Pass ISC CISSP Exam Info and Free Practice Test [Q507-Q527]

Traffic padding is a countermeasure to traffic analysis.
Even if perfect cryptographic routines are used, the attacker can gain knowledge of the amount of traffic that was generated. The attacker might not know what Alice and Bob were talking about, but can know that they were talking and how much they talked. In certain circumstances this can be very bad. Consider for example when a military is organising a secret attack against another nation: it may suffice to alert the other nation for them to know merely that there is a lot of secret activity going on.
As another example, when encrypting Voice Over IP streams that use variable bit rate encoding, the number of bits per unit of time is not obscured, and this can be exploited to guess spoken phrases.
Padding messages is a way to make it harder to do traffic analysis. Normally, a number of random bits are appended to the end of the message with an indication at the end how much this random data is. The randomness should have a minimum value of 0, a maximum number of N and an even distribution between the two extremes. Note, that increasing 0 does not help, only increasing N helps, though that also means that a lower percentage of the channel will be used to transmit real data. Also note, that since the cryptographic routine is assumed to be uncrackable (otherwise the padding length itself is crackable), it does not help to put the padding anywhere else, e.g. at the beginning, in the middle, or in a sporadic manner.
The other answers are all techniques used to do Penetration Testing.
References:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, pages 233, 238.
and
https://secure.wikimedia.org/wikipedia/en/wiki/Padding_%28cryptography%29#Traffic_anal ysis

Diffie and Hellman describe a means for two parties to agree upon a shared secret in such a way that the secret will be unavailable to eavesdroppers. This secret may then be converted into cryptographic keying material for other (symmetric) algorithms. A large number of minor variants of this process exist. See RFC 2631 Diffie-Hellman Key
Agreement Method for more details.
In 1976, Diffie and Hellman were the first to introduce the notion of public key cryptography, requiring a system allowing the exchange of secret keys over non-secure channels. The
Diffie-Hellman algorithm is used for key exchange between two parties communicating with each other, it cannot be used for encrypting and decrypting messages, or digital signature.
Diffie and Hellman sought to address the issue of having to exchange keys via courier and other unsecure means. Their efforts were the FIRST asymmetric key agreement algorithm.
Since the Diffie-Hellman algorithm cannot be used for encrypting and decrypting it cannot provide confidentiality nor integrity. This algorithm also does not provide for digital signature functionality and thus non-repudiation is not a choice.
NOTE: The DH algorithm is susceptible to man-in-the-middle attacks.
KEY AGREEMENT VERSUS KEY EXCHANGE
A key exchange can be done multiple way. It can be done in person, I can generate a key and then encrypt the key to get it securely to you by encrypting it with your public key. A
Key Agreement protocol is done over a public medium such as the internet using a mathematical formula to come out with a common value on both sides of the communication link, without the ennemy being able to know what the common agreement is.
The following answers were incorrect:
All of the other choices were not correct choices
Reference(s) used for this question:
Shon Harris, CISSP All In One (AIO), 6th edition . Chapter 7, Cryptography, Page 812.
http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
http://www.google.com/patents?vid=4200770

If a category does not exist then you cannot compare it. Incomparable is when you
have two disjointed sensitivity labels, that is a category in one of the labels is not in the other label.
“Because neither label contains all the categories of the other, the labels can’t be compared.
They’re said to be incomparable”
COMPARABILITY:
The label:
TOP SECRET [VENUS ALPHA]
is “higher” than either of the labels:
SECRET [VENUS ALPHA] TOP SECRET [VENUS]
But you can’t really say that the label:
TOP SECRET [VENUS]
is higher than the label:
SECRET [ALPHA]
Because neither label contains all the categories of the other, the labels can’t be compared.
They’re said to be incomparable. In a mandatory access control system, you won’t be allowed
access to a file whose label is incomparable to your clearance.
The Multilevel Security policy uses an ordering relationship between labels known as the
dominance relationship. Intuitively, we think of a label that dominates another as being “higher”
than the other. Similarly, we think of a label that is dominated by another as being “lower” than the
other. The dominance relationship is used to determine permitted operations and information
flows.
DOMINANCE
The dominance relationship is determined by the ordering of the Sensitivity/Clearance component
of the label and the intersection of the set of Compartments.
Sample Sensitivity/Clearance ordering are:
Top Secret > Secret > Confidential > Unclassified
s3 > s2 > s1 > s0
Formally, for label one to dominate label 2 both of the following must be true:
The sensitivity/clearance of label one must be greater than or equal to the sensitivity/clearance of
label two.
The intersection of the compartments of label one and label two must equal the compartments of
label two.
Additionally:
Two labels are said to be equal if their sensitivity/clearance and set of compartments are exactly
equal. Note that dominance includes equality.
One label is said to strictly dominate the other if it dominates the other but is not equal to the other.
Two labels are said to be incomparable if each label has at least one compartment that is not
included in the other’s set of compartments.
The dominance relationship will produce a partial ordering over all possible MLS labels, resulting
in what is known as the MLS Security Lattice.
The following answers are incorrect:
The number of classification in the two labels is different. Is incorrect because the categories are
what is being compared, not the classifications.
Neither label contains all the classifications of the other. Is incorrect because the categories are
what is being compared, not the classifications.
the number of categories in the two labels is different. Is incorrect because it is possibe a category exists more than once in one sensitivity label and does exist in the other so they would be comparable.
Reference(s) used for this question:
OReilly – Computer Systems and Access Control (Chapter 3) http://www.oreilly.com/catalog/csb/chapter/ch03.html and http://rubix.com/cms/mls_dom

Explanation/Reference:
Explanation:
Identification involves a user supplying identification information using a username, user ID, or account number.
Incorrect Answers:
A: Authentication involves verifying a user’s identification information using a passphrase, PIN value, biometric, one-time password, or password.
C: Authorization is when a system establishes whether the user is authorized to access the particular resource and what actions he is permitted to perform on that resource.
D: Confidentiality is used to make sure that the required level of secrecy is imposed at every junction of data processing and prevents unauthorized disclosure.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 24, 166, 203

Explanation/Reference:
Explanation:
On-line network-based IDS monitors network traffic in real time and it analyses the Ethernet packet and applies it on the same rules to decide if it is an attack or not.
Incorrect Answers:
B: A host-based intrusion detection system (HIDS) monitors and analyzes the internals of a computing system, as well as the network packets on its network interfaces in certain instances.
C: An application-based IDS is designed to monitor a specific application.
D: Firewalls are different to IDS because it looks outwardly for intrusions in order to stop them from happening.
References:
https://en.wikipedia.org/wiki/Intrusion_detection_system
https://en.wikipedia.org/wiki/Host-based_intrusion_detection_system

S/MIME (for Secure MIME, or Secure Multipurpose Mail Extension) is a security process used for e-mail exchanges that makes it possible to guarantee the confidentiality and non-repudiation of electronic messages. S/MIME is based on the MIME standard, the goal of which is to let users attach files other than ASCII text files to electronic messages. The MIME standard therefore makes it possible to attach all types of files to e-mails. S/MIME was originally developed by the company RSA Data Security. Ratified in July 1999 by the IETF, S/MIME has become a standard, whose specifications are contained in RFCs 2630 to 2633.
How S/MIME works
The S/MIME standard is based on the principle of public-key encryption. S/MIME therefore makes
it possible to encrypt the content of messages but does not encrypt the communication.
The various sections of an electronic message, encoded according to the MIME standard, are
each encrypted using a session key.
The session key is inserted in each section’s header, and is encrypted using the recipient’s public
key. Only the recipient can open the message’s body, using his private key, which guarantees the
confidentiality and integrity of the received message.
In addition, the message’s signature is encrypted with the sender’s private key. Anyone
intercepting the communication can read the content of the message’s signature, but this ensures
the recipient of the sender’s identity, since only the sender is capable of encrypting a message
(with his private key) that can be decrypted with his public key.
Reference(s) used for this question:
http://en.kioskea.net/contents/139-cryptography-s-mime
RFC 2630: Cryptographic Message Syntax;
OPPLIGER, Rolf, Secure Messaging with PGP and S/MIME, 2000, Artech House;
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne, page
570;
SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.

Historically, a code refers to a cryptosystem that deals with linguistic units: words,
phrases, sentences, and so forth. Codes are only useful for specialized circumstances where the
message to transmit has an already defined equivalent ciphertext word.
Source: DUPUIS, Cl?ment, CISSP Open Study Guide on domain 5, cryptography, April 1999.

Explanation/Reference:
Explanation:
After DES was used as an encryption standard for over 20 years and it was cracked in a relatively short time once the necessary technology was available, NIST decided a new standard, the Advanced Encryption Standard (AES), needed to be put into place. In January 1997, NIST announced its request for AES candidates and outlined the requirements in FIPS PUB 197. AES was to be a symmetric block cipher supporting key sizes of 128, 192, and 256 bits. The following five algorithms were the finalists:
MARS Developed by the IBM team that created Lucifer

RC6 Developed by RSA Laboratories

Serpent Developed by Ross Anderson, Eli Biham, and Lars Knudsen

Twofish Developed by Counterpane Systems

Rijndael Developed by Joan Daemen and Vincent Rijmen

Out of these contestants, Rijndael was chosen. The block sizes that Rijndael supports are 128, 192, and
256 bits.
Rijndael works well when implemented in software and hardware in a wide range of products and environments. It has low memory requirements and has been constructed to easily defend against timing attacks.
Rijndael was NIST’s choice to replace DES. It is now the algorithm required to protect sensitive but unclassified U.S. government information.
Incorrect Answers:
A: RC6 was a finalist; however, Rijndael was selected by NIST as the AES algorithm.
B: Twofish was a finalist; however, Rijndael was selected by NIST as the AES algorithm.
B: Blowfish was not selected by NIST as the AES algorithm.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 809

Explanation/Reference:
Explanation:
Physically securing the tapes from unauthorized access is obviously a security concern and is considered a function of the Operations Security Domain.
Operations Security can be described as the controls over the hardware in a computing facility, the data media used in a facility, and the operators using these resources in a facility.
Operations Security refers to the act of understanding the threats to and vulnerabilities of computer operations in order to routinely support operational activities that enable computer systems to function correctly. It also refers to the implementation of security controls for normal transaction processing, system administration tasks, and critical external support operations. These controls can include resolving software or hardware problems along with the proper maintenance of auditing and monitoring processes.
Incorrect Answers:
B: Physically securing backup tapes from unauthorized access is not considered a function of the Operations Security Domain Analysis.
C: Physically securing backup tapes from unauthorized access is not considered a function of the Telecommunications and Network Security Domain.
D: Physically securing backup tapes from unauthorized access is not considered a function of the Business Continuity Planning and Disaster Recovery Planning.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, 2nd Edition, Wiley Publishing, Indianapolis, 2004, p. 71
Krutz, Ronald L. and Russel Dean Vines, The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, New York, 2001, p. 301

The RARP protocol sends out a packet, which includes its MAC address and a
request to be informed of the IP address that should be assigned to that MAC address.
ARP does the opposite by broadcasting a request to find the Ethernet address that matches a
known IP address.
ICMP supports packets containing error, control, and informational messages (e.g. PING).
UDP runs over IP and is used primarily for broadcasting messages over a network.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 87.

As it provides much of the same functionality that RSA provides: digital signatures,
secure key distribution,and encryption. One differing factor is ECC’s efficiency. ECC is more
efficient that RSA and any other asymmetric algorithm.
The following answers are incorrect because :
RSA is incorrect as it is less efficient than ECC to be used in handheld devices.
SHA is also incorrect as it is a hashing algorithm.
RC4 is also incorrect as it is a symmetric algorithm.
Reference : Shon Harris AIO v3 , Chapter-8 : Cryptography , Page : 631 , 638.

The most appropriate strategy for the log retention of a cloud service provider that requires its customer organizations to enable maximum audit logging for its data storage service and to retain the logs for the period of three months, given that the audit logging generates extremely high amount of logs, is to keep last week’s logs in an online storage and the rest in a near-line storage. Online storage is a type of storage that is directly accessible by the system or application, such as hard disk drives, solid state drives, or flash drives. Online storage is fast, convenient, and reliable, but it is also expensive and consumes more power. Near-line storage is a type of storage that is not directly accessible by the system or application, but can be made accessible within a short time, such as tape drives, optical disks, or removable media. Near-line storage is slower, less convenient, and less reliable than online storage, but it is also cheaper and consumes less power. By keeping last week’s logs in an online storage and the rest in a near-line storage, the cloud service provider can balance the trade-offs between performance, cost, and availability of the logs. The logs that are most likely to be accessed or analyzed are kept in the online storage, while the logs that are less likely to be accessed or analyzed are kept in the near-line storage. This way, the cloud service provider can meet the log retention requirement without wasting too much resources or compromising the security of the logs. Keeping all logs in an online storage, keeping all logs in an offline storage, or keeping last week’s logs in an online storage and the rest in an offline storage are not appropriate strategies for the log retention of the cloud service provider.
Keeping all logs in an online storage would be too costly and inefficient, as it would consume too much disk space and power for logs that are rarely accessed or analyzed. Keeping all logs in an offline storage or keeping last week’s logs in an online storage and the rest in an offline storage would be too risky and inconvenient, as it would make the logs inaccessible or difficult to access in case of an audit, investigation, or incident response. Offline storage is a type of storage that is not accessible by the system or application, and requires manual intervention to access, such as archived tapes, disks, or media. References: Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 7, Security Operations, page 697. CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7, Security Operations, page 660.

When using symmetric cryptography, both parties will be using the same key for encryption and decryption. Symmetric cryptography is generally fast and can be hard to break, but it offers limited overall security in the fact that it can only provide confidentiality.
Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page
2).