Discuss ISC2 SSCP Exam Topic 1 Question 93

Which of the following is less likely to accompany a contingency plan, either within the plan itself or in the form of an appendix?

AContact information for all personnel.

BVendor contact information, including offsite storage and alternate site.

CEquipment and system requirements lists of the hardware, software, firmware and other resources required to support system operations.

DThe Business Impact Analysis.

Suggested Answer: B

Instead of using a Certificate Authority, PGP uses a 'Web of Trust', where users can certify each other in a mesh model, which is best applied to smaller groups.

In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP compatible systems to establish the authenticity of the binding between a public key and its owner. Its decentralized trust model is an alternative to the centralized trust model of a public key infrastructure (PKI), which relies exclusively on a certificate authority (or a hierarchy of such). The web of trust concept was first put forth by PGP creator Phil Zimmermann in 1992 in the manual for PGP version 2.0.

Pretty Good Privacy (PGP) is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications. It was created by Phil Zimmermann in 1991.

As per Shon Harris's book:

Pretty Good Privacy (PGP) was designed by Phil Zimmerman as a freeware e-mail security program and was released in 1991. It was the first widespread public key encryption program. PGP is a complete cryptosystem that uses cryptographic protection to protect e-mail and files. It can use RSA public key encryption for key management and use IDEA symmetric cipher for bulk encryption of data, although the user has the option of picking different types of algorithms for these functions. PGP can provide confidentiality by using the IDEA encryption algorithm, integrity by using the MD5 hashing algorithm, authentication by using the public key certificates, and nonrepudiation by using cryptographically signed messages. PGP initially used its own type of digital certificates rather than what is used in PKI, but they both have similar purposes. Today PGP support X.509 V3 digital certificates.

Reference(s) used for this question:

KRUTZ,

Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 169).

Shon Harris, CISSP All in One book

https://en.wikipedia.org/wiki/Pretty_Good_Privacy

TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

Get Premium SSCP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Ronny 10 months ago

Not sure why anyone would skip the Business Impact Analysis.

Teddy 11 months ago

Surprised that some might leave out vendor contacts!

Julio 11 months ago

Equipment lists are usually included, right?

Roselle 11 months ago

I think the Business Impact Analysis is crucial too.

Jacqueline 11 months ago

Definitely need contact info for personnel in a plan.

Jill 12 months ago

I vaguely recall that vendor contacts are crucial for recovery, so I’m leaning towards A or D being the right answer.

Sabina 12 months ago

I practiced a similar question where equipment requirements were essential, so I think C might be less likely too.

Tommy 12 months ago

I’m not sure, but I feel like the Business Impact Analysis is pretty important and would definitely be part of the plan, so maybe D?

Dudley 1 year ago

I remember we discussed that contact information is usually included in contingency plans, so I think A is less likely.

Stanton 1 year ago

I feel pretty confident about this one. The Business Impact Analysis is a core part of the contingency planning process, so that's definitely going to be included, either in the plan itself or as an appendix. I think the other options are all pretty essential, so I'll go with D.

Camellia 1 year ago

Okay, let's see here. The contingency plan needs to have all the key information to keep the business running in an emergency, so I'm guessing the contact information and vendor details would be more essential. Maybe the equipment and system requirements would be a bit less likely to be a separate appendix? I'll go with C on this one.

Corrie 1 year ago

This question seems straightforward. I think the Business Impact Analysis is the most likely to be included in a contingency plan, so I'll go with D.

Krystal 1 year ago

Hmm, I'm a bit unsure about this one. I know the contingency plan needs to have a lot of detailed information, but I'm not sure which of these would be less likely to be included. I might have to think this through a bit more.

Sylvie 1 year ago

Hmm, I'm not totally sure about this one. I know Lister was an important figure in medicine, but I can't remember the specifics of his work. I'll have to think this through carefully.

Nikita 1 year ago

I think the sales force input about customer plans might be crucial, especially for made-to-order products. They have direct insight into customer needs.

Pearlene 1 year ago

Okay, I think the key here is to verify the application is using the required client library and the service account has the proper permissions. That's where I'll focus my attention.

Buck 1 year ago

Vendor contact info? You mean I can't just call the pizza guy and ask him to set up the backup site?

Katina 1 year ago

The Business Impact Analysis? That's like the equivalent of forgetting to put the engine in your car. Rookie mistake.

Catalina 1 year ago

↳ replying to Katina

D) The Business Impact Analysis.

Yasuko 1 year ago

↳ replying to Katina

C) Equipment and system requirements lists of the hardware, software, firmware and other resources required to support system operations.

Julene 1 year ago

↳ replying to Katina

B) Vendor contact information, including offsite storage and alternate site.

Barbra 1 year ago

↳ replying to Katina

A) Contact information for all personnel.

Yun 1 year ago

Contact information for all personnel? That's just common sense, right? I mean, how else are you gonna coordinate the response?

Detra 1 year ago

Equipment and system requirements? That's like the backbone of the whole plan, no way that's the least likely to be included.

Noel 1 year ago

I think the vendor contact information is crucial for ensuring continuity, so that one seems the least likely to be left out.

Galen 1 year ago

↳ replying to Noel

C) Equipment and system requirements lists of the hardware, software, firmware and other resources required to support system operations.

Avery 1 year ago

↳ replying to Noel

B) Vendor contact information, including offsite storage and alternate site.

Kimbery 1 year ago

↳ replying to Noel

A) Contact information for all personnel.

Rodolfo 1 year ago

The Business Impact Analysis is the core of the contingency plan, so it's definitely not less likely to be included.

Lawrence 1 year ago

↳ replying to Rodolfo

B) Vendor contact information, including offsite storage and alternate site.

Lawrence 1 year ago

↳ replying to Rodolfo

A) Contact information for all personnel.

Alecia 2 years ago

I disagree. The Business Impact Analysis is crucial for understanding the impact of disruptions on the business.

Sylvia 2 years ago

I agree with Melissa. The Business Impact Analysis is more of a separate document.

Melissa 2 years ago

I think the Business Impact Analysis is less likely to accompany a contingency plan.

ISC2 SSCP Exam - Topic 1 Question 93 Discussion