Free SSCP Exam Braindumps

- (Topic 4)
What is electronic vaulting?

1. A. Information is backed up to tape on a hourly basis and is stored in a on-site vault.
2. B. Information is backed up to tape on a daily basis and is stored in a on-site vault.
3. C. Transferring electronic journals or transaction logs to an off-site storage facility
4. D. A transfer of bulk information to a remote central backup facility.

Correct Answer: D
Electronic vaulting is defined as "a method of transferring bulk information to off-site facilities for backup purposes". Remote Journaling is the same concept as electronic vaulting, but has to do with journals and transaction logs, not the actual files. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw- Hill/Osborne, 2002, chapter 9: Disaster Recovery and Business continuity (page 619).

- (Topic 6)
Similar to Secure Shell (SSH-2), Secure Sockets Layer (SSL) uses symmetric encryption for encrypting the bulk of the data being sent over the session and it uses asymmetric or public key cryptography for:

1. A. Peer Authentication
2. B. Peer Identification
3. C. Server Authentication
4. D. Name Resolution

Correct Answer: A
SSL provides for Peer Authentication. Though peer authentication is possible, authentication of the client is seldom used in practice when connecting to public e-commerce web sites. Once authentication is complete, confidentiality is assured over the session by the use of symmetric encryption in the interests of better performance.
The following answers were all incorrect:
"Peer identification" is incorrect. The desired attribute is assurance of the identity of the communicating parties provided by authentication and NOT identification. Identification is only who you claim to be. Authentication is proving who you claim to be.
"Server authentication" is incorrect. While server authentication only is common practice, the protocol provides for peer authentication (i.e., authentication of both client and server). This answer was not complete.
"Name resolution" is incorrect. Name resolution is commonly provided by the Domain Name System (DNS) not SSL.
Reference(s) used for this question: CBK, pp. 496 - 497.

- (Topic 2)
In what way could Java applets pose a security threat?

1. A. Their transport can interrupt the secure distribution of World Wide Web pages over the Internet by removing SSL and S-HTTP
2. B. Java interpreters do not provide the ability to limit system access that an applet could have on a client system.
3. C. Executables from the Internet may attempt an intentional attack when they are downloaded on a client system.
4. D. Java does not check the bytecode at runtime or provide other safety mechanisms for program isolation from the client system.

Correct Answer: C
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

- (Topic 1)
Which of the following exemplifies proper separation of duties?

1. A. Operators are not permitted modify the system time.
2. B. Programmers are permitted to use the system console.
3. C. Console operators are permitted to mount tapes and disks.
4. D. Tape operators are permitted to use the system console.

Correct Answer: A
This is an example of Separation of Duties because operators are prevented from modifying the system time which could lead to fraud. Tasks of this nature should be performed by they system administrators.
AIO defines Separation of Duties as a security principle that splits up a critical task among two or more individuals to ensure that one person cannot complete a risky task by himself.
The following answers are incorrect:
Programmers are permitted to use the system console. Is incorrect because programmers should not be permitted to use the system console, this task should be performed by operators. Allowing programmers access to the system console could allow fraud to occur so this is not an example of Separation of Duties..
Console operators are permitted to mount tapes and disks. Is incorrect because operators should be able to mount tapes and disks so this is not an example of Separation of Duties.
Tape operators are permitted to use the system console. Is incorrect because operators should be able to use the system console so this is not an example of Separation of Duties.
References:
OIG CBK Access Control (page 98 - 101) AIOv3 Access Control (page 182)

- (Topic 6)
Which xDSL flavour delivers both downstream and upstream speeds of 1.544 Mbps over two copper twisted pairs?

1. A. HDSL
2. B. SDSL
3. C. ADSL
4. D. VDSL

Correct Answer: A
High-rate Digital Subscriber Line (HDSL) delivers 1.544 Mbps of bandwidth each way over two copper twisted pairs. SDSL also delivers 1.544 Mbps but over a single copper twisted pair. ADSL and VDSL offer a higher bandwidth downstream than upstream. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 115).