ISSAP Practice Questions

A fence that is 3 to 4 feet (approximately 1 meter) high serves primarily as a psychological and demarcation barrier. Its main purpose is to define a property boundary and discourage casual or opportunistic entry. This height is easily surmounted by a determined individual but is generally sufficient to deter someone who is not actively seeking to trespass. It effectively communicates that an area is private property without providing a significant physical obstacle, thus deterring only casual trespassers.

A. 8 feet: This height constitutes a high-security barrier designed to deter and delay determined intruders, not just casual ones.

C. 2 to 2.5 feet: This height is largely ornamental and can be stepped over easily, offering negligible deterrent value even to a casual trespasser.

D. 6 to 7 feet: This height presents a physical challenge that is difficult to climb, intended to prevent entry from more than just casual trespassers.

1. Fennelly

L. J. (2017). Effective Physical Security (5th ed.). Butterworth-Heinemann. In Chapter 10

"Physical Barriers

" it is explained that fences under 4 feet are primarily for marking boundaries

while fences 6 feet or higher are considered true barriers intended to prevent climbing. This aligns with the 3-4 foot fence being a deterrent for casual trespassers.

2. Garcia

M. L. (2007). The Design and Evaluation of Physical Protection Systems (2nd ed.). Butterworth-Heinemann. Chapter 4

"The Physical Protection System

" discusses the functions of deterrence

detection

and delay. A low fence (3-4 ft) primarily serves the deterrence function against an unmotivated adversary (i.e.

a casual trespasser)

as it offers minimal delay.

3. U.S. Army Corps of Engineers. (2019). Unified Facilities Criteria (UFC) 4-010-01: DoD Minimum Antiterrorism Standards for Buildings. Section B-2.2

"Fences and Walls

" notes that for standoff distance credit

fences must be at least 7 ft (2.1 m) high

implying that shorter fences do not meet the standard for deterring determined adversaries

and thus serve a lesser

more demarcation-focused role.

Network Address Translation (NAT) is a method used by routers to map multiple private, non-routable IP addresses (e.g., from the 192.168.0.0/16 range) to a single, public, routable IP address. When a device on the internal network sends a packet to the internet, the NAT router replaces the private source IP address with its own public IP address. To any external observer, all traffic appears to originate from the router itself, effectively hiding the internal network's structure and specific IP addresses. This is a fundamental function of NAT and directly addresses the customer's requirement.

A. Port forwarding: This feature selectively exposes specific internal services to the external network; it does not hide the internal network.

C. MAC filtering: This is a Layer 2 security control that restricts network access based on a device's hardware address, not its IP address.

D. Firewall: A firewall's primary function is to filter traffic based on a set of rules, not to translate or hide IP addresses, which is the specific role of NAT.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-41 Rev. 1

Guidelines on Firewalls and Firewall Policy.

Section 4.4

Network Address Translation (NAT): "Network Address Translation (NAT) is the translation of an IP address used within one network to a different IP address known within another network... NAT can also provide a type of security by hiding internal IP addresses from external networks."

2. Internet Engineering Task Force (IETF) RFC 2663

IP Network Address Translator (NAT) Terminology and Considerations.

Section 1

Introduction: This document describes how NAT is used to "alleviate the IP address depletion problem" and notes its side effect of providing a form of "firewall" by hiding the internal network topology.

3. Peterson

L.

& Davie

B. (2011). Computer Networks: A Systems Approach (5th ed.). Morgan Kaufmann.

Section 4.1.4

Network Address Translation (NAT): "The key idea is that NAT is implemented on a border router that has one interface on the inside (local) network and one on the outside (global) network... To the outside world

the entire local network looks like a single host with the IP address of the outside interface of the NAT box."

4. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Section 4.4.2

The Network Address Translation (NAT) Router: "From the outside world

all datagrams leaving the home network for the larger Internet have the same single source NAT IP address... The hosts inside the home network are not directly addressable or visible by the outside world."

Non-repudiation is a security service that provides proof of the integrity and origin of data, preventing an entity from denying having performed a particular action. This is typically achieved using digital signatures, which are created and verified by application-level protocols. The OSI Security Architecture (ISO/IEC 7498-2) explicitly places the non-repudiation service at the Application Layer (Layer 7). This is because the Application Layer is closest to the user and manages the specific data (e.g., an email, a transaction) whose origin needs to be proven. Protocols like Secure/Multipurpose Internet Mail Extensions (S/MIME) operate here to provide this service.

B. The data-link layer: This layer manages physical addressing and framing between adjacent nodes. It lacks the end-to-end scope and user identity context necessary for non-repudiation.

C. The presentation layer: This layer is responsible for data translation, compression, and encryption. While it handles cryptographic functions, the non-repudiation service itself is an application-level concept.

D. The physical layer: This layer deals with the transmission of raw bits over a physical medium and has no mechanisms to implement logical security services like non-repudiation.

1. ISO/IEC 7498-2:1989

"Information processing systems — Open Systems Interconnection — Basic Reference Model — Part 2: Security Architecture." In Section 7.3

"Placement of Security Services

" Table 2 ("Illustration of the placement of security services in the OSI reference model") indicates that the Non-repudiation service is applicable only to the Application Layer.

2. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. In Chapter 1

Section 1.6 "Network Security Model

" the text discusses the OSI Security Architecture

stating

"The nonrepudiation service is specified in the application layer." (p. 23).

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 7

"Networks

" discusses security services in the context of network layers

explaining that services like non-repudiation are handled by application-specific protocols (e.g.

PGP

S/MIME)

which reside at the Application Layer.

A Disaster Recovery Plan (DRP) is the specific, technical plan focused on the actions required to recover and restore information systems, data, and IT infrastructure following a disruptive event. The question's key phrase, "significant loss of information systems resources," directly aligns with the primary purpose of a DRP. While a DRP is a component of broader continuity efforts, it is the principal document that addresses the detailed procedures for responding to a technology-centric disaster before, during, and after the event to restore system functionality.

B. Contingency plan: This is a high-level, umbrella term that encompasses various plans (including DRP and BCP) for system recovery, making it less specific than the correct answer.

C. Business Continuity plan: This plan has a broader, strategic focus on maintaining critical business functions and processes, not just the recovery of information technology resources.

D. Continuity of Operations plan: Similar to a BCP, this plan focuses on sustaining an organization's mission-essential functions at an alternate site, a scope wider than just IT systems recovery.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 2.3

Page 7: Defines a Disaster Recovery Plan (DRP) as "a plan for recovering and protecting a business infrastructure in the event of a disaster... DRPs are generally IT-focused". This directly supports the choice of DRP for a plan concerning "information systems resources."

Section 2.3

Page 7: Defines a Business Continuity Plan (BCP) as focusing "on sustaining an organization’s business functions during and after a disruption

" highlighting its broader

business-process scope.

Section 2.2

Page 6: Describes Contingency Planning as the overall "coordinated strategy involving plans

procedures

and technical measures

" confirming its status as an umbrella concept.

2. FIPS PUB 199

Standards for Security Categorization of Federal Information and Information Systems.

Appendix A

Page 8: In the context of Availability

it discusses contingency plans (which include DRPs) as the primary means to ensure "timely and reliable access to and use of information

" reinforcing the link between these plans and the operational status of information systems. The DRP is the specific implementation for disaster scenarios.

The SSH-2 protocol was a complete redesign of SSH-1 to address security flaws and improve modularity. As part of this redesign, several authentication methods supported in SSH-1 were deprecated and removed or replaced with more secure and flexible alternatives in SSH-2.

Specifically, Rhosts (rsh-style) authentication was removed due to its inherent insecurities related to IP and DNS spoofing. TIS authentication, an early challenge-response mechanism, was superseded by the more generic 'keyboard-interactive' method. The direct Kerberos authentication method in SSH-1 was replaced in SSH-2 by the more extensible Generic Security Service Application Program Interface (GSSAPI), which can support Kerberos 5 and other mechanisms. Password-based authentication remains a core method in both protocol versions.

D. Password-based authentication: This is a fundamental authentication method that is explicitly supported and defined in the protocol specifications for both SSH-1 and SSH-2.

1. University of Michigan

EECS 588 - Computer & Network Security Courseware. (Winter 2006). Lecture 10: SSH

Slides 14 & 18. The lecture notes explicitly list the authentication methods for each protocol version. Slide 14 lists "Rhosts

" "TIS

" and "Kerberos" for SSHv1. Slide 18 lists the SSHv2 methods

which do not include these

instead showing their replacements like "Hostbased" and "Challenge-response."

Source: https://www.eecs.umich.edu/courses/eecs588/static/lectures/10-SSH.pdf

2. OpenBSD. (2023). sshdconfig(5) Manual Page. As the official vendor documentation for OpenSSH

the most widely used SSH implementation

this manual explicitly states that certain authentication options are for SSH-1 only.

Regarding RhostsAuthentication: "This option is for ssh version 1 only."

Regarding KerberosAuthentication: "Specifies whether Kerberos authentication is allowed. This option is for ssh version 1 only."

Source: https://man.openbsd.org/sshdconfig.5

3. IETF RFC 4252: The Secure Shell (SSH) Authentication Protocol. (January 2006). This official standard for SSH-2 authentication specifies the valid methods. Section 7

"Authentication Method Names

" lists publickey

password

and hostbased as the primary methods. The absence of rhosts

tis

and a specific kerberos method from the core protocol specification confirms they are not part of the SSH-2 standard.

Source: https://doi.org/10.17487/RFC4252

The Open Systems Interconnection (OSI) model is a conceptual framework that standardizes the functions of a telecommunication or computing system into seven distinct abstraction layers. The correct sequence, starting from the lowest layer (Layer 1) which deals with the physical hardware, to the highest layer (Layer 7) which interacts with the user application, is: Physical, Data Link, Network, Transport, Session, Presentation, and Application. This order ensures a structured flow of data, where each layer serves the layer above it and is served by the layer below it. Option D correctly lists these seven layers in ascending order.

A. This option incorrectly swaps the Session and Presentation layers. The Session layer (Layer 5) must precede the Presentation layer (Layer 6).

B. This option incorrectly orders the lower layers. The Data Link layer (Layer 2) should come before the Network layer (Layer 3).

C. This option, when read from top to bottom, incorrectly orders the middle layers. The Session layer (Layer 5) should precede the Transport layer (Layer 4).

1. International Organization for Standardization. (1994). ISO/IEC 7498-1:1994 Information technology — Open Systems Interconnection — Basic Reference Model: The Basic Model. Section 7

"Detailed description of the seven layers of the OSI Reference Model

" explicitly lists the layers in the following order: Physical

Data-Link

Network

Transport

Session

Presentation

and Application.

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 1

Section 1.5.2

"The OSI Model

" the text describes the seven-layer model

stating

"The seven layers of the OSI reference model are: application layer

presentation layer

session layer

transport layer

network layer

data link layer

and physical layer." This lists the layers from top to bottom

which corresponds to the bottom-to-top order presented in the correct answer.

3. Stallings

W. (2016). Foundations of Modern Networking: SDN

NFV

and Cloud Computing. Addison-Wesley Professional. Chapter 2

Section 2.1

"The OSI Model

" presents a table (Table 2.1) and a figure (Figure 2.2) that clearly illustrate the seven layers in the correct sequence: Physical

Data Link

Network

Transport

Session

Presentation

Application.

The critical factor in the scenario is the room's environment: "totally in darkness." A photoelectric motion detector is an active sensor that operates by transmitting a beam of light, typically infrared (IR), from an emitter to a receiver. An alarm is triggered when an object passes through and interrupts the beam. Because this device generates its own light source (the IR beam), its functionality is completely independent of ambient light conditions, making it the most suitable and effective choice for a completely dark room.

B. Badge: A badge is an authentication token for an access control system to permit or deny entry; it does not detect unauthorized presence within the room.

C. Closed-circuit television: A standard CCTV camera requires visible light to capture an image and would be useless in total darkness unless it is a specialized thermal or infrared camera with an IR illuminator.

D. Alarm: An alarm is an annunciation device (e.g., a siren or light) that signals a security breach; it is not a sensor and requires a trigger from a separate detection device.

1. U.S. Army Corps of Engineers. (2020). Unified Facilities Criteria (UFC) 4-021-02: Electronic Security Systems.

Page 3-6

Section 3-4.2.2

Infrared Photoelectric Sensors: This section describes photoelectric sensors as "active sensors [that] project a narrow beam of pulsed infrared energy from a transmitter to a receiver." This active projection principle confirms its operational capability in complete darkness.

Page 3-11

Section 3-5.1

Closed Circuit Television (CCTV): This section discusses camera performance relative to light

stating

"The ability of a camera to produce a usable video image is dependent on the amount of light reflected from the scene..." It further details the need for supplemental lighting (visible or IR) for low-light conditions

confirming a standard camera's ineffectiveness in darkness.

Page 3-2

Section 3-2

Intrusion Detection System (IDS) Components: This section distinguishes between sensors (detection)

control units (processing)

and annunciation devices (alarms)

clarifying that an alarm is a separate component from a detector.

2. Garcia

M. L. (2007). The Design and Evaluation of Physical Protection Systems (2nd ed.). Butterworth-Heinemann.

Chapter 5

Intrusion Sensing: This chapter details various sensor technologies. It explains that active infrared sensors (photoelectric beams) are effective because they create their own "monitored energy

" making them independent of environmental lighting. In contrast

it notes that standard CCTV is a passive sensor that relies on available scene illumination.

3. Sennewald

C. A.

& Baillie

C. (2015). Effective Security Management (6th ed.). Butterworth-Heinemann.

Chapter 11

The Alarm System: This chapter explains the fundamental components of an alarm system

consistently identifying three parts: the sensor (detector)

the control panel (circuit)

and the annunciator (alarm/notification). This supports the reasoning that an "alarm" by itself is not a complete or functional security device for detection.

A directory service is a software system that stores, organizes, and provides access to information in a computer network's directory. Its primary function is to act as a central repository for information about network resources, including users, groups, computers, printers, and shared folders. It provides a structured, hierarchical view of this information and includes services for locating resources and managing access control. Administrators use the directory service to centrally manage user authentication and authorization, thereby controlling access to all integrated network resources. Prominent examples include Microsoft's Active Directory and services based on the Lightweight Directory Access Protocol (LDAP).

A. SMTP service: This is the Simple Mail Transfer Protocol, used exclusively for sending and receiving electronic mail, not for general network resource and user management.

B. Terminal service: Now known as Remote Desktop Services, it provides users with remote access to a server's graphical desktop and applications, not a centralized directory.

D. DFS service: The Distributed File System simplifies access to file shares across a network by creating a single logical namespace but does not manage users or other resources.

1. Microsoft Corporation. (2021). Active Directory Domain Services Overview. Microsoft Docs. Retrieved from docs.microsoft.com. In the "What is Active Directory Domain Services?" section

it states

"AD DS stores directory data and manages communication between users and domains

including user logon processes

authentication

and directory searches."

2. Zeilenga

K. (2006). RFC 4510: Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map. IETF. Section 1

Introduction

describes a directory as a "specialized database" that is "optimized for reading

browsing

and searching" and that LDAP is a protocol for accessing these "directory services."

3. Satyanarayanan

M. (2001). Pervasive Computing: Vision and Challenges. IEEE Personal Communications

8(4)

10-17. https://doi.org/10.1109/98.943998. The paper discusses the role of directory services (p. 14) as essential infrastructure for locating users

data

and services in a distributed environment

highlighting their role in resource management.

4. Patterson

D. A.

& Hennessy

J. L. (2011). Computer Organization and Design: The Hardware/Software Interface. Morgan Kaufmann. In discussions on distributed systems

directory services are defined as systems that "provide names for resources and a way to find them

" which is central to managing users and their access. (Refer to sections on Naming in Distributed Systems).

Service-oriented logical design modeling is the phase in the Service-Oriented Architecture (SOA) lifecycle where abstract business requirements are translated into a detailed, technology-agnostic blueprint for services. This activity explicitly defines the service contracts (interfaces), message structures (data exchange formats), and interaction protocols. By defining these elements, this phase formally establishes the functional relationships between services and the specific paths through which they will exchange messages to fulfill their roles within the architecture. It is the crucial step that bridges high-level conceptual models with the concrete details needed for implementation.

B. Service-oriented conceptual architecture modeling: This is a high-level, strategic phase that defines the overall vision, principles, and major components of the SOA, not the detailed interaction paths between specific services.

C. Service-oriented discovery and analysis modeling: This is an earlier phase focused on identifying and analyzing business processes to discover candidate services. It determines what services are needed, not how they interact.

D. Service-oriented business integration modeling: This phase focuses on composing and orchestrating already designed services to implement end-to-end business processes, which occurs after the fundamental relationships and paths have been established.

1. Papazoglou

M. P.

& van den Heuvel

W. J. (2007). Service-oriented architectures: approaches

technologies and research issues. The VLDB Journal

16(3)

389-415. In Section 3

"The SOA life-cycle

" the authors describe the "service design" phase

which follows analysis and involves specifying service interfaces

data types

and interaction patterns

directly corresponding to establishing relationships and message paths. (DOI: https://doi.org/10.1007/s00778-007-0044-3)

2. Erl

T. (2008). SOA: Principles of Service Design. Prentice Hall. While a commercial book

its principles are foundational and widely cited in academic contexts. Chapter 3

"Service-Oriented Analysis and Design

" distinguishes between analysis (discovery) and the logical design phase where service contracts and compositions are formally modeled. This modeling explicitly defines service relationships.

3. Lewis

G. A.

Smith

D. B.

& Kontogiannis

K. (2007). A Research Agenda for Service-Oriented Architecture (SOA): A European Perspective (CMU/SEI-2007-TR-004). Carnegie Mellon University

Software Engineering Institute. Section 2.2

"Service Development

" outlines the lifecycle

where the design phase is responsible for specifying service interfaces

behavior

and interaction protocols

which are the core components of service relationships and message paths.

4. The Open Group. (2011). The SOA Source Book. Van Haren Publishing. Chapter 4

"SOA Reference Architecture

" particularly Section 4.5.3

"Interaction Layer

" describes the logical components and protocols that govern message exchange and service interaction

which are defined during the logical design phase of the architecture lifecycle.

Based on the standard incident handling lifecycle, such as the one defined in NIST SP 800-61, the phases following Identification are Containment, Eradication, and Recovery. In this scenario:

Containment (represented by the non-standard term 'Contamination') is the immediate step to limit the damage, such as by implementing temporary filters or blocking the source of the spam.

Eradication involves removing the root cause of the incident, which means fixing the vulnerability in the public relations e-mail process that allows spammers to exploit it.

Recovery is the final step in the resolution, where the corrected e-mail process is restored to full, secure operation and monitored to ensure the solution is effective.

A. Identification: This phase is largely complete, as the problem has already been discovered. The question asks for the subsequent phases involved in resolving the issue.

E. Preparation: This phase occurs before an incident is detected. It involves establishing the policies, procedures, and tools for incident handling, not responding to an active incident.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). Section 3.2

"Incident Response Lifecycle

" Figure 3-1

and Section 3.3

"Containment

Eradication

and Recovery

" pp. 23-29. This document outlines the standard phases

detailing that after Detection and Analysis (Identification)

the team moves to Containment

Eradication

and Recovery to resolve the incident.

2. University of Illinois at Urbana-Champaign. (2020). CS 461 / ECE 422: Computer Security I

Lecture 22: Incident Response. Slide 10

"NIST Incident Response Lifecycle." The courseware presents the NIST model

showing that Containment

Eradication

& Recovery are the core phases for handling an identified incident before post-incident activities.

3. Carnegie Mellon University Software Engineering Institute. (2017). Best Practice for Network Incident Response. Section "The Incident Response Process

" pp. 4-5. This guide describes the incident response process

which includes the critical steps of containing the incident

eradicating the cause

and recovering normal operations.