CISSP
Leading the way in IT testing and certification tools, www.testking.com
- 17 -
Answer: B
SSL comes in two strengths, 40-bit and 128-bit, which refer to the length of the "session key" generated by
every encrypted transaction. The longer the key, the more difficult it is to break the encryption code. Most
browsers support 40-bit SSL sessions, and the latest browsers, including Netscape Communicator 4.0,
enable users to encrypt transactions in 128-bit sessions - trillions of times stronger than 40-bit sessions.
http://wp.netscape.com/security/techbriefs/ssl.html
QUESTION NO: 36
What is the PRIMARY advantage of using a separate authentication server (e.g., Remote Access Dial-
In User System, Terminal Access Controller Access Control System) to authenticate dial-in users?
A. Single user logons are easier to manage and audit.
B. Each session has a unique (one-time) password assigned to it.
C. Audit and access information are not kept on the access server.
D. Call-back is very difficult to defeat.
Answer: C
TACACS integrates the authentication and authorization processes. XTACACS keeps the authentication,
authorization and accounting processes separate. TACACS+ improves XTACACS by adding two-factor
authentication. - Ed Tittle CISSP Study Guide (sybex) pg 745
QUESTION NO: 37
Which one of the following operations of a secure communication session cannot be protected?
A. Session initialization
B. Session support
C. Session termination
D. Session control
Answer: C
I did not find the answer to this question in any of the texts sources I read for the cissp. However, Network
Intrusion Detection (3
rd
edition) gives some hints. I am basing this off of the 3 way hand shake and looking
for the termination of the session and who does it. Was it a RESET or FIN in the packet. So based off this
concept I am concluding that Session Termination is really not controllable. Use your best judgment on this
question based off of experience and knowledge.
QUESTION NO: 38
Which one of the following is an example of electronic piggybacking?
A. Attaching to a communications line and substituting data.
B. Abruptly terminating a dial-up or direct-connect session.