[Dec-2021] ISC Certification CISSP Exam Practice Dumps
2021 CISSP Premium Files Test pdf - Free Dumps Collection
Understanding specialized and utilitarian abilities of CISSP test: Certified Information Systems Security Professional
The accompanying will be examined in ISC CISSP dumps:
- Integrate Third-Party Identity Services
- Implement and Manage Authorization Mechanisms
- Securing Network Components
- Prevent or Mitigate Network Attacks
- Integrate Identity as a Service (IDaaS)
- Design and Establish Secure Communication Channels
- Apply Secure Design Principles to Network Architecture
- Manage the Identity and Access Provisioning Life Cycle
- Prevent or Mitigate Access Control Attacks
- Manage Identification and Authentication of People and Devices
- Identity and Access Management (Controlling Access and Managing Identity)
- Control Physical and Logical Access to Assets
Study Tips
Below are some helpful study tips you can refer to while preparing for the CISSP test:
- Get an in-depth & real-life experience that your job and your certification can apply to.
- Look at the security management prep exam questions to see what valuable knowledge you can collect.
- Take advantage of the most up-to-date security materials and online webinars focused on security operations and software development security.
- Seek guidance from security practitioners who have already earned certification for their CISSP skills.
- Attend online programs focused on the CISSP and best practices in security to increase your confidence in facing the real exam.
NEW QUESTION 459
Which of the following statements pertaining to quantitative risk analysis is false?
- A. Portion of it can be automated
- B. It requires little experience to apply
- C. It involves complex calculations
- D. It requires a high volume of information
Answer: B
Explanation:
Assigning the values for the inputs to a purely quantitative risk assessment requires both a lot of time and significant experience on the part of the assessors. The most experienced employees or representatives from each of the departments would be involved in the process. It is NOT an easy task if you wish to come up with accurate values.
"It can be automated" is incorrect. There are a number of tools on the market that automate the process of conducting a quantitative risk assessment.
"It involves complex calculations" is incorrect. The calculations are simple for basic scenarios but could become fairly complex for large cases. The formulas have to be applied correctly.
"It requires a high volume of information" is incorrect. Large amounts of information are required in order to develop reasonable and defensible values for the inputs to the quantitative risk assessment.
References:
CBK, pp. 60-61
AIO3, p. 73, 78
The Cissp Prep Guide - Mastering The Ten Domains Of Computer Security - 2001, page
24
NEW QUESTION 460
Who is accountable for the information within an Information System (IS)?
- A. Security manager
- B. Data processor
- C. Data owner
- D. System owner
Answer: D
NEW QUESTION 461
What setup should an administrator use for regularly testing the strength of user passwords?
- A. A networked workstation so the password database can easily be copied locally and processed by the cracking program.
- B. A networked workstation so that the live password database can easily be accessed by the cracking program.
- C. A standalone workstation on which the password database is copied and processed by the cracking program.
- D. A password-cracking program is unethical; therefore it should not be used.
Answer: C
Explanation:
Poor password selection is frequently a major security problem for any system's security. Administrators should obtain and use password-guessing programs frequently to identify those users having easily guessed passwords.
Because password-cracking programs are very CPU intensive and can slow the system on which it is running, it is a good idea to transfer the encrypted passwords to a standalone (not networked) workstation. Also, by doing the work on a non-networked machine, any results found will not be accessible by anyone unless they have physical access to that system.
Out of the four choice presented above this is the best choice.
However, in real life you would have strong password policies that enforce complexity requirements and does not let the user choose a simple or short password that can be easily cracked or guessed. That would be the best choice if it was one of the choice presented.
Another issue with password cracking is one of privacy. Many password cracking tools can avoid this by only showing the password was cracked and not showing what the password actually is. It is masking the password being used from the person doing the cracking.
Source: National Security Agency, Systems and Network Attack Center (SNAC), The 60 Minute Network Security Guide, February 2002, page 8.
NEW QUESTION 462
What control is based on a specific profile for each user?
- A. Lattice based access control.
- B. Rule based access control.
- C. Directory based access control.
- D. ID based access control.
Answer: D
Explanation:
The correct answer should be ID based access control. Rule based isn't necessarily identity based.
NEW QUESTION 463
Which choice below BEST describes the difference between the System
Owner and the Information Owner?
- A. The System Owner is responsible for establishing the rules for
appropriate use of the information. - B. One system could have multiple information owners.
- C. There is a one-to-one relationship between system owners and
information owners. - D. The Information Owner is responsible for defining the system's
operating parameters.
Answer: B
Explanation:
The System Owner is responsible for ensuring that the security
plan is prepared and for implementing the plan and monitoring its
effectiveness. The System Owner is responsible for defining the system's operating parameters, authorized functions, and security requirements. The information owner for information stored within,
processed by, or transmitted by a system may or may not be the same
as the System Owner. Also, a single system may utilize information
from multiple Information Owners.
The Information Owner is responsible for establishing the rules for
appropriate use and protection of the subject data/information (rules of behavior). The Information Owner retains that responsibility even when the data/information are shared with other organizations.
Source: NIST Special Publication 800-18, Guide for Developing Security
Plans for Information Technology Systems.
NEW QUESTION 464
Which utility below can create a server-spoofing attack?
- A. Snort
- B. C2MYAZZ
- C. BO2K
- D. DNS poisoning
Answer: B
Explanation:
C2MYAZZ is a utility that enables server spoofing to implement a session highjacking or man-in-the-middle exploit. It intercepts a client LANMAN authentication logon and obtains the session's logon credentials and password combination, transparently to the user.
*DNS poisoning is also known as cache poisoning. It is the process of distributing incorrect IP address information for a specific host with the intent to divert traffic from its true destination.
*Snort, is a utility used for network sniffing. Network sniffing is the process of gathering traffic from a network by capturing the data as it passes and storing it to analyze later.
*Back Orifice 2000 (BO2K), is an application-level Trojan Horse used to give an attacker backdoor network access. Source: Security Complete, edited by Mark Lierley (Sybex, 2001).
NEW QUESTION 465
What is the correct sequence which enables an authorized agency to use
the Law Enforcement Access Field (LEAF) to decrypt a message sent by
using the Clipper Chip? The following designations are used for the
respective keys involved Kf, the family key; Ks, the session key; U, a
unique identifier for each Clipper Chip and Ku, the unit key that is
unique to each Clipper Chip.
- A. Obtain a court order to acquire the two halves of Ku, the unit key.
Recover Ku. Decrypt the LEAF with Ku and then recover Ks, the
session key. Use the session key to decrypt the message. - B. Obtain a court order to acquire the family key, Kf; recover U and Ku; then recover Ks, the session key. Use the session key to decrypt the message.
- C. Decrypt the LEAF with the family key, Kf; recover U; obtain a court
order to obtain Ks, the session key. Use the session key to decrypt the message. - D. Decrypt the LEAF with the family key, Kf; recover U; obtain a court
order to obtain the two halves of Ku; recover Ku; and then recover Ks,
the session key. Use the session key to decrypt the message.
Answer: D
Explanation:
The explanation is based on the LEAF as shown in the Figure.
image018
The message is encrypted with the symmetric session key, Ks. In order to decrypt the message, then, Ks must be recovered. The LEAF contains the session key, but the LEAF is encrypted with the family key, Kf , that is common to all Clipper Chips. The authorized agency has
access to Kf and decrypts the LEAf. However, the session key is still
encrypted by the 80-bit unit key, Ku, that is unique to each Clipper
Chip and is identified by the unique identifier, U. Ku is divided into
two halves, and each half is deposited with an escrow agency. The
law enforcement agency obtains the two halves of Ku by presenting
the escrow agencies with a court order for the key identified by U.
The two halves of the key obtained by the court order are XORed
together to obtain Ku. Then, Ku is used to recover the session key, Ks, and Ks is used to decrypt the message.
The decryption sequence to obtain Ks can be summarized as:
image020
This is the sequence described in answer "Decrypt the LEAF with the family key, Kf; recover U; obtain a court order to obtain the two halves of Ku; recover Ku; and then recover
Ks,
the session key. Use the session key to decrypt the message". The sequences described in the other answers are incorrect.
NEW QUESTION 466
What is the maximum length of cable that can be used for a twisted-pair, Category 5 10Base-T cable?
- A. 80 meters
- B. 100 meters
- C. 185 meters
- D. 500 meters
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The maximum length of a Category 5 10Base-T cable is 100 meters.
Incorrect Answers:
A: The maximum length is 100 meters, not 80 meters.
C: The maximum length is 100 meters, not 185 meters.
D: The maximum length is 100 meters, not 500 meters.
References:
https://en.wikipedia.org/wiki/Ethernet_over_twisted_pair
NEW QUESTION 467
Which of the following is NOT a VPN communications protocol standard?
- A. Point-to-point tunneling protocol (PPTP)
- B. Challenge Handshake Authentication Protocol (CHAP)
- C. IP Security
- D. Layer 2 tunneling protocol (L2TP)
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The Challenge Handshake Authentication Protocol (CHAP) is used for authentication only. It is not a VPN communications protocol.
Incorrect Answers:
A: The Point-to-Point Tunneling Protocol (PPTP) is a method for implementing virtual private networks.
C: Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support virtual private networks (VPNs).
D: IP Security, Internet Protocol Security (IPsec), can be used to setup secure VPN connections.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 683
NEW QUESTION 468
Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment?
- A. Overt
- B. Internal
- C. Covert
- D. External
Answer: C
NEW QUESTION 469
Which layer of the TCP/IP protocol model defines the IP datagram and handles the routing of data across networks?
- A. Internet layer
- B. Network access layer
- C. Application layer
- D. Host-to-host transport layer
Answer: A
Explanation:
In the TCP/IP protocol model, the Internet layer defines the IP datagram and handles the routing of data across networks.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3:
Telecommunications and Network Security (page 84).
And: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne,
2002, chapter 7: Telecommunications and Network Security (page 344).
NEW QUESTION 470
Primary storage is the:
- A. Memory where information must be obtained by sequentially searching from the beginning of the memory space.
- B. Memory used in conjunction with real memory to present a CPU with a larger, apparent address space.
- C. Memory directly addressable by the CPU, which is for the storage of
instructions and data that are associated with the program being executed. - D. Memory, such as magnetic disks, that provide non-volatile storage.
Answer: C
Explanation:
* Answer "Memory, such as magnetic disks, that provide non-volatile storage" refers to secondary storage.
* Answer "Memory used in conjunction with real memory to present a CPU with a larger, apparent address space" refers to virtual memory, and answer "Memory where information must be obtained by sequentially searching from the beginning of the memory space" refers to sequential memory.
NEW QUESTION 471
Which of the following classes is the first level (lower) defined in the TCSEC (Orange Book) as mandatory protection?
- A. A
- B. C
- C. B
- D. D
Answer: C
Explanation:
B level is the first Mandatory Access Control Level.
First published in 1983 and updated in 1985, the TCSEC, frequently referred to as the Orange
Book, was a United States Government Department of Defense (DoD) standard that sets basic
standards for the implementation of security protections in computing systems. Primarily intended
to help the DoD find products that met those basic standards, TCSEC was used to evaluate,
classify, and select computer systems being considered for the processing, storage, and retrieval
of sensitive or classified information on military and government systems. As such, it was strongly
focused on enforcing confidentiality with no focus on other aspects of security such as integrity or
availability. Although it has since been superseded by the common criteria, it influenced the
development of other product evaluation criteria, and some of its basic approach and terminology
continues to be used.
Reference used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 17920-17926). Auerbach Publications. Kindle Edition.
and
THE source for all TCSEC "level" questions:
http://csrc.nist.gov/publications/secpubs/rainbow/std001.txt (paragraph 3 for this one)
NEW QUESTION 472
By examining the "state" and "context" of the incoming data packets, it helps to track the protocols that are considered "connectionless", such as UDP-based applications and
Remote Procedure Calls (RPC). This type of firewall system is used in?
- A. Fourth generation firewall systems.
- B. Second generation firewall systems.
- C. Third generation firewall systems.
- D. First generation firewall systems.
Answer: C
Explanation:
Statefull inspection is a third generation firewall technology designed to be aware of, and inspect, not only the information being received, but the dynamic connection and transmission state of the information being received. Control decisions are made by analyzing and utilizing the following: Communication Information, Communication derived state, Application derived state and information manipulation. Here are some characteristics of Statefull Inspection technology on Firewalls:
*
Scan information from all layers in the packet.
*
Save state information derived from previous communications, such as the outgoing Port command of an FTP session, so that incoming data communication can be verified against it.
*
Provides tracking support for connectionless protocols through the use of session state databases.
*
Allow state information derived from other applications access through the firewall for authorized services only, such as previously authenticated users.
*
Evaluate and manipulate flexible expressions based on communication and application derived state information.
NEW QUESTION 473
Which of the following is the most secure form of triple-DES encryption?
- A. DES-EDE1
- B. DES-EDE3
- C. DES-EEE4
- D. DES-EDE2
Answer: B
Explanation:
The reason is that it uses three keys. Four keys cannot be used.
The other alternatives do not use as many keys so less secure.
We do not believe there is such a thing as DES-EDE1, but it would still be less secure if it would
exist.
NEW QUESTION 474
Which of the following statements pertaining to the security kernel is incorrect?
- A. It must be small enough to be able to be tested and verified in a complete and comprehensive manner
- B. It is made up of mechanisms that fall under the TCB and implements and enforces the reference monitor concept.
- C. It must provide isolation for the processes carrying out the reference monitor concept and they must be tamperproof
- D. Is an access control concept, not an actual physical component
Answer: D
NEW QUESTION 475
Controls are implemented to?
- A. Eliminate risk and reduce the potential for loss.
- B. Eliminate risk and eliminate the potential for loss.
- C. Mitigate risk and eliminate the potential for loss.
- D. Mitigate risk and reduce the potential for loss.
Answer: D
Explanation:
That's the essence of Controls, you put them in your environment to minimize the impact of a potential loss, with them you can also mitigate the risk and obtain the first through this. Controls are a very good practice to secure an environment, they should be considered by any security professional, CISSP or not, the risk should be minimized as much as you can.
NEW QUESTION 476
Which of the following is an example of discretionary access control?
- A. Rule-based access control
- B. Role-based access control
- C. Identity-based access control
- D. Task-based access control
Answer: C
Explanation:
An identity-based access control is an example of discretionary access control that is based on an individual's identity. Identity-based access control (IBAC) is access control based on the identity of the user (typically relayed as a characteristic of the process acting on behalf of that user) where access authorizations to specific objects are assigned based on user identity.
Rule Based Access Control (RuBAC) and Role Based Access Control (RBAC) are examples of non-discretionary access controls.
Rule-based access control is a type of non-discretionary access control because this access is determined by rules and the subject does not decide what those rules will be, the rules are uniformly applied to ALL of the users or subjects. In general, all access control policies other than DAC are grouped in the category of nondiscretionary access control (NDAC). As the name implies, policies in this category have rules that are not established at the discretion of the user. Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action. Both Role Based Access Control (RBAC) and Rule Based Access Control (RuBAC) fall within Non Discretionary Access Control (NDAC). If it is not DAC or MAC then it is most likely NDAC.
BELOW YOU HAVE A DESCRIPTION OF THE DIFFERENT CATEGORIES:
MAC = Mandatory Access Control
Under a mandatory access control environment, the system or security administrator will define what permissions subjects have on objects. The administrator does not dictate user's access but simply configure the proper level of access as dictated by the Data Owner. The MAC system will look at the Security Clearance of the subject and compare it with the object sensitivity level or classification level. This is what is called the dominance relationship. The subject must DOMINATE the object sensitivity level. Which means that the subject must have a security clearance equal or higher than the object he is attempting to access. MAC also introduce the concept of labels. Every objects will have a label attached to them indicating the classification of the object as well as categories that are used to impose the need to know (NTK) principle. Even thou a user has a security clearance of Secret it does not mean he would be able to access any Secret documents within the system. He would be allowed to access only Secret document for which he has a Need To Know, formal approval, and object where the user belong to one of the categories attached to the object.
If there is no clearance and no labels then IT IS NOT Mandatory Access Control.
Many of the other models can mimic MAC but none of them have labels and a dominance relationship so they are NOT in the MAC category.
DAC = Discretionary Access Control
DAC is also known as: Identity Based access control system.
The owner of an object is define as the person who created the object. As such the owner has the discretion to grant access to other users on the network. Access will be granted based solely on the identity of those users. Such system is good for low level of security. One of the major problem is the fact that a user who has access to someone's else file can further share the file with other users without the knowledge or permission of the owner of the file. Very quickly this could become the wild wild west as there is no control on the dissimination of the information.
RBAC = Role Based Access Control
RBAC is a form of Non-Discretionary access control.
Role Based access control usually maps directly with the different types of jobs performed by employees within a company.
For example there might be 5 security administrator within your company. Instead of creating each of their profile one by one, you would simply create a role and assign the administrators to the role. Once an administrator has been assigned to a role, he will IMPLICITLY inherit the permissions of that role. RBAC is great tool for environment where there is a a large rotation of employees on a daily basis such as a very large help desk for example.
RBAC or RuBAC = Rule Based Access Control
RuBAC is a form of Non-Discretionary access control.
A good example of a Rule Based access control device would be a Firewall. A single set of rules is imposed to all users attempting to connect through the firewall.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 33
and NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316pdf and http://itlaw.wikia.com/wiki/Identity-based_access_control
NEW QUESTION 477
A cryptographic algorithm is also known as:
- A. Cryptanalysis
- B. A key
- C. A cryptosystem
- D. A cipher
Answer: D
Explanation:
Acipher is a cryptographic transformation that operates on characters
or bits. In different words, a cipher is defined as a cryptographic
algorithm or mathematical function that operates on characters or
bits and implements encryption or decryption. In contrast, a code
operates with words, phrases and sentences. In a code, a word may
be the encipherment of a sentence or phrase. For example, the word
SCARF may be the code for the term BEWARE OF DUTCH TRAITOR
IN YOUR MIDST.
* a cryptosystem is a set of transformations from a message
space to a ciphertext space. This system includes all cryptovariables
(keys), plaintexts and ciphertexts associated with the
transformation algorithm. The difference between answers a and c is
that answer c, the correct answer, refers to the algorithm alone and
answer a refers to the algorithm and all plaintexts, ciphertexts and
cryptovariables associated with this algorithm.
* cryptanalysis, refers to being able to break the cipher
so that the encrypted message can be read. Cryptanalysis may be
accomplished by exploiting weaknesses in the cipher or, in some
fashion, determining the key. This act of obtaining the plaintext or
key from the ciphertext can be used to recover sensitive or classified
information and, perhaps, to pass on altered or fake messages in
order to deceive the original intended recipient.
* the key or cryptovariable, is used with a particular algorithm
to encipher or decipher the plaintext message. By using the
key, the algorithm can be publicly known and evaluated for its
strength against attack. The key associated with a particular transformation or algorithm can take on many values and the range of all of these possible values is called the keyspace. Ideally, an enciphered plaintext message using a specific algorithm will produce a unique
ciphertext message for each different key that is used with that algorithm.
The situation in which a plaintext message generates identical
ciphertext messages using the same transformation algorithm, but
with different cryptovariables, is called key clustering. Obviously, this is not a desirable situation, since it effectively reduces the number of keys that have to be tried by an attacker in order to recover the plaintext.
NEW QUESTION 478
External consistency ensures that the data stored in the database is:
- A. in-consistent with the real world.
- B. consistent with the real world.
- C. remains consistant when sent from one system to another.
- D. consistent with the logical world.
Answer: B
Explanation:
External consistency ensures that the data stored in the database is consistent with the real world.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, page 33
NEW QUESTION 479
......
ISC2 CISSP Exam Syllabus Topics:
| Topic | Details |
Security and Risk Management - 15% | |
| Understand, adhere to, and promote professional ethics | - (ISC)2 Code of Professional Ethics - Organizational code of ethics |
| Understand and apply security concepts | - Confidentiality, integrity, and availability, authenticity and nonrepudiation |
| Evaluate and apply security governance principles | - Alignment of the security function to business strategy, goals, mission, and objectives - Organizational processes (e.g., acquisitions, divestitures, governance committees) - Organizational roles and responsibilities - Security control frameworks - Due care/due diligence |
| Determine compliance and other requirements | - Contractual, legal, industry standards, and regulatory requirements - Privacy requirements |
| Understand legal and regulatory issues that pertain to information security in a holistic context | - Cybercrimes and data breaches - Licensing and Intellectual Property (IP) requirements - Import/export controls - Transborder data flow - Privacy |
| Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards) | |
| Develop, document, and implement security policy, standards, procedures, and guidelines | |
| Identify, analyze, and prioritize Business Continuity (BC) requirements | - Business Impact Analysis (BIA) - Develop and document the scope and the plan |
| Contribute to and enforce personnel security policies and procedures | - Candidate screening and hiring - Employment agreements and policies - Onboarding, transfers, and termination processes - Vendor, consultant, and contractor agreements and controls - Compliance policy requirements - Privacy policy requirements |
| Understand and apply risk management concepts | - Identify threats and vulnerabilities - Risk assessment/analysis - Risk response - Countermeasure selection and implementation - Applicable types of controls (e.g., preventive, detective, corrective) - Control assessments (security and privacy) - Monitoring and measurement - Reporting - Continuous improvement (e.g., Risk maturity modeling) - Risk frameworks |
| Understand and apply threat modeling concepts and methodologies | |
| Apply Supply Chain Risk Management (SCRM) concepts | - Risks associated with hardware, software, and services - Third-party assessment and monitoring - Minimum security requirements - Service level requirements |
| Establish and maintain a security awareness, education, and training program | - Methods and techniques to present awareness and training (e.g., social engineering, phishing, security champions, gamification) - Periodic content reviews - Program effectiveness evaluation |
Asset Security - 10% | |
| Identify and classify information and assets | - Data classification - Asset Classification |
| Establish information and asset handling requirements | |
| Provision resources securely | - Information and asset ownership - Asset inventory (e.g., tangible, intangible) - Asset management |
| Manage data lifecycle | - Data roles (i.e., owners, controllers, custodians, processors, users/subjects) - Data collection - Data location - Data maintenance - Data retention - Data remanence - Data destruction |
| Ensure appropriate asset retention (e.g., End-of-Life (EOL), End-of-Support (EOS)) | |
| Determine data security controls and compliance requirements | - Data states (e.g., in use, in transit, at rest) - Scoping and tailoring - Standards selection - Data protection methods (e.g., Digital Rights Management (DRM), Data Loss Prevention (DLP), Cloud Access Security Broker (CASB)) |
Security Architecture and Engineering - 13% | |
| Research, implement and manage engineering processes using secure design principles | - Threat modeling - Least privilege - Defense in depth - Secure defaults - Fail securely - Separation of Duties (SoD) - Keep it simple - Zero Trust - Privacy by design - Trust but verify - Shared responsibility |
| Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula) | |
| Select controls based upon systems security requirements | |
| Understand security capabilities of information systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption) | |
| Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements | - Client-based systems - Server-based systems - Database systems - Cryptographic systems - Industrial Control Systems (ICS) - Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS)) - Distributed systems - Internet of Things (IoT) - Microservices - Containerization - Serverless - Embedded systems - High-Performance Computing (HPC) systems - Edge computing systems - Virtualized systems |
| Select and determine cryptographic solutions | - Cryptographic life cycle (e.g., keys, algorithm selection) - Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum) - Public Key Infrastructure (PKI) - Key management practices - Digital signatures and digital certificates - Non-repudiation - Integrity (e.g., hashing) |
| Understand methods of cryptanalytic attacks | - Brute force - Ciphertext only - Known plaintext - Frequency analysis - Chosen ciphertext - Implementation attacks - Side-channel - Fault injection - Timing - Man-in-the-Middle (MITM) - Pass the hash - Kerberos exploitation - Ransomware |
| Apply security principles to site and facility design | |
| Design site and facility security controls | - Wiring closets/intermediate distribution facilities - Server rooms/data centers - Media storage facilities - Evidence storage - Restricted and work area security - Utilities and Heating, Ventilation, and Air Conditioning (HVAC) - Environmental issues - Fire prevention, detection, and suppression - Power (e.g., redundant, backup) |
Communication and Network Security - 13% | |
| Assess and implement secure design principles in network architectures | - Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models - Internet Protocol (IP) networking (e.g., Internet Protocol Security (IPSec), Internet Protocol (IP) v4/6) - Secure protocols - Implications of multilayer protocols - Converged protocols (e.g., Fiber Channel Over Ethernet (FCoE), Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP)) - Micro-segmentation (e.g., Software Defined Networks (SDN), Virtual eXtensible Local Area Network (VXLAN), Encapsulation, Software-Defined Wide Area Network (SD WAN)) - Wireless networks (e.g., Li-Fi, Wi-Fi, Zigbee, satellite) - Cellular networks (e.g., 4G, 5G) - Content Distribution Networks (CDN) |
| Secure network components | - Operation of hardware (e.g., redundant power, warranty, support) - Transmission media - Network Access Control (NAC) devices - Endpoint security |
| Implement secure communication channels according to design | - Voice - Multimedia collaboration - Remote access - Data communications - Virtualized networks - Third-party connectivity |
Identity and Access Management (IAM) - 13% | |
| Control physical and logical access to assets | - Information - Systems - Devices - Facilities - Applications |
| Manage identification and authentication of people, devices, and services | - Identity Management (IdM) implementation - Single/multi-factor authentication (MFA) - Accountability - Session management - Registration, proofing, and establishment of identity - Federated Identity Management (FIM) - Credential management systems - Single Sign On (SSO) - Just-In-Time (JIT) |
| Federated identity with a third-party service | - On-premise - Cloud - Hybrid |
| Implement and manage authorization mechanisms | - Role Based Access Control (RBAC) - Rule based access control - Mandatory Access Control (MAC) - Discretionary Access Control (DAC) - Attribute Based Access Control (ABAC) - Risk based access control |
| Manage the identity and access provisioning lifecycle | - Account access review (e.g., user, system, service) - Provisioning and deprovisioning (e.g., on /off boarding and transfers) - Role definition (e.g., people assigned to new roles) - Privilege escalation (e.g., managed service accounts, use of sudo, minimizing its use) |
| Implement authentication systems | - OpenID Connect (OIDC)/Open Authorization (Oauth) - Security Assertion Markup Language (SAML) - Kerberos - Remote Authentication Dial-In User Service (RADIUS)/Terminal Access Controller Access Control System Plus (TACACS+) |
Security Assessment and Testing - 12% | |
| Design and validate assessment, test, and audit strategies | - Internal - External - Third-party |
| Conduct security control testing | - Vulnerability assessment - Penetration testing - Log reviews - Synthetic transactions - Code review and testing - Misuse case testing - Test coverage analysis - Interface testing - Breach attack simulations - Compliance checks |
| Collect security process data (e.g., technical and administrative) | - Account management - Management review and approval - Key performance and risk indicators - Backup verification data - Training and awareness - Disaster Recovery (DR) and Business Continuity (BC) |
| Analyze test output and generate report | - Remediation - Exception handling - Ethical disclosure |
| Conduct or facilitate security audits | - Internal - External - Third-party |
Security Operations - 13% | |
| Understand and comply with investigations | - Evidence collection and handling - Reporting and documentation - Investigative techniques - Digital forensics tools, tactics, and procedures - Artifacts (e.g., computer, network, mobile device) |
| Conduct logging and monitoring activities | - Intrusion detection and prevention - Security Information and Event Management (SIEM) - Continuous monitoring - Egress monitoring - Log management - Threat intelligence (e.g., threat feeds, threat hunting) - User and Entity Behavior Analytics (UEBA) |
| Perform Configuration Management (CM) (e.g., provisioning, baselining, automation) | |
| Apply foundational security operations concepts | - Need-to-know/least privilege - Separation of Duties (SoD) and responsibilities - Privileged account management - Job rotation - Service Level Agreements (SLAs) |
| Apply resource protection | - Media management - Media protection techniques |
| Conduct incident management | - Detection - Response - Mitigation - Reporting - Recovery - Remediation - Lessons learned |
| Operate and maintain detective and preventative measures | - Firewalls (e.g., next generation, web application, network) - Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) - Whitelisting/blacklisting - Third-party provided security services - Sandboxing - Honeypots/honeynets - Anti-malware - Machine learning and Artificial Intelligence (AI) based tools |
| Implement and support patch and vulnerability management | |
| Understand and participate in change management processes | |
| Implement recovery strategies | - Backup storage strategies - Recovery site strategies - Multiple processing sites - System resilience, High Availability (HA), Quality of Service (QoS), and fault tolerance |
| Implement Disaster Recovery (DR) processes | - Response - Personnel - Communications - Assessment - Restoration - Training and awareness - Lessons learned |
| Test Disaster Recovery Plans (DRP) | - Read-through/tabletop - Walkthrough - Simulation - Parallel - Full interruption |
| Participate in Business Continuity (BC) planning and exercises | |
| Implement and manage physical security | - Perimeter security controls - Internal security controls |
| Address personnel safety and security concerns | - Travel - Security training and awareness - Emergency management - Duress |
Software Development Security - 11% | |
| Understand and integrate security in the Software Development Life Cycle (SDLC) | - Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps) - Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM)) - Operation and maintenance - Change management - Integrated product team (IPT) |
| Identify and apply security controls in software development ecosystems | - Programming languages - Libraries - Tool sets - Integrated Development Environment (IDE) - Runtime - Continuous Integration and Continuous Delivery (CI/CD) - Security Orchestration, Automation, and Response (SOAR) - Software Configuration Management (SCM) - Code repositories - Application security testing (e.g., Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST)) |
| Assess the effectiveness of software security | - Auditing and logging of changes - Risk analysis and mitigation |
| Assess security impact of acquired software | - Commercial-off-the-shelf (COTS) - Open source - Third-party - Managed services (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS)) |
| Define and apply secure coding guidelines and standards | - Security weaknesses and vulnerabilities at the source-code level - Security of Application Programming Interfaces (APIs) - Secure coding practices - Software-defined security |
Get ready to pass the CISSP Exam right now using our ISC Certification Exam Package: https://www.easy4engine.com/CISSP-test-engine.html
A fully updated 2021 CISSP Exam Dumps exam guide from training expert Easy4Engine: https://drive.google.com/open?id=1VTVcS9bhRxLIbr6AQzv8UVHY60zDhb7b
