Why is ITExamsLab the best choice for certification exam preparation?
ITExamsLab is dedicated to providing ISC2 SSCP practice test questions with answers, free of charge, unlike other web-based interfaces. To see the whole review material you really want to pursue a free record on itexamslab A great deal of clients all around the world are getting high grades by utilizing our SSCP dumps. You can get 100 percent passing and unconditional promise on SSCP test. PDF files are accessible immediately after purchase.
A Central Tool to Help You Prepare for ISC2 SSCP Exam
itexamslab.com is the last educational cost reason for taking the ISC2 SSCP test. We meticulously adhere to the exact audit test questions and answers, which are regularly updated and verified by experts. Our ISC2 SSCP exam dumps experts, who come from a variety of well-known administrations, are intelligent and qualified individuals who have looked over a very important section of ISC2 SSCP exam question and answer to help you understand the concept and pass the certification exam with good marks. ISC2 SSCP braindumps is the most effective way to set up your test in only 1 day.
User Friendly & Easily Accessible on Mobile Devices
Easy to Use and Accessible from Mobile Devices.There is a platform for the ISC2 SSCP exam that is very easy to use. The fundamental point of our foundation is to give most recent, exact, refreshed and truly supportive review material. Students can use this material to study and successfully navigate the implementation and support of ISC2 systems. Students can access authentic test questions and answers, which will be available for download in PDF format immediately after purchase. As long as your mobile device has an internet connection, you can study on this website, which is mobile-friendly for testers.
ISC2 SSCP Dumps Are Verified by Industry Experts
Get Access to the Most Recent and Accurate ISC2 SSCP Questions and Answers Right Away:
Our exam database is frequently updated throughout the year to include the most recent ISC2 SSCP exam questions and answers. Each test page will contain date at the highest point of the page including the refreshed rundown of test questions and replies. You will pass the test on your first attempt due to the authenticity of the current exam questions.
Dumps for the ISC2's SSCP exam have been checked by industry professionals who are dedicated for providing the right ISC2 SSCP test questions and answers with brief descriptions. Each Questions & Answers is checked through ISC2 experts. Highly qualified individuals with extensive professional experience in the vendor examination.
Itexamslab.com delivers the best ISC2 SSCP exam questions with detailed explanations in contrast with a number of other exam web portals.
Money Back Guarantee
itexamslab.com is committed to give quality ISC2 SSCP braindumps that will help you breezing through the test and getting affirmation. In order to provide you with the best method of preparation for the ISC2 SSCP exam, we provide the most recent and realistic test questions from current examinations. If you purchase the entire PDF file but failed the vendor exam, you can get your money back or get your exam replaced. Visit our guarantee page for more information on our straightforward money-back guarantee.
ISC2 SSCP Sample Questions
Question # 1
Which of the following statements is most accurate regarding a digital signature?
A. It is a method used to encrypt confidential data. B. It is the art of transferring handwritten signature to electronic media. C. It allows the recipient of data to prove the source and integrity of data. D. It can be used as a signature system and a cryptosystem.
Answer: C
Explanation:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
Question # 2
Which of the following standards concerns digital certificates?
A. X.400 B. X.25 C. X.509 D. X.75
Answer: C
Explanation:
X.509 is used in digital certificates. X.400 is used in e-mail as a message handling protocol. X.25
is a standard for the network and data link levels of a communication network and X.75 is a
standard defining ways of connecting two X.25 networks.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 164).
Question # 3
Which of the following offers confidentiality to an e-mail message?
A. The sender encrypting it with its private key. B. The sender encrypting it with its public key. C. The sender encrypting it with the receiver's public key. D. The sender encrypting it with the receiver's private key.
Answer: C
Explanation:
An e-mail message's confidentiality is protected when encrypted with the receiver's public key,
because he is the only one able to decrypt the message. The sender is not supposed to have the
receiver's private key. By encrypting a message with its private key, anybody possessing the
corresponding public key would be able to read the message. By encrypting the message with its
public key, not even the receiver would be able to read the message.
Which of the following is NOT a property of the Rijndael block cipher algorithm?
A. The key sizes must be a multiple of 32 bits B. Maximum block size is 256 bits C. Maximum key size is 512 bits D. The key size does not have to match the block size
Answer: C
Explanation:
The above statement is NOT true and thus the correct answer. The maximum key size on Rijndael
is 256 bits.
There are some differences between Rijndael and the official FIPS-197 specification for AES.
Rijndael specification per se is specified with block and key sizes that must be a multiple of 32
bits, both with a minimum of 128 and a maximum of 256 bits. Namely, Rijndael allows for both key
and block sizes to be chosen independently from the set of { 128, 160, 192, 224, 256 } bits. (And
the key size does not in fact have to match the block size).
However, FIPS-197 specifies that the block size must always be 128 bits in AES, and that the key
size may be either 128, 192, or 256 bits. Therefore AES-128, AES-192, and AES-256 are actually:
Key Size (bits) Block Size (bits)
AES-128 128 128
AES-192 192 128
AES-256 256 128
So in short:
Rijndael and AES differ only in the range of supported values for the block length and cipher key
length.
For Rijndael, the block length and the key length can be independently specified to any multiple of
32 bits, with a minimum of 128 bits, and a maximum of 256 bits.
AES fixes the block length to 128 bits, and supports key lengths of 128, 192 or 256 bits only.
What principle focuses on the uniqueness of separate objects that must be joined together toperform a task? It is sometimes referred to as “what each must bring” and joined together whengetting access or decrypting a file. Each of which does not reveal the other?
A. Dual control B. Separation of duties C. Split knowledge D. Need to know
Answer: C
Explanation:
Split knowledge involves encryption keys being separated into two components, each of which
does not reveal the other. Split knowledge is the other complementary access control principle to
dual control.
In cryptographic terms, one could say dual control and split knowledge are properly implemented if
no one person has access to or knowledge of the content of the complete cryptographic key being
protected by the two rocesses.
The sound implementation of dual control and split knowledge in a cryptographic environment
necessarily means that the quickest way to break the key would be through the best attack known
for the algorithm of that key. The principles of dual control and split knowledge primarily apply to
access to plaintext keys.
Access to cryptographic keys used for encrypting and decrypting data or access to keys that are
encrypted under a master key (which may or may not be maintained under dual control and split
knowledge) do not require dual control and split knowledge. Dual control and split knowledge can
be summed up as the determination of any part of a key being protected must require the collusion
between two or more persons with each supplying unique cryptographic materials that must be
joined together to access the protected key.
Any feasible method to violate the axiom means that the principles of dual control and split
knowledge are not being upheld.
Split knowledge is the unique “what each must bring” and joined together when implementing dual
control. To illustrate, a box containing petty cash is secured by one combination lock and one
keyed lock. One employee is given the combination to the combo lock and another employee has
possession of the correct key to the keyed lock.
In order to get the cash out of the box both employees must be present at the cash box at the
same time. One cannot open the box without the other. This is the aspect of dual control.
On the other hand, split knowledge is exemplified here by the different objects (the combination to
the combo lock and the correct physical key), both of which are unique and necessary, that each
brings to the meeting. Split knowledge focuses on the uniqueness of separate objects that must be
joined together.
Dual control has to do with forcing the collusion of at least two or more persons to combine their
split knowledge to gain access to an asset. Both split knowledge and dual control complement
each other and are necessary functions that implement the segregation of duties in high integrity
cryptographic environments.
The following are incorrect answers:
Dual control is a procedure that uses two or more entities (usually persons) operating in concert to
protect a system resource, such that no single entity acting alone can access that resource. Dual
control is implemented as a security procedure that requires two or more persons to come
together and collude to complete a process. In a cryptographic system the two (or more) persons
would each supply a unique key, that when taken together, performs a cryptographic process.
Split knowledge is the other complementary access control principle to dual control.
Separation of duties - The practice of dividing the steps in a system function among different
individuals, so as to keep a single individual from subverting the process.
The need-to-know principle requires a user having necessity for access to, knowledge of, or
possession of specific information required to perform official tasks or services.
Reference(s) used for this question:
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :
Shon Harris, CISSP All In One (AIO), 6th Edition , page 126
Question # 13
Which of the following is a symmetric encryption algorithm?
A. RSA B. Elliptic Curve C. RC5 D. El Gamal
Answer: C
Explanation:
RC5 is a symmetric encryption algorithm. It is a block cipher of variable block length, encrypts
through integer addition, the application of a bitwise Exclusive OR (XOR), and variable rotations.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 153).
Question # 14
What level of assurance for a digital certificate verifies a user's name, address, social securitynumber, and other information against a credit bureau database?
A. Level 1/Class 1 B. Level 2/Class 2 C. Level 3/Class 3 D. Level 4/Class 4
Answer: B
Explanation:
Users can obtain certificates with various levels of assurance. Here is a list that describe each of
them:
- Class 1/Level 1 for individuals, intended for email, no proof of identity
For example, level 1 certificates verify electronic mail addresses. This is done through the use of a
personal information number that a user would supply when asked to register. This level of
certificate may also provide a name as well as an electronic mail address; however, it may or may
not be a genuine name (i.e., it could be an alias). This proves that a human being will reply back if
you send an email to that name or email address.
- Class 2/Level 2 is for organizations and companies for which proof of identity is required
Level 2 certificates verify a user's name, address, social security number, and other information
against a credit bureau database.
- Class 3/Level 3 is for servers and software signing, for which independent verification and
checking of identity and authority is done by the issuing certificate authority
Level 3 certificates are available to companies. This level of certificate provides photo identification
to accompany the other items of information provided by a level 2 certificate.
- Class 4 for online business transactions between companies
- Class 5 for private organizations or governmental security
