Question 41 · 203 in bank
In the Open Systems Interconnect (OSI) Reference Model, at what level are TCP and UDP provided?
Show answer
Answer: A
ISC2 Systems Security Certified Practitioner203 questions across 21 pages are complete and free, with no account or card.
203 questions in this bank
Free access · progress saved on this device
In the Open Systems Interconnect (OSI) Reference Model, at what level are TCP and UDP provided?
Answer: A
What is the primary goal of setting up a honeypot?
Answer: D
A department manager has read access to the salaries of the employees in his/her department but not to the salaries of employees in other departments. A database security mechanism that enforces this policy would typically be said to provide which of the following?
Answer: A
A is the correct answer, because the question is asking about an action control mechanism (read, tool or method to execute a principal) NOT a principal or accepted ideology preference. In this case, "least privilege" could be argued for all these access controls, but A is the best fit answer to this scenario purely on how this is worded. Keep that in mind when taking the exam, good luck!
Source: Adapted from community discussion — Caoilfhion
FTP, TFTP, SNMP, and SMTP are provided at what level of the Open Systems Interconnect (OSI) Reference Model?
Answer: A
Which of the following is NOT a form of detective administrative control?
Answer: A
Detective administrative controls warn of administrative control violations. Rotation of duties, required vacations and security reviews and audits are forms of detective administrative controls. Separation of duties is the practice of dividing the steps in a system function among different individuals, so as to keep a single individual from subverting the process, thus a preventive control rather than a detective control. Source: DUPUIS, Cl?ment, Access Control Systems and Methodology CISSP Open Study Guide, version 1.0 (march 2002).
Which TCSEC level is labeled Controlled Access Protection?
Answer: D
C2 is labeled Controlled Access Protection. The TCSEC defines four divisions: D, C, B and A where division A has the highest security. Each division represents a significant difference in the trust an individual or organization can place on the evaluated system. Additionally divisions C, B and A are broken into a series of hierarchical subdivisions called classes: C1, C2, B1, B2, B3 and A1. Each division and class expands or modifies as indicated the requirements of the immediately prior division or class. D Minimal protection - Reserved for those systems that have been evaluated but that fail to meet the requirements for a higher division C Discretionary protection - C1 Discretionary Security Protection Identification and authentication Separation of users and data - Discretionary Access Control (DAC) capable of enforcing access limitations on an individual basis Required System Documentation and user manuals C2 Controlled Access Protection More finely grained DAC - Individual accountability through login procedures Audit trails - Object reuse - Resource isolation - B Mandatory protection - B1 Labeled Security Protection - Informal statement of the security policy model Data sensitivity labels - Mandatory Access Control (MAC) over selected subjects and objects Label exportation capabilities - All discovered flaws must be removed or otherwise mitigated Design specifications and verification B2 Structured Protection - Security policy model clearly defined and formally documented DAC and MAC enforcement extended to all subjects and objects Covert storage channels are analyzed for occurrence and bandwidth Carefully structured into protection-critical and non-protection-critical elements Design and implementation enable more comprehensive testing and review Authentication mechanisms are strengthened Trusted facility management is provided with administrator and operator segregation Strict configuration management controls are imposed B3 Security Domains - Satisfies reference monitor requirements Structured to exclude code not essential to security policy enforcement Significant system engineering directed toward minimizing complexity Security administrator role defined Audit security-relevant events - Automated imminent intrusion detection, notification, and response Trusted system recovery procedures Covert timing channels are analyzed for occurrence and bandwidth An example of such a system is the XTS-300, a precursor to the XTS-400 A Verified protection - A1 Verified Design - Functionally identical to B3 - Formal design and verification techniques including a formal top-level specification Formal management and distribution procedures An example of such a system is Honeywell's Secure Communications Processor SCOMP, a precursor to the XTS-400 Beyond A1 - System Architecture demonstrates that the requirements of self-protection and completeness for reference monitors have been implemented in the Trusted Computing Base (TCB). Security Testing automatically generates test-case from the formal top-level specification or formal lower-level specifications. Formal Specification and Verification is where the TCB is verified down to the source code level, using formal verification methods where feasible. Trusted Design Environment is where the TCB is designed in a trusted facility with only trusted (cleared) personnel. The following are incorrect answers: C1 is Discretionary security - C3 does not exists, it is only a detractor B1 is called Labeled Security Protection. Reference(s) used for this question: HARE, Chris, Security management Practices CISSP Open Study Guide, version 1.0, april 1999. and AIOv4 Security Architecture and Design (pages 357 - 361) AIOv5 Security Architecture and Design (pages 358 - 362)
What is the role of IKE within the IPsec protocol?
Answer: A
Which of the following would constitute the best example of a password to use for access to a system by a network administrator?
Answer: D
Entropy doesn't matter if a dictionary attack can scope out the password quickly from a list. It negates any measure of time needed to try and figure out a combination, thus making entropy a useless statistic in this case. Therefore, D is the applicable answer here. (Note: however, passphrase based passwords seek to reinstate that entropy while enabling it to be "human readable" and may not apply in the context of this scenario)
Source: Adapted from community discussion — Caoilfhion
In which phase of Internet Key Exchange (IKE) protocol is peer authentication performed?
Answer: B
Which of the following is the most reliable, secure means of removing data from magnetic storage media such as a magnetic tape, or a cassette?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SSCP practice, question 41. 203 questions available.
Version 1.0.0. How we source questions