CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. ISC
  5. SSCP

Free SSCP Exam Braindumps (page: 89)

Page 88 of 269
PDF with 1074 Questions

Who is responsible for implementing user clearances in computer-based information systems at the B3 level of the TCSEC rating ?

  1. Security administrators
  2. Operators
  3. Data owners
  4. Data custodians

Answer(s): A

Explanation:

Security administrator functions include user-oriented activities such as setting user clearances, setting initial password, setting other security characteristics for new users or changing security profiles for existing users. Data owners have the ultimate responsibility for protecting data, thus determining proper user access rights to data.


Reference:

TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.



Buffer overflow and boundary condition errors are subsets of which of the following?

  1. Race condition errors.
  2. Access validation errors.
  3. Exceptional condition handling errors.
  4. Input validation errors.

Answer(s): D

Explanation:

In an input validation error, the input received by a system is not properly checked, resulting in a vulnerability that can be exploited by sending a certain input sequence. There are two important types of input validation errors: buffer overflows (input received is longer than expected input length) and boundary condition error (where an input received causes the system to exceed an assumed boundary). A race condition occurs when there is a delay between the time when a system checks to see if an operation is allowed by the security model and the time when the system actually performs the operation. In an access validation error, the system is vulnerable because the access control mechanism is faulty. In an exceptional condition handling error, the system somehow becomes vulnerable due to an exceptional condition that has arisen.


Reference:

DUPUIS, Clement, Access Control Systems and Methodology CISSP Open Study Guide,
version 1.0, march 2002 (page 105).



Ensuring least privilege does not require:

  1. Identifying what the user's job is.
  2. Ensuring that the user alone does not have sufficient rights to subvert an important process.
  3. Determining the minimum set of privileges required for a user to perform their duties.
  4. Restricting the user to required privileges and nothing more.

Answer(s): B

Explanation:

Ensuring that the user alone does not have sufficient rights to subvert an important process is a concern of the separation of duties principle and it does not concern the least privilege principle.


Reference:

DUPUIS, Clément, Access Control Systems and Methodology CISSP Open Study Guide, version 1.0, march 2002 (page 33).



Who is responsible for initiating corrective measures and capabilities used when there are security violations?

  1. Information systems auditor
  2. Security administrator
  3. Management
  4. Data owners

Answer(s): C

Explanation:

Management is responsible for protecting all assets that are directly or indirectly under their control.
They must ensure that employees understand their obligations to protect the company's assets, and implement security in accordance with the company policy. Finally, management is responsible for initiating corrective actions when there are security violations.


Reference:

HARE, Chris, Security management Practices CISSP Open Study Guide, version 1.0, april 1999.






Post your Comments and Discuss ISC SSCP exam with other Community members:

SSCP Exam Discussions & Posts