Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

ISC2 SSCP Exam - Topic 4 Question 97 Discussion

Posted by Alonso on Jan 23, 2025 at 11:04 AM

In a SSL session between a client and a server, who is responsible for generating the master secret that will be used as a seed to generate the symmetric keys that will be used during the session?

Suggested Answer: C

A trojan horse is any code that appears to have some useful purpose but also contains code that has a malicious or harmful purpose imbedded in it. A Trojan often also includes a trapdoor as a means to gain access to a computer system bypassing security controls.

Wikipedia defines it as:

A Trojan horse, or Trojan, in computing is a non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. The term is derived from the story of the wooden horse used to trick defenders of Troy into taking concealed warriors into their city in ancient Greece, because computer Trojans often employ a form of social engineering, presenting themselves as routine, useful, or interesting in order to persuade victims to install them on their computers.

The following answers are incorrect:

virus. Is incorrect because a Virus is a malicious program and is does not appear to be harmless, it's sole purpose is malicious intent often doing damage to a system. A computer virus is a type of malware that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data files, or the boot sector of the hard drive; when this replication succeeds, the affected areas are then said to be 'infected'.

worm. Is incorrect because a Worm is similiar to a Virus but does not require user intervention to execute. Rather than doing damage to the system, worms tend to self-propagate and devour the resources of a system. A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Unlike a computer virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

trapdoor. Is incorrect because a trapdoor is a means to bypass security by hiding an entry point into a system. Trojan Horses often have a trapdoor imbedded in them.

References:

http://en.wikipedia.org/wiki/Trojan_horse_%28computing%29

and

http://en.wikipedia.org/wiki/Computer_virus

and

http://en.wikipedia.org/wiki/Computer_worm

and

http://en.wikipedia.org/wiki/Backdoor_%28computing%29


Get Premium SSCP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test
30 comments · newest first
SH
Sharen 10 months ago
The Certificate Server has nothing to do with the master secret!
EL
Elfrieda 11 months ago
Wait, are you sure? I always thought the server handled it alone.
MA
Matilda 11 months ago
I thought it was just the client’s browser that did it.
HA
Harrison 11 months ago
Totally agree, it's a collaborative process!
KE
Kenda 11 months ago
It's both the client and server that generate the master secret.
JU
Jutta 12 months ago
The merchant's Certificate Server seems like a distraction here; I don't think it generates the master secret at all.
FR
France 12 months ago
I feel like the web server has a significant part in the process, but I can't recall if it solely generates the master secret.
KR
Krystina 12 months ago
I remember practicing a question like this, and I think it was the client's browser that plays a key role in generating the master secret.
FR
Francesco 1 year ago
I think both the client and server generate the master secret together, but I'm not entirely sure.
DE
Delmy 1 year ago
I'm feeling confident about this one. The web server is responsible for generating the master secret that will be used to create the symmetric keys for the SSL session. The client doesn't directly generate the master secret.
IL
Iluminada 1 year ago
Okay, I remember learning about this in class. The client and server work together to generate the master secret, which is then used to derive the symmetric keys. I think the key is understanding the SSL handshake process.
TH
Thaddeus 1 year ago
Hmm, I'm a bit confused on this one. I know the client and server exchange information to establish the SSL session, but I can't recall who is responsible for the master secret. I'll have to think this through carefully.
RO
Rossana 1 year ago
I'm pretty sure the server is responsible for generating the master secret, but I'll double-check the details in my notes just to be sure.
TU
Tuyet 1 year ago
The master secret? More like the 'master of disguise' if you ask me. This exam is really keeping us on our toes!
NO
Norah 1 year ago
↳ replying to Tuyet
A) Both client and server
HA
Harrison 1 year ago
↳ replying to Tuyet
C) The web server
MI
Misty 1 year ago
↳ replying to Tuyet
A) Both client and server
DE
Demetra 1 year ago
The merchant's Certificate Server? Really? What is this, a magic show? I thought we were talking about a SSL session, not a circus act.
VA
Val 1 year ago
↳ replying to Demetra
A) Both client and server
LA
Laura 1 year ago
↳ replying to Demetra
C) The web server
AU
Audra 1 year ago
↳ replying to Demetra
A) Both client and server
KA
Kallie 1 year ago
The web server, of course! It's the one hosting the session, so it's gotta be in charge of the master secret. Duh!
BA
Barbra 1 year ago
The client's browser? So the server is just standing there twiddling its thumbs while the browser does all the work? I don't think so.
JE
Jesus 1 year ago
↳ replying to Barbra
A) Both client and server
VE
Vesta 1 year ago
↳ replying to Barbra
C) The web server
AL
Alyce 1 year ago
↳ replying to Barbra
A) Both client and server
DE
Dewitt 1 year ago
The client and server are both responsible for generating the master secret? That's like both players of a tennis match deciding where the ball should land - it just doesn't make sense!
BA
Barrie 2 years ago
I agree with Lorrie, it's both client and server because they both need to contribute to generate the master secret.
LO
Lorrie 2 years ago
I believe it's both the client and server.
LI
Lindsey 2 years ago
I think it's the web server.
0/2000 characters

Save Cancel