100%合格率リアルSSCP試験成功を掴み取れ！[2024年09月]
ISC SSCPのPDF問題格別な練習System Security Certified Practitioner (SSCP)
System Security Certified Practitioner (SSCP) 認定試験は、システムセキュリティ分野の知識とスキルを証明したい IT 専門家を対象としています。この試験は、国際情報システムセキュリティ認証機構（(ISC)²）によって実施され、IT セキュリティ業界で最も信頼性の高い組織の1つです。アクセス制御、暗号化、リスク管理、脅威分析などのさまざまなトピックをカバーします。サイバーセキュリティの重要性が高まる中、SSCP 認定試験は、専門家がシステムとデータをセキュリティで保護する能力を示す優れた方法です。
ISC SSCP、またはシステムセキュリティ認定プラクティショナーは、ネットワークおよびシステムセキュリティに特化したITプロフェッショナル向けの認定プログラムです。この試験は、アクセスコントロール、暗号化、リスク管理などの分野での個人の知識とスキルをテストすることを目的としています。SSCP認定は、グローバルに認められており、情報セキュリティの分野でキャリアを進めたいプロフェッショナルにとって貴重な資格です。
質問 # 594
Which type of attack involves hijacking a session between a host and a target by predicting the target's choice of an initial TCP sequence number?
- A. IP spoofing attack
- B. TCP sequence number attack
- C. Smurf attack
- D. SYN flood attack
正解：B
解説：
A TCP sequence number attack exploits the communication session which was established between the target and the trusted host that initiated the session. It involves hijacking the session between the host and the target by predicting the target's choice of an initial TCP sequence number. An IP spoofing attack is used to convince a system that it is communication with a known entity that gives an intruder access. It involves modifying the source address of a packet for a trusted source's address. A SYN attack is when an attacker floods a system with connection requests but does not respond when the target system replies to those requests. A smurf attack occurs when an attacker sends a spoofed (IP spoofing) PING (ICMP ECHO) packet to the broadcast address of a large network (the bounce site). The modified packet containing the address of the target system, all devices on its local network respond with a ICMP REPLY to the target system, which is then saturated with those replies. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 77).
質問 # 595
Which of the following does NOT use token-passing?
- A. IEEE 802.3
- B. ARCnet
- C. FDDI
- D. Token-ring
正解：A
解説：
Section: Network and Telecommunications
Explanation/Reference:
IEEE 802.3 specifies the standard for Ethernet and uses CSMA/CD, not token-passing.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
104).
質問 # 596
Which of the following protocol was used by the INITIAL version of the Terminal Access Controller Access Control System TACACS for communication between clients and servers?
- A. SSL
- B. TCP
- C. SSH
- D. UDP
正解：D
解説：
The original TACACS, developed in the early ARPANet days, had very limited functionality and used the UDP transport. In the early 1990s, the protocol was extended to include additional functionality and the transport changed to TCP.
TACACS is defined in RFC 1492, and uses (either TCP or UDP) port 49 by default. TACACS allows a client to accept a username and password and send a query to a TACACS authentication server, sometimes called a TACACS daemon or simply TACACSD. TACACSD uses TCP and usually runs on port 49. It would determine whether to accept or deny the authentication request and send a response back.
TACACS+
TACACS+ and RADIUS have generally replaced TACACS and XTACACS in more recently built or updated networks. TACACS+ is an entirely new protocol and is not compatible with TACACS or XTACACS. TACACS+ uses the Transmission Control Protocol (TCP) and RADIUS uses the User Datagram Protocol (UDP). Since TCP is connection oriented protocol, TACACS+ does not have to implement transmission control. RADIUS, however, does have to detect and correct transmission errors like packet loss, timeout etc. since it rides on UDP which is connectionless.
RADIUS encrypts only the users' password as it travels from the RADIUS client to RADIUS server. All other information such as the username, authorization, accounting are transmitted in clear text. Therefore it is vulnerable to different types of attacks. TACACS+ encrypts all the information mentioned above and therefore does not have the vulnerabilities present in the RADIUS protocol.
RADIUS and TACACS + are client/ server protocols, which means the server portion cannot send unsolicited commands to the client portion. The server portion can only speak when spoken to.
Diameter is a peer-based protocol that allows either end to initiate communication. This functionality allows the Diameter server to send a message to the access server to request the user to provide another authentication credential if she is attempting to access a secure resource.
質問 # 597
Which of the following encryption algorithms does not deal with discrete logarithms?
- A. Elliptic Curve
- B. RSA
- C. Diffie-Hellman
- D. El Gamal
正解：B
解説：
Section: Cryptography
Explanation/Reference:
The security of the RSA system is based on the assumption that factoring the product into two original large prime numbers is difficult Source:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 159).
Shon Harris, CISSP All-in-One Examine Guide, Third Edition, McGraw-Hill Companies, August 2005, Chapter
8: Cryptography, Page 636 - 639
質問 # 598
Which type of attack involves hijacking a session between a host and a target by predicting the target's choice of an initial TCP sequence number?
- A. IP spoofing attack
- B. TCP sequence number attack
- C. Smurf attack
- D. SYN flood attack
正解：B
解説：
Section: Network and Telecommunications
Explanation/Reference:
A TCP sequence number attack exploits the communication session which was established between the target and the trusted host that initiated the session. It involves hijacking the session between the host and the target by predicting the target's choice of an initial TCP sequence number. An IP spoofing attack is used to convince a system that it is communication with a known entity that gives an intruder access. It involves modifying the source address of a packet for a trusted source's address. A SYN attack is when an attacker floods a system with connection requests but does not respond when the target system replies to those requests. A smurf attack occurs when an attacker sends a spoofed (IP spoofing) PING (ICMP ECHO) packet to the broadcast address of a large network (the bounce site). The modified packet containing the address of the target system, all devices on its local network respond with a ICMP REPLY to the target system, which is then saturated with those replies.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
77).
質問 # 599
Which of the following are suitable protocols for securing VPN connections at the lower layers of the OSI model?
- A. S/MIME and SSH
- B. IPsec and L2TP
- C. PKCS#10 and X.509
- D. TLS and SSL
正解：B
質問 # 600
Which of the following steps are involved in a basic risk assessment?
- A. None of the items listed
- B. Investigate potential legal, financial, and regulatory issues
- C. Determine what data and systems need to be protected
- D. All of the items listed
- E. Determine the chances of a disaster or risk related event occurring
- F. Evaluate who are the potential threats
正解：D
質問 # 601
Which of the following statements pertaining to ethical hacking is incorrect?
- A. Testing should be done remotely to simulate external threats.
- B. Ethical hacking should not involve writing to or modifying the target systems negatively.
- C. Ethical hackers never use tools that have the potential of affecting servers or services.
- D. An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/or networking services.
正解：C
解説：
Explanation/Reference:
This means that many of the tools used for ethical hacking have the potential of exploiting vulnerabilities and causing disruption to IT system. It is up to the individuals performing the tests to be familiar with their use and to make sure that no such disruption can happen or at least shoudl be avoided.
The first step before sending even one single packet to the target would be to have a signed agreement with clear rules of engagement and a signed contract. The signed contract explains to the client the associated risks and the client must agree to them before you even send one packet to the target range.
This way the client understand that some of the test could lead to interruption of service or even crash a server. The client signs that he is aware of such risks and willing to accept them.
The following are incorrect answers:
An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/or networking services. An ethical hacking firm's independence can be questioned if they sell security solutions at the same time as doing testing for the same client. There has to be independance between the judge (the tester) and the accuse (the client).
Testing should be done remotely to simulate external threats Testing simulating a cracker from the Internet is often time one of the first test being done, this is to validate perimeter security. By performing tests remotely, the ethical hacking firm emulates the hacker's approach more realistically.
Ethical hacking should not involve writing to or modifying the target systems negatively. Even though ethical hacking should not involve negligence in writing to or modifying the target systems or reducing its response time, comprehensive penetration testing has to be performed using the most complete tools available just like a real cracker would.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Appendix F: The Case for Ethical Hacking (page 520).
質問 # 602
AH - Authentication Header is used in what industry standard protocol?
- A. IPSEC - Internet Protocol Security
- B. ESP - Encapsulating Security payload
- C. ISAKMP - Internet Security Association and Key Management Protocol
- D. IKE - Internet Key Exchange
- E. SSL - Secure Sockets Layer
正解：A
質問 # 603
Computer security should be first and foremost which of the following:
- A. Be examined in both monetary and non-monetary terms.
- B. Cover all identified risks
- C. Be cost-effective.
- D. Be proportionate to the value of IT systems.
正解：C
解説：
Section: Risk, Response and Recovery
Explanation/Reference:
Computer security should be first and foremost cost-effective.
As for any organization, there is a need to measure their cost-effectiveness, to justify budget usage and provide supportive arguments for their next budget claim. But organizations often have difficulties to accurately measure the effectiveness and the cost of their information security activities.
The classical financial approach for ROI calculation is not particularly appropriate for measuring security-related initiatives: Security is not generally an investment that results in a profit. Security is more about loss prevention. In other terms, when you invest in security, you don't expect benefits; you expect to reduce the risks threatening your assets.
The concept of the ROI calculation applies to every investment. Security is no exception. Executive decision-makers want to know the impact security is having on the bottom line. In order to know how much they should spend on security, they need to know how much is the lack of security costing to the business and what are the most cost-effective solutions.
Applied to security, a Return On Security Investment (ROSI) calculation can provide quantitative answers to essential financial questions:
Is an organization paying too much for its security?
What financial impact on productivity could have lack of security?
When is the security investment enough?
Is this security product/organisation beneficial?
The following are other concerns about computer security but not the first and foremost:
The costs and benefits of security should be carefully examined in both monetary and non-monetary terms to ensure that the cost of controls does not exceed expected benefits.
Security should be appropriate and proportionate to the value of and degree of reliance on the IT systems and to the severity, probability, and extent of potential harm.
Requirements for security vary, depending upon the particular IT system. Therefore it does not make sense for computer security to cover all identified risks when the cost of the measures exceeds the value of the systems they are protecting.
Reference(s) used for this question:
SWANSON, Marianne & GUTTMAN, Barbara, National Institute of Standards and Technology (NIST), NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, September 1996 (page 6).
and
http://www.enisa.europa.eu/activities/cert/other-work/introduction-to-return-on-security-investment
質問 # 604
Which of the following questions are least likely to help in assessing controls covering audit trails?
- A. Does the audit trail provide a trace of user actions?
- B. Is access to online logs strictly controlled?
- C. Are incidents monitored and tracked until resolved?
- D. Is there separation of duties between security personnel who administer the access control function and those who administer the audit trail?
正解：C
解説：
Explanation/Reference:
Audit trails maintain a record of system activity by system or application processes and by user activity. In conjunction with appropriate tools and procedures, audit trails can provide individual accountability, a means to reconstruct events, detect intrusions, and identify problems. Audit trail controls are considered technical controls. Monitoring and tracking of incidents is more an operational control related to incident response capability.
Reference(s) used for this question:
SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-50 to A-51).
NOTE: NIST SP 800-26 has been superceded By: FIPS 200, SP 800-53, SP 800-53A You can find the new replacement at: http://csrc.nist.gov/publications/PubsSPs.html However, if you really wish to see the old standard, it is listed as an archived document at:
http://csrc.nist.gov/publications/PubsSPArch.html
質問 # 605
Which of the following statements is true about data encryption as a method of protecting data?
- A. It is usually easily administered
- B. It requires careful key management
- C. It should sometimes be used for password files
- D. It makes few demands on system resources
正解：B
解説：
In cryptography, you always assume the "bad guy" has the encryption algorithm (indeed, many algorithms such as DES, Triple DES, AES, etc. are public domain). What the bad guy lacks is the key used to complete that algorithm and encrypt/decrypt information. Therefore, protection of the key, controlled distribution, scheduled key change, timely destruction, and several other factors require careful consideration. All of these factors are covered under the umbrella term of "key management".
Another significant consideration is the case of "data encryption as a method of protecting data" as the question states. If that data is to be stored over a long period of time (such as on backup), you must ensure that your key management scheme stores old keys for as long as they will be needed to decrypt the information they encrypted.
The other answers are not correct because:
"It should sometimes be used for password files." - Encryption is often used to encrypt passwords stored within password files, but it is not typically effective for the password file itself. On most systems, if a user cannot access the contents of a password file, they cannot authenticate.
Encrypting the entire file prevents that access.
"It is usually easily administered." - Developments over the last several years have made cryptography significantly easier to manage and administer. But it remains a significant challenge.
This is not a good answer.
"It makes few demands on system resources." - Cryptography is, essentially, a large complex mathematical algorithm. In order to encrypt and decrypt information, the system must perform this algorithm hundreds, thousands, or even millions/billions/trillions of times. This becomes system resource intensive, making this a very bad answer.
質問 # 606
Controlling access to information systems and associated networks is necessary for the preservation of their:
- A. Authenticity, confidentiality and availability
- B. authenticity,confidentiality, integrity and availability.
- C. Confidentiality, integrity, and availability.
- D. integrity and availability.
正解：C
解説：
Explanation/Reference:
Controlling access to information systems and associated networks is necessary for the preservation of their confidentiality, integrity and availability.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 31.
質問 # 607
In what way could Java applets pose a security threat?
- A. Their transport can interrupt the secure distribution of World Wide Web pages over the Internet by removing SSL and S-HTTP
- B. Java interpreters do not provide the ability to limit system access that an applet could have on a client system.
- C. Executables from the Internet may attempt an intentional attack when they are downloaded on a client system.
- D. Java does not check the bytecode at runtime or provide other safety mechanisms for program isolation from the client system.
正解：C
解説：
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
Topic 3, Analysis and Monitoring
質問 # 608
A common way to create fault tolerance with leased lines is to group several T1s together with an inverse multiplexer placed:
- A. at one end of the connection.
- B. in the middle of the connection.
- C. at both ends of the connection.
- D. somewhere between both end points.
正解：C
解説：
Explanation/Reference:
A common way to create fault tolerance with leased lines is to group several T1s together with an inverse multiplexer placed at both ends of the connection.
In fact it would be a Multiplexer at one end and DeMultiplexer at other end or vice versa. Inverse Multiplexer at both end.
In electronics, a multiplexer (or mux) is a device that selects one of several analog or digital input signals and forwards the selected input into a single line. A multiplexer of 2n inputs has n select lines, which are used to select which input line to send to the output. Multiplexers are mainly used to increase the amount of data that can be sent over the network within a certain amount of time and bandwidth. A multiplexer is also called a data selector.
An electronic multiplexer makes it possible for several signals to share one device or resource, for example one A/D converter or one communication line, instead of having one device per input signal.
On the other hand, a demultiplexer (or demux) is a device taking a single input signal and selecting one of many data-output-lines, which is connected to the single input. A multiplexer is often used with a complementary demultiplexer on the receiving end.
An electronic multiplexer can be considered as a multiple-input, single-output switch, and a demultiplexer as a single-input, multiple-output switch
References:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 72.
and
https://secure.wikimedia.org/wikipedia/en/wiki/Multiplexer
質問 # 609
Which of the following is NOT a factor related to Access Control?
- A. integrity
- B. availability
- C. authenticity
- D. confidentiality
正解：C
解説：
Explanation/Reference:
These factors cover the integrity, confidentiality, and availability components of information system security.
Integrity is important in access control as it relates to ensuring only authorized subjects can make changes to objects.
Authenticity is different from authentication. Authenticity pertains to something being authentic, not necessarily having a direct correlation to access control.
Confidentiality is pertinent to access control in that the access to sensitive information is controlled to protect confidentiality.
vailability is protected by access controls in that if an attacket attempts to disrupt availability they would first need access.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 49.
質問 # 610
Who should measure the effectiveness of Information System security related controls in an organization?
- A. The central security manager
- B. The local security specialist
- C. The systems auditor
- D. The business manager
正解：C
解説：
It is the systems auditor that should lead the effort to ensure that the security controls are in place and effective. The audit would verify that the controls comply with polices, procedures, laws, and regulations where applicable. The findings would provide these to senior management.
The following answers are incorrect: the local security specialist. Is incorrect because an independent review should take place by a third party. The security specialist might offer mitigation strategies but it is the auditor that would ensure the effectiveness of the controls
the business manager. Is incorrect because the business manager would be responsible that the controls are in place, but it is the auditor that would ensure the effectiveness of the controls.
the central security manager. Is incorrect because the central security manager would be responsible for implementing the controls, but it is the auditor that is responsibe for ensuring their effectiveness.
質問 # 611
Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?
- A. Parallel testing
- B. Regression testing
- C. Pilot testing
- D. Unit testing
正解：B
解説：
Explanation/Reference:
Regression testing is the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be the same as the data used in the original test. Unit testing refers to the testing of an individual program or module. Pilot testing is a preliminary test that focuses only on specific and predetermined aspects of a system. Parallel testing is the process of feeding test data into two systems and comparing the results.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 300).
質問 # 612
Which of the following items is NOT a benefit of cold sites?
- A. A secondary location is available to reconstruct the environment
- B. Low Cost
- C. No resource contention with other organisation
- D. Quick Recovery
正解：D
解説：
Section: Risk, Response and Recovery
Explanation/Reference:
A cold site is a permanent location that provide you with your own space that you can move into in case of a disaster or catastrophe. It is one of the cheapest solution available as a rental place but it is also the one that would take the most time to recover. A cold site usually takes one to two weeks for recoverey.
Although major disruptions with long-term effects may be rare, they should be accounted for in the contingency plan. The plan should include a trategy to recover and perform system operations at an alternate facility for an extended period. In general, three types of alternate sites are available:
Dedicated site owned or operated by the organization. Also called redundant or alternate sites; Reciprocal agreement or memorandum of agreement with an internal or external entity; and Commercially leased facility.
Regardless of the type of alternate site chosen, the facility must be able to support system operations as defined in the contingency plan. The three alternate site types commonly categorized in terms of their operational readiness are cold sites, warm sites, or hot sites. Other variations or combinations of these can be found, but generally all variations retain similar core features found in one of these three site types.
Progressing from basic to advanced, the sites are described below:
Cold Sites are typically facilities with adequate space and infrastructure (electric power, telecommunications connections, and environmental controls) to support information system recovery activities.
ƒWarm Sites are partially equipped office spaces that contain some or all of the system hardware, software, telecommunications, and power sources.
Hot Sites are facilities appropriately sized to support system requirements and configured with the necessary system hardware, supporting infrastructure, and support personnel.
As discussed above, these three alternate site types are the most common. There are also variations, and hybrid mixtures of features from any one of the three. Each organization should evaluate its core requirements in order to establish the most effective solution.
Two examples of variations to the site types are:
ƒMobile Sites are self-contained, transportable shells custom-fitted with specific telecommunications and system equipment necessary to meet system requirements.
ƒMirrored Sites are fully redundant facilities with automated real-time information mirroring. Mirrored sites are identical to the primary site in all technical respects.
There are obvious cost and ready-time differences among the options. In these examples, the mirrored site is the most expensive choice, but it ensures virtually 100 percent availability. Cold sites are the least expensive to maintain, although they may require substantial time to acquire and install necessary equipment. Partially equipped sites, such as warm sites, fall in the middle of the spectrum. In many cases, mobile sites may be delivered to the desired location within 24 hours, but the time necessary for equipment installation and setup can increase this response time. The selection of fixed-site locations should account for the time and mode of transportation necessary to move personnel and/or equipment there. In addition, the fixed site should be in a geographic area that is unlikely to be negatively affected by the same hazard as the organization's primary site.
The following reference(s) were used for this question:
http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf
質問 # 613
Of the following, which is NOT a risk assessment system?
- A. Dollar-based OPSEC Risk Analysis (DORA)
- B. Analysis of Networked Systems Security Risks (ANSSR)
- C. Information Security Protection Assessment Model (ISPAM)
- D. Aggregated Countermeasures Effectiveness (ACE) Model
正解：C
質問 # 614
Which of the following describes a computer processing architecture in which a language compiler or pre- processor breaks program instructions down into basic operations that can be performed by the processor at the same time?
- A. Very-Long Instruction-Word Processor (VLIW)
- B. Super Scalar Processor Architecture (SCPA)
- C. Reduced-Instruction-Set-Computer (RISC)
- D. Complex-Instruction-Set-Computer (CISC)
正解：A
解説：
Section: Security Operation Adimnistration
Explanation/Reference:
Very long instruction word (VLIW) describes a computer processing architecture in which a language compiler or pre-processor breaks program instruction down into basic operations that can be performed by the processor in parallel (that is, at the same time). These operations are put into a very long instruction word which the processor can then take apart without further analysis, handing each operation to an appropriate functional unit.
The following answer are incorrect:
The term "CISC" (complex instruction set computer or computing) refers to computers designed with a full set of computer instructions that were intended to provide needed capabilities in the most efficient way. Later, it was discovered that, by reducing the full set to only the most frequently used instructions, the computer would get more work done in a shorter amount of time for most applications. Intel's Pentium microprocessors are CISC microprocessors.
The PowerPC microprocessor, used in IBM's RISC System/6000 workstation and Macintosh computers, is a RISC microprocessor. RISC takes each of the longer, more complex instructions from a CISC design and reduces it to multiple instructions that are shorter and faster to process. RISC technology has been a staple of mobile devices for decades, but it is now finally poised to take on a serious role in data center servers and server virtualization. The latest RISC processors support virtualization and will change the way computing resources scale to meet workload demands.
A superscalar CPU architecture implements a form of parallelism called instruction level parallelism within a single processor. It therefore allows faster CPU throughput than would otherwise be possible at a given clock rate. A superscalar processor executes more than one instruction during a clock cycle by simultaneously dispatching multiple instructions to redundant functional units on the processor. Each functional unit is not a separate CPU core but an execution resource within a single CPU such as an arithmetic logic unit, a bit shifter, or a multiplier.
Reference(s) Used for this question:
http://whatis.techtarget.com/definition/0,,sid9_gci214395,00.html
and
http://searchcio-midmarket.techtarget.com/definition/CISC
and
http://en.wikipedia.org/wiki/Superscalar
質問 # 615
......
SSCP認定試験は、アクセスコントロール、セキュリティオペレーションと管理、リスクの識別、モニタリングと分析、暗号化、ネットワークと通信セキュリティ、セキュリティ評価とテストの7つのセキュリティ運用と管理のドメインをカバーしています。この試験は、これらのドメインの1つまたは複数の経験を持つ専門家を対象としています。
SSCP問題集Fast2test100%合格率保証：https://jp.fast2test.com/SSCP-premium-file.html