What is NOT true about a one-way hashing function?
Correct Answer: A
Explanation/Reference: A one way hashing function can only be use for the integrity of a message and not for authentication or confidentiality. Because the hash creates just a fingerprint of the message which cannot be reversed and it is also very difficult to create a second message with the same hash. A hash by itself does not provide Authentication. It only provides a weak form or integrity. It would be possible for an attacker to perform a Man-In-The-Middle attack where both the hash and the digest could be changed without the receiver knowing it. A hash combined with your session key will produce a Message Authentication Code (MAC) which will provide you with both authentication of the source and integrity. It is sometimes referred to as a Keyed Hash. A hash encrypted with the sender private key produce a Digital Signature which provide authentication, but not the hash by itself. Hashing functions by themselves such as MD5, SHA1, SHA2, SHA-3 does not provide authentication. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2001, Page 548
Question 237
Which of the following is a telecommunication device that translates data from digital to analog form and back to digital?
Correct Answer: B
Explanation/Reference: A modem is a device that translates data from digital form and then back to digital for communication over analog lines. Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 114).
Question 238
The MOST common threat that impacts a business's ability to function normally is:
Correct Answer: A
Explanation/Reference: The MOST common threat that impacts a business's ability to function normally is power. Power interruption cause more business interruption than any other type of event. The second most common threat is Water such as flood, water damage from broken pipe, leaky roof, etc... Threats will be discovered while doing your Threats and Risk Assessments (TRA). There are three elements of risks: threats, assets, and mitigating factors (countermeasures, safeguards, controls). A threat is an event or situation that if it occured would affect your business and may even prevent it from functioning normally or in some case functioning at all. Evaluation of threats is done by looking at Likelihood and Impact of possible threat. Safeguards, countermeasures, and controls would be used to bring the threat level down to an acceptable level. Other common events that can impact a company are: Weather, cable cuts, fires, labor disputes, transportation mishaps, hardware failure, chemical spills, sabotage. References: The Official ISC2 Guide to the CISSP CBK, Second Edition, Page 275-276
Question 239
Which of the following backup methods is most appropriate for off-site archiving?
Correct Answer: C
Section: Risk, Response and Recovery Explanation/Reference: The full backup makes a complete backup of every file on the system every time it is run. Since a single backup set is needed to perform a full restore, it is appropriate for off-site archiving. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 69).
Question 240
Which of the following is NOT a characteristic or shortcoming of packet filtering gateways?
Correct Answer: D
Packet filtering firewalls use routers with packet filtering rules to grant or deny access based on source address, destination address, and port. They offer minimum security but at a very low cost, and can be an appropriate choice for a low-risk environment. Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 3, Secured Connections to External Networks (page 60).
