Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.
exam questions

Exam SSCP All Questions

View all questions & answers for the SSCP exam

Exam SSCP topic 1 question 41 discussion

Actual exam question from ISC's SSCP
Question #: 41
Topic #: 1
[All SSCP Questions]

Which of the following is NOT a technique used to perform a penetration test?

  • A. traffic padding
  • B. scanning and probing
  • C. war dialing
  • D. sniffing
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
Traffic padding is a countermeasure to traffic analysis.
Even if perfect cryptographic routines are used, the attacker can gain knowledge of the amount of traffic that was generated. The attacker might not know what
Alice and Bob were talking about, but can know that they were talking and how much they talked. In certain circumstances this can be very bad. Consider for example when a military is organising a secret attack against another nation: it may suffice to alert the other nation for them to know merely that there is a lot of secret activity going on.
As another example, when encrypting Voice Over IP streams that use variable bit rate encoding, the number of bits per unit of time is not obscured, and this can be exploited to guess spoken phrases.
Padding messages is a way to make it harder to do traffic analysis. Normally, a number of random bits are appended to the end of the message with an indication at the end how much this random data is. The randomness should have a minimum value of 0, a maximum number of N and an even distribution between the two extremes. Note, that increasing 0 does not help, only increasing N helps, though that also means that a lower percentage of the channel will be used to transmit real data. Also note, that since the cryptographic routine is assumed to be uncrackable (otherwise the padding length itself is crackable), it does not help to put the padding anywhere else, e.g. at the beginning, in the middle, or in a sporadic manner.
The other answers are all techniques used to do Penetration Testing.
References:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, pages 233, 238. and https://secure.wikimedia.org/wikipedia/en/wiki/Padding_%28cryptography%29#Traffic_analysis

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
mansour975
11 months, 2 weeks ago
Selected Answer: D
I think D :Sniffing
upvoted 1 times
...
jsingh26
1 year, 4 months ago
How is war dialing not the correct answer?
upvoted 1 times
Stevovo123
1 year, 2 months ago
Because war dialing is a technique used to find and identify vulnerable computer systems or networks by systematically dialing a range of phone numbers and listening for modem tones or responses. It was more commonly used in the past when many computer systems were connected to the internet via dial-up modems.
upvoted 2 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...