The IPSec protocol is configured in an organization's network in order to maintain a complete infrastructure for secured network communications. IPSec uses four components for this.Which of the following components reduces the size of data transmitted over congested network connections and increases the speed of such networks without losing data?
Answer(s): C
The IP Payload Compression (IPcomp) protocol is a low level compression protocol for IP datagrams defined in RFC 3173. The goal of IPcomp protocol is to reduce the size of data transmitted over congested or slow network connections, thereby increasing the speed of such networks without losing data. According to the RFC requirements, compression must be done before fragmenting or encrypting the packet. It further states that each datagram must be compressed independently; so it can be decompressed even if received out of order. This is important because it allows IPComp to work with both TCP and UDP network communications. Answer option A is incorrect. Authentication Header (AH) is an IPsec protocol. The AH provides connectionless integrity and data origin authentication of IP packets. It can also protect the IP packets against replay attacks by using the sliding window technique and discarding old packets. The AH protects the IP payload and all header fields of an IP datagram except for mutable fields.Answer option B is incorrect. Encapsulating Security Payload (ESP) is an IPSec protocol that provides confidentiality with authentication, integrity, and anti-replay. ESP can be used alone in combination with Authentication Header (AH).ESP can also be used nested with the LayerTwo Tunneling Protocol (L2TP). Normally, ESP does not sign the entire packet unless it is being tunneled. Typically, only the data payload is protected, not the IP header.Answer option D is incorrect. IKE (Internet Key Exchange) is the protocol used to set up a security association (SA) in the IPsec protocol suite.IKE uses a Diffie-Hellman key exchange to set up a shared session secret, from which cryptographic keys are derived. Public key techniques or alternatively pre-shared keys are used to mutually authenticate the communicating parties.
You work as a CSO (Chief Security Officer) for Tech Perfect Inc. You want to perform the following tasks:Develop a risk-driven enterprise information security architecture. Deliver security infrastructure solutions that support critical business initiatives.Which of the following methods will you use to accomplish these tasks?
Answer(s): B
SABSA (Sherwood Applied Business Security Architecture) is a framework and methodology for Enterprise Security Architecture and Service Management. SABSA is a model and a methodology for developing risk-driven enterprise information security architectures and for delivering security infrastructure solutions that support critical business initiatives. The primary characteristic of the SABSA model is that everything must be derived from an analysis of the business requirements for security, especially those in which security has an enabling function through which new business opportunities can be developed and exploited. Answer option C is incorrect. The service-oriented modeling framework (SOMF) is a service-oriented development life cycle methodology. It offers a number of modeling practices and disciplines that contribute to a successful service-oriented life cycle management and modeling. The service-oriented modeling framework illustrates the major elements that identify the "what to do" aspects of a service development scheme.Answer option D is incorrect. The service-oriented modeling and architecture (SOMA) includes an analysis and design method that extends traditional object-oriented and component-based analysis and design methods to include concerns relevant to and supporting SOA.Answer option A is incorrect. The service-oriented architecture (SOA) is a flexible set of design principles used during the phases of systems development and integration.
A network is configured on a Bus topology.Which of the following conditions could cause a network failure? Each correct answer represents a complete solution. Choose all that apply.
Answer(s): A,B,D
The following conditions could cause a network failure in a Bus topology:An open-ended cable without terminators75 ohm terminators at open endsA break in a network cableBus topology is a type of physical network design where all computers in the network are connected through a single coaxial cable known as bus. This topology uses minimum cabling and is therefore, the simplest and least expensive topology for small networks. In this topology, 50 ohm terminators terminate both ends of the network. A Bus topology network is difficult to troubleshoot, as a break or problem at any point along the cable can cause the entire network to go down.
Which of the following is an input device that is used for controlling machines such as cranes, trucks, underwater unmanned vehicles,wheelchairs, surveillance cameras, and zero turning radius lawn mowers?
A joystick is an input device consisting of a stick that pivots on a base and reports its angle or direction to the device it is controlling. Joysticks are often used to control video games, and usually have one or more push-buttons whose state can also be read by the computer. A popular variation of the joystick used on modern video game consoles is the analog stick.
Which of the following types of attacks is often performed by looking surreptitiously at the keyboard or monitor of an employee's computer?
The Shoulder surfing attack is often performed by looking surreptitiously at the keyboard or monitor of an employee's computer.Shoulder surfing is a type of in person attack in which an attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard or monitor screen of an employee's computer while he is typing in his password at any access point such as a terminal/Web site. An attacker can also gather information by looking at open documents on the employee's desk, posted notices on the notice boards, etc.Answer option B is incorrect. Man-in-the-middle attacks occur when an attacker successfully inserts an intermediary software or program between two communicating hosts. The intermediary software or program allows attackers to listen to and modify the communication packets passing between the two hosts. The software intercepts the communication packets and then sends the information to the receiving host.The receiving host responds to the software, presuming it to be the legitimate client. Answer option A is incorrect. A buffer-overflow attack is performed when a hacker fills a field, typically an address bar, with more characters than it can accommodate. The excess characters can be run as executable code, effectively giving the hacker control of the computer and overriding any security measures set.Answer option D is incorrect. A Denial-of-Service (DoS) attack is mounted with the objective of causing a negative impact on the performance of a computer or network. It is also known as network saturation attack or bandwidth consumption attack. Attackers make Denial-of-Service attacks by sending a large number of protocol packets to a network. A DoS attack can cause the following to occur:Saturate network resources.Disrupt connections between two computers, thereby preventing communications between services.Disrupt services to a specific computer.A SYN attack is a common DoS technique in which an attacker sends multiple SYN packets to a target computer. For each SYN packet received, the target computer allocates resources and sends an acknowledgement (SYN-ACK) to the source IP address. Since the target computer does not receive a response from the attacking computer, it attempts to resend the SYN-ACK. This leaves TCP ports in the half-open state.When an attacker sends TCP SYNs repeatedly before the half-open connections are timed out, the target computer eventually runs out of resources and is unable to handle any more connections, thereby denying service to legitimate users.
Post your Comments and Discuss ISC2 ISSAP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the ISSAP content, but please register or login to continue.