Correct Answer: B

Identification is the act of a user professing an identity to a system, usually in the form of a log- on ID to the

system.

Identification is nothing more than claiming you are somebody. You identify yourself when you speak to

someone on the phone that you don't know, and they ask you who they're speaking to. When you say, "I'm

Jason.", you've just identified yourself.

In the information security world, this is analogous to entering a username. It's not analogous to entering a

password. Entering a password is a method for verifying that you are who you identified yourself as.

NOTE: The word "professing" used above means: "to say that you are, do, or feel something when other

people doubt what you say". This is exactly what happen when you provide your identifier (identification),

you claim to be someone but the system cannot take your word for it, you must further Authenticate to the

system to prove who you claim to be.

The following are incorrect answers:

Authentication: is how one proves that they are who they say they are. When you claim to be Jane Smith

by logging into a computer system as "jsmith", it's most likely going to ask you for a password. You've

claimed to be that person by entering the name into the username field (that's the identification part), but

now you have to prove that you are really that person.

Many systems use a password for this, which is based on "something you know", i.e. a secret between you

and the system.

Another form of authentication is presenting something you have, such as a driver's license, an RSA token,

or a smart card.

You can also authenticate via something you are. This is the foundation for biometrics. When you do this,

you first identify yourself and then submit a thumb print, a retina scan, or another form of bio-based

authentication.

Once you've successfully authenticated, you have now done two things: you've claimed to be someone,

and you've proven that you are that person. The only thing that's left is for the system to determine what

you're allowed to do.

Authorization: is what takes place after a person has been both identified and authenticated; it's the step

determines what a person can then do on the system.

An example in people terms would be someone knocking on your door at night. You say, "Who is it?", and

wait for a response. They say, "It's John." in order to identify themselves. You ask them to back up into the

light so you can see them through the peephole. They do so, and you authenticate them based on what

they look like (biometric). At that point you decide they can come inside the house.

If they had said they were someone you didn't want in your house (identification), and you then verified that

it was that person (authentication), the authorization phase would not include access to the inside of the

house.

Confidentiality: Is one part of the CIA triad. It prevents sensitive information from reaching the wrong people, while making sure that the right people can in fact get it. A good example is a credit card number while shopping online, the merchant needs it to clear the transaction but you do not want your informaiton exposed over the network, you would use a secure link such as SSL, TLS, or some tunneling tool to protect the information from prying eyes between point A and point B. Data encryption is a common method of ensuring confidentiality.

The other parts of the CIA triad are listed below:

Integrity involves maintaining the consistency, accuracy, and trustworthiness of data over its entire life cycle. Data must not be changed in transit, and steps must be taken to ensure that data cannot be altered by unauthorized people (for example, in a breach of confidentiality). In addition, some means must be in place to detect any changes in data that might occur as a result of non-human-caused events such as an electromagnetic pulse (EMP) or server crash. If an unexpected change occurs, a backup copy must be available to restore the affected data to its correct state. Availability is best ensured by rigorously maintaining all hardware, performing hardware repairs immediately when needed, providing a certain measure of redundancy and failover, providing adequate communications bandwidth and preventing the occurrence of bottlenecks, implementing emergency backup power systems, keeping current with all necessary system upgrades, and guarding against malicious actions such as denial-of-service (DoS) attacks.

Reference used for this question:

http://whatis.techtarget.com/definition/Confidentiality-integrity-and-availability-CIA

http://www.danielmiessler.com/blog/security-identification-authentication-and-authorization

http://www.merriam-webster.com/dictionary/profess

KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 36.

Correct Answer: D

Authentication is based on the following three factor types: Type 1. Something you know, such as a PIN or password Type 2. Something you have, such as an ATM card or smart card Type 3. Something you are (Unique physical characteristic), such as a fingerprint or retina scan Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of

Computer Security, 2001, John Wiley and Sons, Page 36.

Also: HARRIS, Shon, All-In-One CISSP Certification uide, McGraw-Hill/Osborne, 2002, chapter 4:

Access Control (pages 132-133).

Correct Answer: A

Data Hiding is protecting data so that it is only available to higher levels this is done and is also performed

by layering, when the software in each layer maintains its own global data and does not directly reference

data outside its layers.

The following answers are incorrect:

Auditing processes and their memory addresses cannot be accessed by user processes. Is incorrect

because this does not offer data hiding.

Only security processes are allowed to write to ring zero memory. This is incorrect, the security kernel

would be responsible for this.

It is a form of strong encryption cipher. Is incorrect because this does not conform to the definition of data

hiding.

Correct Answer: A

Risk is the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact. If a firewall has several ports open , there is a higher likelihood that an intruder will use one to access the network in an unauthorized method.

The following answers are incorrect :

Residual Risk is very different from the notion of total risk. Residual Risk would be the risks that still exists

after countermeasures have been implemented. Total risk is the amount of risk a company faces if it

chooses not to implement any type of safeguard.

Exposure: An exposure is an instance of being exposed to losses from a threat agent.

Countermeasure: A countermeasure or a safeguard is put in place to mitigate the potential risk. Examples

of countermeasures include strong password management , a security guard.

REFERENCES : SHON HARRIS ALL IN ONE 3rd EDITION

Chapter - 3: Security Management Practices , Pages : 57-59

Correct Answer: B

RFC 2828 (Internet Security Glossary) defines Simple Key Management for Internet Protocols (SKIP) as:

A key distribution protocol that uses hybrid encryption to convey session keys that are used to encrypt data

in IP packets.

SKIP is an hybrid Key distribution protocol similar to SSL, except that it establishes a long-term key once,

and then requires no prior communication in order to establish or exchange keys on a session-by-session

basis. Therefore, no connection setup overhead exists and new keys values are not continually generated.

SKIP uses the knowledge of its own secret key or private component and the destination's public

component to calculate a unique key that can only be used between them.

IKE stand for Internet Key Exchange, it makes use of ISAKMP and OAKLEY internally.

Internet Key Exchange (IKE or IKEv2) is the protocol used to set up a security association (SA) in the

IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP. IKE uses X.509 certificates for

authentication and a DiffieHellman key exchange to set up a shared session secret from which

cryptographic keys are derived.

The following are incorrect answers:

ISAKMP is an Internet IPsec protocol to negotiate, establish, modify, and delete security associations, and

to exchange key generation and authentication data, independent of the details of any specific key

generation technique, key establishment protocol, encryption algorithm, or authentication mechanism.

IKE is an Internet, IPsec, key-establishment protocol (partly based on OAKLEY) that is intended for putting

in place authenticated keying material for use with ISAKMP and for other security associations, such as in

AH and ESP.

IPsec Key exchange (IKE) is only a detracto.

Reference(s) used for this question:

SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

and

http://en.wikipedia.org/wiki/Simple_Key-Management_for_Internet_Protocol

and

http://en.wikipedia.org/wiki/Simple_Key-Management_for_Internet_Protocol

Correct Answer: A

Reference: RFC 2409: The Internet Key Exchange (IKE); DORASWAMY, Naganand and HARKINS, Dan, Ipsec: The New Security Standard for the Internet, Intranets, and Virtual Private Networks, 1999, Prentice Hall PTR; SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.

Correct Answer: B

As per RFC, The DoD TCP/IP protocol model defines four layers, with the layers having names, not

numbers, as follows:

Application (process-to-process) Layer:

This is the scope within which applications create user data and communicate this data to other processes

or applications on another or the same host. The communications partners are often called peers. This is

where the "higher level" protocols such as SMTP, FTP, SSH, HTTP, etc.

operate.

Transport (host-to-host) Layer:

The Transport Layer constitutes the networking regime between two network hosts, either on the local

network or on remote networks separated by routers. The Transport Layer provides a uniform networking

interface that hides the actual topology (layout) of the underlying network connections. This is where flow-

control, error-correction, and connection protocols exist, such as TCP. This layer deals with opening and

maintaining connections between internet hosts.

Internet (internetworking) Layer:

The Internet Layer has the task of exchanging datagrams across network boundaries. It is therefore also

referred to as the layer that establishes internetworking; indeed, it defines and establishes the Internet.

This layer defines the addressing and routing structures used for the TCP/IP protocol suite. The primary

protocol in this scope is the Internet Protocol, which defines IP addresses. Its function in routing is to

transport datagrams to the next IP router that has the connectivity to a network closer to the final data

destination.

Link (network access) Layer:

This layer defines the networking methods with the scope of the local network link on which hosts

communicate without intervening routers. This layer describes the protocols used to describe the local

network topology and the interfaces needed to affect transmission of Internet Layer datagrams to next-

neighbor hosts.

The DoD tcp/ip model DoD model Osi Model

Graphic above from: http://bit.kuas.edu.tw/

REALITY VERSUS THE STANDARD

In real life today, this is getting very confusing. Many books and references will not use exactly the same

names as the initial RFC that was published. For example, the Link layer is often times called Network

Access. The same applies with Transport which is often times called Host-to- Host and vice versa.

The following answer is incorrect:

The session layer is defined within the OSI/ISO model but not within the DOD model. Being incorrect it

made it the best answer according to the question. It does not belong to the DoD TCP/IP Model.

Reference(s) Used for this question:

http://www.freesoft.org/CIE/RFC/1122/

http://bit.kuas.edu.tw/~csshieh/teach/np/tcpip/

Correct Answer: C

Repeaters offer the simplest form of connectivity. They regenerate received electrical signals at their original strength between cable segments. Bridges are devices used to connect similar or dissimilar LANs together to form an extended LAN. Routers provide packet routing between network segments. Brouter are devices that combine router and bridge functionality.

Source: HARRIS, Shon, All-In-One CISSP Certification uide, McGraw-Hill/Osborne, 2002, chapter

7: Telecommunications and Network Security (page 397).

Correct Answer: C

The Secure Socket Layer (SSL) protocol is used between a web server and client and provides entire session encryption, thus preventing from session hijacking. RSA is asymmetric encryption algorithm that can be used in setting up a SSL session. SET is the Secure Electronic Transaction protocol that was introduced by Visa and Mastercard to allow for more credit card transaction possibilities. PPP is a point-topoint protocol.

Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley and Sons, 2001, Chapter 3: Telecommunications and Network Security (page 89).

Correct Answer: D

The MAC address is 48 bits long, 24 of which identify the vendor, as provided by the IEEE. The other 24 bits are provided by the vendor. A media access control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies and most IEEE 802 network technologies, including Ethernet. Logically, MAC addresses are used in the media access control protocol sublayer of the OSI reference model. MAC addresses are most often assigned by the manufacturer of a network interface card (NIC) and are stored in its hardware, such as the card's read-only memory or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer's registered identification number and may be referred to as the burned-in address. It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. This is can be contrasted to a programmed address, where the host device issues commands to the NIC to use an arbitrary address. An example is many SOHO routers, where the ISP grants access to only one MAC address (used previously to inserting the router) so the router must use that MAC address on its Internet-facing NIC. Therefore the router administrator configures a MAC address to override the burned-in one. A network node may have multiple NICs and each must have one unique MAC address per NIC. See diagram below from Wikipedia showing the format of a MAC address. : MAC Address format Reference(s) used for this question: http://en.wikipedia.org/wiki/MAC_address