CISSP Certification - The Ultimate Guide [Updated 2021]
CISSP Practice Exam and Study Guides - Verified By Test4Cram
Career Benefits
When you're CISSP certified, there are a lot of benefits you will receive. By creating new opportunities to excel in your security profession, your career will improve visibility, credibility, and job security. With your deep base of experience in cybersecurity and cloud computing, you can be a high-demand employee. Furthermore, you’ll become an (ISC)2 member and part of the worldwide technical community with many membership benefits once you obtain your CISSP. Besides, you can connect with the global community of cybersecurity leaders. Moreover, the average licensed CISSP salary in the USA is USD 135,510 as rendered by the vendor.
NEW QUESTION 144
Which Orange book security rating introduces the object reuse protection?
- A. C2
- B. B1
- C. B2
- D. C1
Answer: A
Explanation:
Explanation/Reference:
Explanation:
C2: Controlled Access Protection: Users need to be identified individually to provide more precise access control and auditing functionality. Logical access control mechanisms are used to enforce authentication and the uniqueness of each individual's identification. Security-relevant events are audited, and these records must be protected from unauthorized modification. The architecture must provide resource, or object, isolation so proper protection can be applied to the resource and any actions taken upon it can be properly audited. The object reuse concept must also be invoked, meaning that any medium holding data must not contain any remnants of information after it is released for another subject to use. If a subject uses a segment of memory, that memory space must not hold any information after the subject is done using it. The same is true for storage media, objects being populated, and temporary files being created-all data must be efficiently erased once the subject is done with that medium.
Incorrect Answers:
A: Object reuse protection is not required at level C1.
C: Object reuse protection is required at level B1; however, it was introduced at level C2.
D: Object reuse protection is required at level B2; however, it was introduced at level C2.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 392-395
NEW QUESTION 145
A software scanner identifies a region within a binary image having high entropy. What does this MOST likely indicate?
- A. Encryption routines
- B. Obfuscated code
- C. Random number generator
- D. Botnet command and control
Answer: B
NEW QUESTION 146
Drag the following Security Engineering terms on the left to the BEST definition on the right.
Answer:
Explanation:
Explanation
NEW QUESTION 147
Network Security is a
- A. ever evolving process
- B. Product
- C. protocols
- D. quick-fix solution
Answer: A
NEW QUESTION 148
Which of the following Kerberos components holds all users' and services' cryptographic keys?
- A. The Key Granting Service
- B. The Key Distribution Service
- C. The Authentication Service
- D. The Key Distribution Center
Answer: D
Explanation:
The Key Distribution Center (KDC) holds all users' and services' cryptographic keys.
It provides authentication services, as well as key distribution functionality. The Authentication
Service is the part of the KDC that authenticates a principal. The Key Distribution Service and Key
Granting Service are distracters and are not defined Kerberos components.
Source: WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#1 Access Control System &
Methodology (page 3), /Documents/CISSP_Summary_2002/index.html.
NEW QUESTION 149
What is the MOST important consideration from a data security perspective when an organization plans to relocate?
- A. Ensure the fire prevention and detection systems are sufficient to protect personnel
- B. Conduct a gap analysis of a new facilities against existing security requirements
- C. Revise the Disaster Recovery and Business Continuity (DR/BC) plan
- D. Review the architectural plans to determine how many emergency exits are present
Answer: B
NEW QUESTION 150
A security analyst asks you to look at the traffic he has gathered, and you find several Push flags within the capture. It seems the packets are sent to an unknown Internet Address (IP) that is not in your network from one of your own IP addresses which is a financial database that is critical and must remain up and running
24x7. This traffic was noticed in the middle of the day. What would be the best course of action to follow?
- A. Shut off the Port to the database and start conducting computer forensics
- B. Let the connection stay up because you do not want to disrupt availability
- C. Block the IP address at the perimeter and create a bit level copy of the database server. Run antivirus scan on the database and add to the IPS a rule to automatically block similar traffic.
- D. Contact the FBI or the US Secret Service to give guidance on what steps should be taken
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Block the IP address at the perimeter and create a bit level copy of the database server.
Run antivirus scan on the database and add a rule to the IPS to automatically block similar traffic. It would also be wise to add a rule on your perimeter gateway such as your firewall to block the suspected external IP address. The following answers are incorrect: Contact the FBI or the US Secret Service to give guidance on what steps should be taken? Before you scream that you are under attack, you must ensure that you are in fact under attack and some losses has been suffered. The law enforcement authority might not be interested in your case unless you have suffered losses. Let the connection stay up because you do not want to disrupt availability? Although Availability is a great concerned, you must take action to ensure that information is not at risk. Shut off the Port to the database and start conducting computer forensics?
Imposing a total shutdown on a critical database might cause more issue. You are not even sure what the problem is at this stage. A series of PUSH flag indicates a transfer of data which might or might not be malicious.
References: Experience working with indecent investigation. The book "Computer Forensics and Investigation" by Thompson Learning.
NEW QUESTION 151
Which of the following is a type of mandatory access control?
- A. Lattice-based access control
- B. User-directed access control
- C. Rule-based access control
- D. Role-based access control
Answer: C
Explanation:
Reference: pg 46 Krutz: CISSP Prep Guide: Gold Edition
NEW QUESTION 152
What would be considered the biggest drawback of Host-based Intrusion Detection systems (HIDS)?
- A. It can be very invasive to the host operating system
- B. They have an increased level of visibility and control compared to NIDS
- C. Monitors all processes and activities on the host system only
- D. Virtually eliminates limits associated with encryption
Answer: A
Explanation:
The biggest drawback of HIDS, and the reason many organizations resist its use, is that it can be very invasive to the host operating system. HIDS must have the capability to monitor all processes and activities on the host system and this can sometimes interfere with normal system processing.
HIDS versus NIDS
A host-based IDS (HIDS) can be installed on individual workstations and/ or servers to watch for inappropriate or anomalous activity. HIDSs are usually used to make sure users do not delete system files, reconfigure important settings, or put the system at risk in any other way.
So, whereas the NIDS understands and monitors the network traffic, a HIDS's universe is limited to the computer itself. A HIDS does not understand or review network traffic, and a NIDS does not
"look in" and monitor a system's activity. Each has its own job and stays out of the other's way.
The ISC2 official study book defines an IDS as:
An intrusion detection system (IDS) is a technology that alerts organizations to adverse or
unwanted activity. An IDS can be implemented as part of a network device, such as a router,
switch, or firewall, or it can be a dedicated IDS device monitoring traffic as it traverses the network.
When used in this way, it is referred to as a network IDS, or NIDS. IDS can also be used on
individual host systems to monitor and report on file, disk, and process activity on that host. When
used in this way it is referred to as a host-based IDS, or HIDS.
An IDS is informative by nature and provides real-time information when suspicious activities are
identified. It is primarily a detective device and, acting in this traditional role, is not used to directly
prevent the suspected attack.
What about IPS?
In contrast, an intrusion prevention system (IPS), is a technology that monitors activity like an IDS
but will automatically take proactive preventative action if it detects unacceptable activity. An IPS
permits a predetermined set of functions and actions to occur on a network or system; anything
that is not permitted is considered unwanted activity and blocked. IPS is engineered specifically to
respond in real time to an event at the system or network layer. By proactively enforcing policy,
IPS can thwart not only attackers, but also authorized users attempting to perform an action that is
not within policy. Fundamentally, IPS is considered an access control and policy enforcement
technology, whereas IDS is considered network monitoring and audit technology.
The following answers were incorrect:
All of the other answer were advantages and not drawback of using HIDS
TIP FOR THE EXAM:
Be familiar with the differences that exists between an HIDS, NIDS, and IPS. Know that IDS's are
mostly detective but IPS are preventive. IPS's are considered an access control and policy
enforcement technology, whereas IDS's are considered network monitoring and audit technology.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 5817-
5822). McGraw-Hill. Kindle Edition.
and
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Access
Control ((ISC)2 Press), Domain1, Page 180-188 or on the kindle version look for Kindle Locations
3199-3203 Auerbach Publications.
NEW QUESTION 153
Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?
- A. Secure Hash Algorithm 2(SHA-2)
- B. Message Digest 5 (MD5)
- C. Advanced Encryption Standard (AES)
- D. Triple Data Encryption Standard (3DES)
Answer: C
Explanation:
Section: Asset Security
NEW QUESTION 154
In 1996, the World Intellectual Property Organization (WIPO) sponsored
a treaty under which participating countries would standardize treatment
of digital copyrights. One of the items of standardization was the
prohibition of altering copyright management information (CMI) that is
included with the copyrighted material. CMI is:
- A. Product description information
- B. Licensing and ownership information
- C. A listing of Public keys
- D. An encryption algorithm
Answer: B
Explanation:
The other answers are distracters. The WIPO digital copyright legislation that resulted in the US was the 1998 Digital Millennium Copyright Act (DMCA). In addition to addressing answer d, the DMCAprohibits trading, manufacturing, or selling in any way that is intended to bypass copyright protection mechanisms. It also addresses Internet Service Providers (ISPs) that unknowingly support the posting of copyrighted material by subscribers. If the ISP is notified that the material is copyrighted, the ISP must remove the material. Additionally, if the posting party proves that the removed material was of lawful use, the ISP must restore the material and notify the copyright owner within 14 business days. Two important rulings regarding the DMCA were made in 2001. The rulings involved DeCSS, which is a program that bypasses the Content Scrambling System (CSS) software used to prevent viewing of DVD movie disks on unlicensed platforms. In a trade secrecy case [DVD-CCA v. Banner], the California Appellate Court overturned a lower court ruling that an individual who posted DeCSS on the Internet had revealed the trade secret of CSS. The appeals court has reversed an injunction on the posting of DeCSS, stating that the code is speech-protected by the First Amendment. The second case [Universal City v. Reimerdes] was the first constitutional challenge to DMCA anti-circumvention rules. The case involved Eric Corley, the publisher of the hacker magazine 2600 MagazinE. Corley was covering the DeCSS situation and, as part of that coverage, posted DeCSS on his publications Web site. The trial and appellate courts both ruled that the posting violated the DMCA and was, therefore, illegal. This ruling upheld the DMCA. It appears that there will be more challenges to DMCA in the future.
NEW QUESTION 155
Which RAID Level often implements a one-for-one disk to disk ratio?
- A. RAID Level 0
- B. RAID Level 5
- C. RAID Level 1
- D. RAID Level 2
Answer: C
Explanation:
Explanation/Reference:
Explanation:
RAID Level 1, disk mirroring, uses a one-for-one setup, where data are written to two drives at once. If one drive fails, the other drive has the exact same data available.
Incorrect Answers:
B: RAID Level 0 uses data striped over several drives, not just two drives. There is not one-to-one disk ratio.
C: RAID Level 2 uses data striped over several drives, not just two drives. There is not one-to-one disk ratio.
D: RAID Level 5 does not use a one-to-one disk ratio.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1270
NEW QUESTION 156
Which of the following cannot be undertaken in conjunction or while computer incident handling is ongoing?
- A. System Imaging
- B. System development activity
- C. Help-desk function
- D. Risk management process
Answer: B
Explanation:
If Incident Handling is underway an incident has potentially been identified. At that point all use of the system should stop because the system can no longer be trusted and any changes could contaminate the evidence. This would include all System Development Activity.
Every organization should have plans and procedures in place that deals with Incident Handling.
Employees should be instructed what steps are to be taken as soon as an incident occurs and how to report it. It is important that all parties involved are aware of these steps to protect not only any possible evidence but also to prevent any additional harm.
It is quite possible that the fraudster has planted malicous code that could cause destruction or even a Trojan Horse with a back door into the system. As soon as an incident has been identified the system can no longer be trusted and all use of the system should cease.
Shon Harris in her latest book mentions: Although we commonly use the terms "event" and "incident" interchangeably, there are subtle differences between the two. An event is a negative occurrence that can be observed, verified, and documented, whereas an incident is a series of events that negatively affects the company and/ or impacts its security posture. This is why we call reacting to these issues "incident response" (or "incident handling"), because something is negatively affecting the company and causing a security breach.
Many types of incidents (virus, insider attack, terrorist attacks, and so on) exist, and sometimes it is just human error. Indeed, many incident response individuals have received a frantic call in the middle of the night because a system is acting "weird." The reasons could be that a deployed patch broke something, someone misconfigured a device, or the administrator just learned a new scripting language and rolled out some code that caused mayhem and confusion.
When a company endures a computer crime, it should leave the environment and evidence unaltered and contact whomever has been delegated to investigate these types of situations. Someone who is unfamiliar with the proper process of collecting data and evidence from a crime scene could instead destroy that evidence, and thus all hope of prosecuting individuals, and achieving a conviction would be lost.
Companies should have procedures for many issues in computer security such as enforcement procedures, disaster recovery and continuity procedures, and backup procedures. It is also necessary to have a procedure for dealing with computer incidents because they have become an increasingly important issue of today's information security departments. This is a direct result of attacks against networks and information systems increasing annually. Even though we don't have specific numbers due to a lack of universal reporting and reporting in general, it is clear that the volume of attacks is increasing.
Just think about all the spam, phishing scams, malware, distributed denial-of-service, and other attacks you see on your own network and hear about in the news. Unfortunately, many companies are at a loss as to who to call or what to do right after they have been the victim of a cybercrime. Therefore, all companies should have an incident response policy that indicates who has the authority to initiate an incident response, with supporting procedures set up before an incident takes place.
This policy should be managed by the legal department and security department. They need to work together to make sure the technical security issues are covered and the legal issues that surround criminal activities are properly dealt with. The incident response policy should be clear and concise. For example, it should indicate if systems can be taken offline to try to save evidence or if systems have to continue functioning at the risk of destroying evidence. Each system and functionality should have a priority assigned to it. For instance, if the file server is infected, it should be removed from the network, but not shut down. However, if the mail server is infected, it should not be removed from the network or shut down because of the priority the company attributes to the mail server over the file server. Tradeoffs and decisions will have to be made, but it is better to think through these issues before the situation occurs, because better logic is usually possible before a crisis, when there's less emotion and chaos.
The Australian Computer Emergency Response Team's General Guidelines for Computer Forensics:
Keep the handling and corruption of original data to a minimum.
Document all actions and explain changes.
Follow the Five Rules for Evidence (Admissible, Authentic, Complete, Accurate, Convincing).
Bring in more experienced help when handling and/ or analyzing the evidence is beyond your knowledge, skills, or abilities.
Adhere to your organization's security policy and obtain written permission to conduct a forensics investigation.
Capture as accurate an image of the system( s) as possible while working quickly.
Be ready to testify in a court of law.
Make certain your actions are repeatable.
Prioritize your actions, beginning with volatile and proceeding to persistent evidence.
Do not run any programs on the system( s) that are potential evidence.
Act ethically and in good faith while conducting a forensics investigation, and do not attempt to do any harm.
The following answers are incorrect: help-desk function. Is incorrect because during an incident, employees need to be able to communicate with a central source. It is most likely that would be the help-desk. Also the help-desk would need to be able to communicate with the employees to keep them informed.
system imaging. Is incorrect because once an incident has occured you should perform a capture of evidence starting with the most volatile data and imaging would be doen using bit for bit copy of storage medias to protect the evidence.
risk management process. Is incorrect because incident handling is part of risk management, and should continue.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 2146821476). McGraw-Hill. Kindle Edition. and Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 2109621121). McGraw-Hill. Kindle Edition. and NIST Computer Security incident handling http://csrc.nist.gov/publications/nistpubs/800-12/80012-html/chapter12.html
NEW QUESTION 157
Which of the following encryption algorithms does not deal with discrete logarithms?
- A. RSA
- B. Diffie-Hellman
- C. Elliptic Curve
- D. El Gamal
Answer: A
Explanation:
Reference: pg 416 Hansche: Official (ISC)2 Guide to the CISSP Exam
NEW QUESTION 158
Match the name of access control model with its associated restriction.
Drag each access control model to its appropriate restriction access on the right.
Answer:
Explanation:
NEW QUESTION 159
Which statement below is accurate about Evaluation Assurance Levels
(EALs) in the Common Criteria (CC)?
- A. A statement of intent to counter specified threats
- B. A security level equal to the security level of the objects to which the subject has both read and write access
- C. Requirements that specify the security behavior of an IT product or system
- D. Predefined packages of assurance components that make up security confidence rating scale
Answer: D
Explanation:
An Evaluation Assurance Level (EAL) is one of seven increasingly
rigorous packages of assurance requirements from CC Part 3. Each
numbered package represents a point on the CCs predefined assurance
scalE. An EAL can be considered a level of confidence in the security
functions of an IT product or system. The EALs have been developed
with the goal of preserving the concepts of assurance drawn from the
source criteria, such as the Trusted Computer System Evaluation
Criteria (TCSEC), Information Technology Security Evaluation Criteria
(ITSEC), or Canadian Trusted Computer Evaluation Criteria (CTCPEC),
so that results of previous evaluations remain relevant. EAL levels 2O7 are generally equivalent to the assurance portions of the TCSEC C2-A1 scale, although exact TCSEC mappings do not exist.
*Answer "A security level equal to the security level of the objects to which the subject has both read and write access" is the definition of Subject Security Level. Asubjects security level is equal to the security level of the objects to which it has both read and write access. A subjects security level must always be dominated by the clearance of the user with which the subject is associated.
* Answer "A statement of intent to counter specified threats" describes a Security
Objective, which is a statement of
intent to counter specified threats and/or satisfy specified organizational security policies and assumptions.
*Answer "Requirements that specify the security behavior of an IT product or system" describes Security Functional Requirements. These are requirements, preferably from CC Part 2, that when taken together
specify the security behavior of an IT product or system.
Source: CC Project and DoD 5200.28-STD.
NEW QUESTION 160
What should happen when an emergency change to a system must be performed?
- A. The change must be given priority at the next meeting of the change control board.
- B. The change must be performed immediately and then submitted to the change board.
- C. The change is performed and a notation is made in the system log.
- D. Testing and approvals must be performed quickly.
Answer: D
NEW QUESTION 161
......
What is the duration, language, and format of CISSP test: Certified Information Systems Security Professional
- Passing Score: 70%
- Length of Examination: 120 minutes
- Number of Questions: 60
- Type of Questions: Single and Multiple Choice.
- Language: English
Ultimate Guide to the CISSP - Latest Edition Available Now: https://www.test4cram.com/CISSP_real-exam-dumps.html
2021 Updated Verified Pass CISSP Study Guides & Best Courses: https://drive.google.com/open?id=1-gAyTOyP7jIa567-m7DoQ3QJFzxZ6muD