Systems Security Certified Practitioner – SSCP – Question0874

Which of the following are WELL KNOWN PORTS assigned by the IANA?

A.
Ports 0 to 255
B. Ports 0 to 1024
C. Ports 0 to 1023
D. Ports 0 to 127

Correct Answer: C

Explanation:

The port numbers are divided into three ranges: the Well Known Ports, the Registered Ports, and the Dynamic and/or Private Ports. The range for assigned “Well Known” ports managed by the IANA (Internet Assigned Numbers Authority) is 0-1023.
Source: iana.org: port assignments.

Systems Security Certified Practitioner – SSCP – Question0872

Which of the following methods of providing telecommunications continuity involves the use of an alternative media?

A.
Alternative routing
B. Diverse routing
C. Long haul network diversity
D. Last mile circuit protection

Correct Answer: A

Explanation:

Alternative routing is a method of routing information via an alternate medium such as copper cable or fiber optics. This involves use of different networks, circuits or end points should the normal network be unavailable. Diverse routing routes traffic through split cable facilities or duplicate cable facilities. This can be accomplished with different and/or duplicate cable sheaths. If different cable sheaths are used, the cable may be in the same conduit and therefore subject to the same interruptions as the cable it is backing up. The communication service subscriber can duplicate the facilities by having alternate routes, although the entrance to and from the customer premises may be in the same conduit. The subscriber can obtain diverse routing and alternate routing from the local carrier, including dual entrance facilities. This type of access is time-consuming and costly. Long haul network diversity is a diverse long-distance network utilizing T1 circuits among the major long-distance carriers. It ensures long-distance access should any one carrier experience a network failure. Last mile circuit protection is a redundant combination of local carrier T1s microwave and/or coaxial cable access to the local communications loop. This enables the facility to have access during a local carrier communication disaster. Alternate local carrier routing is also utilized. Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 5: Disaster Recovery and Business Continuity (page 259).

Systems Security Certified Practitioner – SSCP – Question0871

Which of the following is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length?

A.
Fiber Optic cable
B. Coaxial cable
C. Twisted Pair cable
D. Axial cable

Correct Answer: A

Explanation:

Fiber Optic cable is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length (up to two kilometers in some cases). Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 72.

Systems Security Certified Practitioner – SSCP – Question0870

If any server in the cluster crashes, processing continues transparently, however, the cluster suffers some performance degradation. This implementation is sometimes called a:

A.
server farm
B. client farm
C. cluster farm
D. host farm

Correct Answer: A

Explanation:

If any server in the cluster crashes, processing continues transparently, however, the cluster suffers some performance degradation. This implementation is sometimes called a “server farm.” Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 67.

Systems Security Certified Practitioner – SSCP – Question0869

A server cluster looks like a:

A.
single server from the user's point of view
B. dual server from the user's point of view
C. triple server from the user's point of view
D. quardle server from the user's point of view

Correct Answer: A

Explanation:

The cluster looks like a single server from the user’s point of view. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 67.

Systems Security Certified Practitioner – SSCP – Question0868

A group of independent servers, which are managed as a single system, that provides higher availability, easier manageability, and greater scalability is:

A.
server cluster
B. client cluster
C. guest cluster
D. host cluster

Correct Answer: A

Explanation:

A server cluster is a group of independent servers, which are managed as a single system, that provides higher availability, easier manageability, and greater scalability. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 67.

Systems Security Certified Practitioner – SSCP – Question0867

You have been tasked to develop an effective information classification program. Which one of the following steps should be performed first?

A.
Establish procedures for periodically reviewing the classification and ownership
B. Specify the security controls required for each classification level
C. Identify the data custodian who will be responsible for maintaining the security level of data
D. Specify the criteria that will determine how data is classified

Correct Answer: D

Explanation:

According to the AIO 3rd edition, these are the necessary steps for a proper classification program:
1. Define classification levels.
2. Specify the criteria that will determine how data is classified.
3. Have the data owner indicate the classification of the data she is responsible for.
4. Identify the data custodian who will be responsible for maintaining data and its security level.
5. Indicate the security controls, or protection mechanisms, that are required for each classification level.
6. Document any exceptions to the previous classification issues.
7. Indicate the methods that can be used to transfer custody of the information to a different data owner.
8. Create a procedure to periodically review the classification and ownership. Communicate any changes to the data custodian.
9. Indicate termination procedures for declassifying the data. 10. Integrate these issues into the security-awareness program so that all employees understand how to handle data at different classification levels.
Domain: Information security and risk management
Reference: AIO 3rd edition page 50

Systems Security Certified Practitioner – SSCP – Question0866

One of the following statements about the differences between PPTP and L2TP is NOT true

A.
PPTP can run only on top of IP networks.
B. PPTP is an encryption protocol and L2TP is not.
C. L2TP works well with all firewalls and network devices that perform NAT.
D. L2TP supports AAA servers

Correct Answer: C

Explanation:

L2TP is affected by packet header modification and cannot cope with firewalls and network devices that perform NAT.
“PPTP can run only on top of IP networks.” is correct as PPTP encapsulates datagrams into an IP packet, allowing PPTP to route many network protocols across an IP network.
“PPTP is an encryption protocol and L2TP is not.” is correct. When using PPTP, the PPP payload is encrypted with Microsoft Point-to-Point Encryption (MPPE) using MSCHAP or EAP-TLS.
“L2TP supports AAA servers” is correct as L2TP supports TACACS+ and RADIUS.
NOTE: L2TP does work over NAT. It is possible to use a tunneled mode that wraps every packet into a UDP packet. Port 4500 is used for this purpose. However this is not true of PPTP and it is not true as well that it works well with all firewalls and NAT devices.
References: All in One Third Edition page 545 Official Guide to the CISSP Exam page 124-126

Systems Security Certified Practitioner – SSCP – Question0865

Communications and network security relates to transmission of which of the following?

A.
voice
B. voice and multimedia
C. data and multimedia
D. voice, data and multimedia

Correct Answer: B

Explanation:

From the published (ISC)2 goals for the Certified Information Systems Security Professional candidate:
The CISSP candidate should be familiar to communications and network security as it relates to voice, data, multimedia, and facsimile transmissions in terms of local area, wide area, and remote access.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 57.