- (Topic 5)
A X.509 public key certificate with the key usage attribute "non repudiation" can be used for which of the following?

1. A. encrypting messages
2. B. signing messages
3. C. verifying signed messages
4. D. decrypt encrypted messages

Correct Answer: C
References: RFC 2459 : Internet X.509 Public Key Infrastructure Certificate and CRL Profile; GUTMANN, P., X.509 style guide.

- (Topic 6)
The concept of best effort delivery is best associated with?

1. A. TCP
2. B. HTTP
3. C. RSVP
4. D. IP

Correct Answer: D
The Internet Protocol (IP) is a data-oriented protocol used for communicating data across a packet-switched internetwork. IP provides an unreliable service (i.e., best effort delivery). This means that the network makes no guarantees about the packet.
Low-level connectionless protocols such as DDP (under Appletalk) and IP usually provide best-effort delivery of data.
Best-effort delivery means that the protocol attempts to deliver any packets that meet certain requirements, such as containing a valid destination address, but the protocol does not inform the sender when it is unable to deliver the data, nor does it attempt to recover from error conditions and data loss.
Higher-level protocols such as TCP on the other hand, can provide reliable delivery of data. Reliable delivery includes error checking and recovery from error or loss of data.
HTTP is the HyperText Transport Protocol used to establish connections to a web server and thus one of the higher level protocol using TCP to ensure delivery of all bytes between the client and the server. It was not a good choice according to the question presented.
Here is another definition from the TCP/IP guide at: http://www.tcpipguide.com/free/t_IPOverviewandKeyOperationalCharacteristics.htm
Delivered Unreliably: IP is said to be an “unreliable protocol”. That doesn't mean that one day your IP software will decide to go fishing rather than run your network. J It does mean that when datagrams are sent from device A to device B, device A just sends each one and then moves on to the next. IP doesn't keep track of the ones it sent. It does not provide reliability or service quality capabilities such as error protection for the data it sends (though it does on the IP header), flow control or retransmission of lost datagrams.
For this reason, IP is sometimes called a best-effort protocol. It does what it can to get data to where it needs to go, but “makes no guarantees” that the data will actually get there.

- (Topic 2)
The preliminary steps to security planning include all of the following EXCEPT which of the
following?

1. A. Establish objectives.
2. B. List planning assumptions.
3. C. Establish a security audit function.
4. D. Determine alternate courses of action

Correct Answer: C
The keyword within the question is: preliminary
This means that you are starting your effort, you cannot audit if your infrastructure is not even in place.
Reference used for this question:
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

- (Topic 4)
Which of the following is an advantage of a qualitative over a quantitative risk analysis?

1. A. It prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities.
2. B. It provides specific quantifiable measurements of the magnitude of the impacts.
3. C. It makes a cost-benefit analysis of recommended controls easier.
4. D. It can easily be automated.

Correct Answer: A
The main advantage of the qualitative impact analysis is that it prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities. It does not provide specific quantifiable measurements of the magnitude of the impacts, therefore making a cost-analysis of any recommended controls difficult. Since it involves a consensus of export and some guesswork based on the experience of Subject Matter Experts (SME's), it can not be easily automated.
Reference used for this question:
STONEBURNER, Gary et al., NIST Special publication 800-30, Risk management Guide for Information Technology Systems, 2001 (page 23).

- (Topic 6)
Which of the following statements pertaining to firewalls is incorrect?

1. A. Firewalls create bottlenecks between the internal and external network.
2. B. Firewalls allow for centralization of security services in machines optimized and dedicated to the task.
3. C. Firewalls protect a network at all layers of the OSI models.
4. D. Firewalls are used to create security checkpoints at the boundaries of private networks.

Correct Answer: C
Firewalls can protect a network at multiple layers of the OSI models, however most of the firewalls do not have the ability to monitor the payload of the packets and see if an application level attack is taking place.
Today there are a new breed of firewall called Unified Threat Managers or UTM. They are a collection of products on a single computer and not necessarily a typical firewall. A UTM can address all of the layers but typically a firewall cannot.
Firewalls are security checkpoints at the boundaries of internal networks through which every packet must pass and be inspected, hence they create bottlenecks between the internal and external networks. But since external connections are relatively slow compared to modern computers, the latency caused by this bottleneck can almost be transparent.
By implementing the concept of border security, they centralize security services in machines optimized and dedicated to the task, thus relieving the other hosts on the network from that function.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 1: Understanding Firewalls.