is very different from the notion of total risk. Residual Risk would be the risks that still exists after countermeasures have been implemented. Total risk is the amount of risk a company faces if it chooses not to implement any type of safeguard.
Exposure: An exposure is an instance of being exposed to losses from a threat agent.
Countermeasure: A countermeasure or a safeguard is put in place to mitigate the potential risk. Examples of countermeasures include strong password management , a security guard.
REFERENCES : SHON HARRIS ALL IN ONE 3rd EDITION
Chapter - 3: Security Management Practices , Pages : 57-59
NEW QUESTION 400
You work in a police department forensics lab where you examine computers for evidence of crimes. Your work is vital to the success of the prosecution of criminals.
One day you receive a laptop and are part of a two man team responsible for examining it together.
However, it is lunch time and after receiving the laptop you leave it on your desk and you both head out to lunch.
What critical step in forensic evidence have you forgotten?
- A. Chain of custody
- B. Cracking the admin password with chntpw
- C. Locking the laptop in your desk
- D. Making a disk image for examination
Answer: A
Explanation:
Explanation/Reference:
When evidence from a crime is to be used in the prosecution of a criminal it is critical that you follow the law when handling that evidence. Part of that process is called chain of custody and is when you maintain proactive and documented control over ALL evidence involved in a crime.
Failure to do this can lead to the dismissal of charges against a criminal because if the evidence is compromised because you failed to maintain of chain of custody.
A chain of custody is chronological documentation for evidence in a particular case, and is especially important with electronic evidence due to the possibility of fraudulent data alteration, deletion, or creation.
A fully detailed chain of custody report is necessary to prove the physical custody of a piece of evidence and show all parties that had access to said evidence at any given time.
Evidence must be protected from the time it is collected until the time it is presented in court.
The following answers are incorrect:
- Locking the laptop in your desk: Even this wouldn't assure that the defense team would try to challenge chain of custody handling. It's usually easy to break into a desk drawer and evidence should be stored in approved safes or other storage facility.
- Making a disk image for examination: This is a key part of system forensics where we make a disk image of the evidence system and study that as opposed to studying the real disk drive. That could lead to loss of evidence. However if the original evidence is not secured than the chain of custoday has not been maintained properly.
- Cracking the admin password with chntpw: This isn't correct. Your first mistake was to compromise the chain of custody of the laptop. The chntpw program is a Linux utility to (re)set the password of any user that has a valid (local) account on a Windows system, by modifying the crypted password in the registry's SAM file. You do not need to know the old password to set a new one. It works offline which means you must have physical access (i.e., you have to shutdown your computer and boot off a linux floppy disk). The bootdisk includes stuff to access NTFS partitions and scripts to glue the whole thing together. This utility works with SYSKEY and includes the option to turn it off. A bootdisk image is provided on their website at
http://freecode.com/projects/chntpw .
The following reference(s) was used to create this question:
For more details and to cover 100% of the exam Qs, subscribe to our holistic Security+ 2014 CBT Tutorial at: http://www.cccure.tv/
and
http://en.wikipedia.org/wiki/Chain_of_custody
and
http://www.datarecovery.com/forensic_chain_of_custody.asp
NEW QUESTION 401
After a company is out of an emergency state, what should be moved back to the original site first?
- A. Executives
- B. IT support staff
- C. Least critical components
- D. Most critical components
Answer: C
Explanation:
Section: Risk, Response and Recovery
Explanation/Reference:
This will expose any weaknesses in the plan and ensure the primary site has been properly repaired before moving back. Moving critical assets first may induce a second disaster if the primary site has not been repaired properly.
The first group to go back would test items such as connectivity, HVAC, power, water, improper procedures, and/or steps that has been overlooked or not done properly. By moving these first, and fixing any problems identified, the critical operations of the company are not negatively affected.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 9:
Disaster Recovery and Business continuity (page 621).
NEW QUESTION 402
Similar to Secure Shell (SSH-2), Secure Sockets Layer (SSL) uses symmetric encryption for encrypting the bulk of the data being sent over the session and it uses asymmetric or public key cryptography for:
- A. Server Authentication
- B. Peer Authentication
- C. Peer Identification
- D. Name Resolution
Answer: B
Explanation:
Explanation/Reference:
SSL provides for Peer Authentication. Though peer authentication is possible, authentication of the client is seldom used in practice when connecting to public e-commerce web sites. Once authentication is complete, confidentiality is assured over the session by the use of symmetric encryption in the interests of better performance.
The following answers were all incorrect:
"Peer identification" is incorrect. The desired attribute is assurance of the identity of the communicating parties provided by authentication and NOT identification. Identification is only who you claim to be.
Authentication is proving who you claim to be.
"Server authentication" is incorrect. While server authentication only is common practice, the protocol provides for peer authentication (i.e., authentication of both client and server). This answer was not complete.
"Name resolution" is incorrect. Name resolution is commonly provided by the Domain Name System (DNS) not SSL.
Reference(s) used for this question:
CBK, pp. 496 - 497.
NEW QUESTION 403
Which of the following remote access authentication systems is the most robust?
- A. TACACS+
- B. RADIUS
- C. TACACS
- D. PAP
Answer: A
Explanation:
Explanation/Reference:
TACACS+ is a proprietary Cisco enhancement to TACACS and is more robust than RADIUS. PAP is not a remote access authentication system but a remote node security protocol.
Source: KRUTZ, Ronald L & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
122).
NEW QUESTION 404
This is a common security issue that is extremely hard to control in large environments. It occurs when a user has more computer rights, permissions, and access than what is required for the tasks the user needs to fulfill. What best describes this scenario?
- A. Excessive Access
- B. Excessive Rights
- C. Excessive Permissions
- D. Excessive Privileges
Answer: D
Explanation:
Even thou all 4 terms are very close to each other, the best choice is Excessive Privileges which would include the other three choices presented.
Reference(s) used for this question:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2001, Page 645. and
NEW QUESTION 405
Which of the following is NOT a technical control?
- A. Intrusion Detection Systems
- B. Password and resource management
- C. Identification and authentication methods
- D. Monitoring for physical intrusion
Answer: D
Explanation:
Section: Security Operation Adimnistration
Explanation/Reference:
It is considered to be a 'Physical Control'
There are three broad categories of access control: administrative, technical, and physical. Each category has different access control mechanisms that can be carried out manually or automatically. All of these access control mechanisms should work in concert with each other to protect an infrastructure and its data.
Each category of access control has several components that fall within it, a partial list is shown here. Not all controls fall into a single category, many of the controls will be in two or more categories. Below you have an example with backups where it is in all three categories:
Administrative Controls
Policy and procedures
- A backup policy would be in place
Personnel controls
Supervisory structure
Security-awareness training
Testing
Physical Controls
Network segregation
Perimeter security
Computer controls
Work area separation
Data backups (actual storage of the media, i:e Offsite Storage Facility) Cabling Technical Controls System access Network architecture Network access Encryption and protocols Control zone Auditing Backup (Actual software doing the backups) The following answers are incorrect :
Password and resource management is considered to be a logical or technical control.
Identification and authentication methods is considered to be a logical or technical control.
Intrusion Detection Systems is considered to be a logical or technical control.
Reference : Shon Harris , AIO v3 , Chapter - 4 : Access Control , Page : 180 - 185
NEW QUESTION 406
Which of the following division is defined in the TCSEC (Orange Book) as minimal protection?
- A. Division B
- B. Division C
- C. Division D
- D. Division A
Answer: C
Explanation:
The criteria are divided into four divisions: D, C, B, and A ordered in a hierarchical manner with the highest division (A) being reserved for systems providing the most comprehensive security.
Each division represents a major improvement in the overall confidence one can place in the system for the protection of sensitive information.
Within divisions C and B there are a number of subdivisions known as classes. The classes are also ordered in a hierarchical manner with systems representative of division C and lower classes of division B being characterized by the set of computer security mechanisms that they possess.
Assurance of correct and complete design and implementation for these systems is gained mostly through testing of the security- relevant portions of the system. The security-relevant portions of a system are referred to throughout this document as the Trusted Computing Base (TCB).
Systems representative of higher classes in division B and division A derive their security attributes more from their design and implementation structure. Increased assurance that the required features are operative, correct, and tamperproof under all circumstances is gained through progressively more rigorous analysis during the design process.
TCSEC provides a classification system that is divided into hierarchical divisions of assurance levels:
Division D - minimal security Division C - discretionary protection Division B - mandatory protection Division A - verified protection
Reference: page 358 AIO V.5 Shon Harris
also
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, page 197.
Also:
THE source for all TCSEC "level" questions: http://csrc.nist.gov/publications/secpubs/rainbow/std001.txt
NEW QUESTION 407
Which of the following server contingency solutions offers the highest availability?
- A. System backups
- B. Redundant arrays of independent disks (RAID)
- C. Load balancing/disk replication
- D. Electronic vaulting/remote journaling
Answer: C
Explanation:
Of the offered technologies, load balancing/disk replication offers the highest availability, measured in terms of minutes of lost data or server downtime. A Network-Attached Storage (NAS) or a Storage Area Network (SAN) solution combined with virtualization would offer an even higher availability.
Source: SWANSON, Marianne, & al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 49).
NEW QUESTION 408
Computer security should be first and foremost which of the following:
- A. Be proportionate to the value of IT systems.
- B. Cover all identified risks
- C. Be examined in both monetary and non-monetary terms.
- D. Be cost-effective.
Answer: D
Explanation:
Explanation/Reference:
Computer security should be first and foremost cost-effective.
As for any organization, there is a need to measure their cost-effectiveness, to justify budget usage and provide supportive arguments for their next budget claim. But organizations often have difficulties to accurately measure the effectiveness and the cost of their information security activities.
The classical financial approach for ROI calculation is not particularly appropriate for measuring security-related initiatives: Security is not generally an investment that results in a profit. Security is more about loss prevention. In other terms, when you invest in security, you don't expect benefits; you expect to reduce the risks threatening your assets.
The concept of the ROI calculation applies to every investment. Security is no exception. Executive decision-makers want to know the impact security is having on the bottom line. In order to know how much they should spend on security, they need to know how much is the lack of security costing to the business and what
are the most cost-effective solutions.
Applied to security, a Return On Security Investment (ROSI) calculation can provide quantitative answers to essential financial questions:
Is an organization paying too much for its security?
What financial impact on productivity could have lack of security?
When is the security investment enough?
Is this security product/organisation beneficial?
The following are other concerns about computer security but not the first and foremost:
The costs and benefits of security should be carefully examined in both monetary and non-monetary terms to ensure that the cost of controls does not exceed expected benefits.
Security should be appropriate and proportionate to the value of and degree of reliance on the IT systems and to the severity, probability, and extent of potential harm.
Requirements for security vary, depending upon the particular IT system. Therefore it does not make sense for computer security to cover all identified risks when the cost of the measures exceeds the value of the systems they are protecting.
Reference(s) used for this question:
SWANSON, Marianne & GUTTMAN, Barbara, National Institute of Standards and Technology (NIST), NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, September 1996 (page 6).
and
http://www.enisa.europa.eu/activities/cert/other-work/introduction-to-return-on-security-investment
NEW QUESTION 409
A business continuity plan is an example of which of the following?
- A. Corrective control
- B. Detective control
- C. Preventive control
- D. Compensating control
Answer: A
Explanation:
Business Continuity Plans are designed to minimize the damage done by the event, and facilitate rapid restoration of the organization to its full operational capacity. They are for use "after the fact", thus are examples of corrective controls.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 8: Business Continuity Planning and Disaster Recovery Planning (page 273). and Conrad, Eric; Misenar, Seth; Feldman, Joshua (2012-09-01). CISSP Study Guide (Kindle Location 8069). Elsevier Science (reference). Kindle Edition. and
NEW QUESTION 410
What is the name of the first mathematical model of a multi-level security policy used to define the concept of a secure state, the modes of access, and rules for granting access?
- A. Bell-LaPadula Model
- B. Harrison-Ruzzo-Ullman Model
- C. Clark and Wilson Model
- D. Rivest and Shamir Model
Answer: A
Explanation:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
NEW QUESTION 411
......
Overview to the pattern of the ISC SSCP Exam is as follow:
The SSCP exam is an exam that tests the skills of cyber security professionals. The exam is divided into three sections: theoretical, application, and laboratory. There are in total 15 different questions in the theoretical section which includes 10 multiple-choice questions in addition to 5 open-ended questions. For the application section, there are 12 multiple-choice questions with one practice question for each topic. Finally, for the laboratory section, there are 6 different lab simulations that carry almost 50% of the total time to be completed by an individual on this type of exam.
SSCP Premium Files Practice Valid Exam Dumps Question: https://www.exams-boost.com/SSCP-valid-materials.html
Get 100% Real SSCP Accurate & Verified Answers As Seen in the Real Exam!: https://drive.google.com/open?id=1PXrTHtKYrZUty3kfg8ImEG4yxrgw6FXW