Free CISSP Exam Braindumps certification guide Q&A
CISSP Certification Overview Latest CISSP PDF Dumps
To be eligible for the ISC CISSP certification exam, candidates must have a minimum of five years of experience in two or more of the eight domains of the CISSP Common Body of Knowledge (CBK). Candidates who do not have the required experience can still take the exam, but will only be awarded an Associate of ISC² designation until they meet the experience requirements.
ISC CISSP (Certified Information Systems Security Professional) Exam is a globally recognized certification for information security professionals. It is considered one of the most prestigious and sought-after certifications in the field of cybersecurity. CISSP exam covers a wide range of topics, including security and risk management, asset security, security engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security.
The CISSP certification exam covers eight domains of information security, including security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security. CISSP exam is designed to test an individual’s knowledge and understanding of these domains, as well as their ability to apply this knowledge in practical scenarios.
NEW QUESTION # 619
Which one of the following is true about information that is designated with the highest of confidentiality in a private sector organization?
- A. It is restricted to those in the department of origin for the information.
- B. It is classified only by the information security officer and restricted to those who have made formal requests for access.
- C. It is limited to named individuals and creates an audit trail.
- D. It is available to anyone in the organization whose work relates to the subject and requires authorization for each access.
Answer: D
NEW QUESTION # 620
In order for a security policy to be effective within an organization, it MUST include
- A. disciplinary measures for non compliance.
- B. owner information and date of last revision.
- C. a list of all standards that apply to the policy.
- D. strong statements that clearly define the problem.
Answer: A
NEW QUESTION # 621
What is the second step in the identity and access provisioning lifecycle?
- A. Provisioning
- B. Approval
- C. Review
- D. Revocation
Answer: C
NEW QUESTION # 622
In terms of the order of effectiveness, which of the following technologies is the most affective?
- A. Fingerprint
- B. Iris scan
- C. Keystroke pattern
- D. Retina scan
Answer: B
Explanation:
The order of effectiveness has not changed for a few years. It is still the same today as it was three years ago. The list below present them from most effective to list effective: Iris scan Retina scan Fingerprint Hand geometry Voice pattern Keystroke pattern Signature
NEW QUESTION # 623
Which of the following access control models introduces user security clearance and data classification?
- A. Discretionary access control
- B. Mandatory access control
- C. Role-based access control
- D. Non-discretionary access control
Answer: B
Explanation:
The mandatory access control model is based on a security label system. Users are given a security clearance and data is classified. The classification is stored in the security labels of the resources. Classification labels specify the level of trust a user must have to access a certain file. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 4: Access Control (Page 154).
NEW QUESTION # 624
Which of the following statements pertaining to IPSec is incorrect?
- A. In transport mode, ESP only encrypts the data payload of each packet.
- B. ESP provides for integrity, authentication and encryption to IP datagrams.
- C. Integrity and authentication for IP datagrams are provided by AH.
- D. A security association has to be defined between two IPSec systems in order for bi- directional communication to be established.
Answer: D
Explanation:
This is incorrect, there would be a pair of Security Association (SA) needed for bi directional communication and NOT only one SA. The sender and the receiver would both negotiate an SA for inbound and outbound connections.
The two main concepts of IPSec are Security Associations (SA) and tunneling. A Security
Association (SA) is a simplex logical connection between two IPSec systems. For bi- directional communication to be established between two IPSec systems, two separate
Security Associations, one in each direction, must be defined.
The security protocols can either be AH or ESP.
NOTE FROM CLEMENT:
The explanations below are a bit more thorough than what you need to know for the exam.
However, they always say a picture is worth one thousands words, I think it is very true when it comes to explaining IPSEC and it's inner working. I have found a great article from
CISCO PRESS and DLINK covering this subject, see references below.
Tunnel and Transport Modes
IPSec can be run in either tunnel mode or transport mode. Each of these modes has its own particular uses and care should be taken to ensure that the correct one is selected for the solution:
Tunnel mode is most commonly used between gateways, or at an end-station to a gateway, the gateway acting as a proxy for the hosts behind it.
Transport mode is used between end-stations or between an end-station and a gateway, if the gateway is being treated as a host-for example, an encrypted Telnet session from a workstation to a router, in which the router is the actual destination.
As you can see in the Figure 1 graphic below, basically transport mode should be used for end-to-end sessions and tunnel mode should be used for everything else.
FIGURE: 1
IPSEC Transport Mode versus Tunnel Mode
Tunnel and transport modes in IPSec.
Figure 1 above displays some examples of when to use tunnel versus transport mode:
Tunnel mode is most commonly used to encrypt traffic between secure IPSec gateways, such as between the Cisco router and PIX Firewall (as shown in example A in Figure 1).
The IPSec gateways proxy IPSec for the devices behind them, such as Alice's PC and the
HR servers in Figure 1. In example A, Alice connects to the HR servers securely through the IPSec tunnel set up between the gateways.
Tunnel mode is also used to connect an end-station running IPSec software, such as the
Cisco Secure VPN Client, to an IPSec gateway, as shown in example B.
In example C, tunnel mode is used to set up an IPSec tunnel between the Cisco router and a server running IPSec software. Note that Cisco IOS software and the PIX Firewall sets tunnel mode as the default IPSec mode.
Transport mode is used between end-stations supporting IPSec, or between an end-station and a gateway, if the gateway is being treated as a host. In example D, transport mode is used to set up an encrypted Telnet session from Alice's PC running Cisco Secure VPN
Client software to terminate at the PIX Firewall, enabling Alice to remotely configure the
PIX Firewall securely.
FIGURE: 2
IPSEC AH Tunnel and Transport mode
AH Tunnel Versus Transport Mode
Figure 2 above, shows the differences that the IPSec mode makes to AH. In transport mode, AH services protect the external IP header along with the data payload. AH services protect all the fields in the header that don't change in transport. The header goes after the
IP header and before the ESP header, if present, and other higher-layer protocols.
As you can see in Figure 2 above, In tunnel mode, the entire original header is authenticated, a new IP header is built, and the new IP header is protected in the same way as the IP header in transport mode.
AH is incompatible with Network Address Translation (NAT) because NAT changes the source IP address, which breaks the AH header and causes the packets to be rejected by the IPSec peer.
FIGURE: 3
IPSEC ESP Tunnel versus Transport modes
ESP Tunnel Versus Transport Mode
Figure 3 above shows the differences that the IPSec mode makes to ESP. In transport mode, the IP payload is encrypted and the original headers are left intact. The ESP header is inserted after the IP header and before the upper-layer protocol header. The upper-layer protocols are encrypted and authenticated along with the ESP header. ESP doesn't authenticate the IP header itself.
NOTE: Higher-layer information is not available because it's part of the encrypted payload.
When ESP is used in tunnel mode, the original IP header is well protected because the entire original IP datagram is encrypted. With an ESP authentication mechanism, the original IP datagram and the ESP header are included; however, the new IP header is not included in the authentication.
When both authentication and encryption are selected, encryption is performed first, before authentication. One reason for this order of processing is that it facilitates rapid detection and rejection of replayed or bogus packets by the receiving node. Prior to decrypting the packet, the receiver can detect the problem and potentially reduce the impact of denial-of- service attacks.
ESP can also provide packet authentication with an optional field for authentication. Cisco
IOS software and the PIX Firewall refer to this service as ESP hashed message authentication code (HMAC). Authentication is calculated after the encryption is done. The current IPSec standard specifies which hashing algorithms have to be supported as the mandatory HMAC algorithms.
The main difference between the authentication provided by ESP and AH is the extent of the coverage. Specifically, ESP doesn't protect any IP header fields unless those fields are encapsulated by ESP (tunnel mode).
The following were incorrect answers for this question:
Integrity and authentication for IP datagrams are provided by AH This is correct, AH provides integrity and authentication and ESP provides integrity, authentication and encryption.
ESP provides for integrity, authentication and encryption to IP datagrams. ESP provides authentication, integrity, and confidentiality, which protect against data tampering and, most importantly, provide message content protection.
In transport mode, ESP only encrypts the data payload of each packet. ESP can be operated in either tunnel mode (where the original packet is encapsulated into a new one) or transport mode (where only the data payload of each packet is encrypted, leaving the header untouched).
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 6986-6989). Auerbach Publications. Kindle
Edition.
and
http://www.ciscopress.com/articles/article.asp?p=25477
and
http://documentation.netgear.com/reference/sve/vpn/VPNBasics-3-05.html
NEW QUESTION # 625
Which one of the following is NOT one of the maturity levels of the
Software Capability Maturity Model (CMM)?
- A. Defined
- B. Repeatable
- C. Managed
- D. Fundamental
Answer: D
Explanation:
The correct answer is Fundamental, a distracter. The first level of the Software CMM is the Initiating level. At this level, processes are performed on an ad hoc basis. Answer the Repeatable level is the second maturity level in the model. In the third level, Defined, management practices are institutionalized and technical procedures are integrated into the organizational structurE. The Managed level has both product and processes quantitatively controlled. The fifth level of the Software CMM is the Optimized level, where continuous process improvement is institutionalized.
NEW QUESTION # 626
The older coaxial cable has been widely replaced with twisted pair, which is extremely easy to work with, inexpensive, and also resistant to multiple hosts failure at once, especially when used in one of the following topology:
- A. Star Configuration.
- B. Point to Point Configuration.
- C. Ring Configuration.
- D. Token Passing Configuration.
Answer: A
Explanation:
The older coaxial cable has been widely replaced with twisted pair, which is extremely resistant to failure, especially in a star-wired configuration where a switch is used as a central point the traffic is going through.
If one cable fail then only one station will be affected and not all of the station as in Coaxial
Cable.
NOTE: You must be familiar with the term Topology versus Media Access Control methods.
TOPOLOGY (Bus, Star, Ring, Mesh, Tree, Point to Point):
Network topology is the arrangement of the various elements (links, nodes, etc.) of a computer network. Essentially, it is the topological structure of a network, and may be depicted physically or logically. Physical topology refers to the placement of the network's various components, including device location and cable installation, while logical topology shows how data flows within a network, regardless of its physical design. Distances between nodes, physical interconnections, transmission rates, and/or signal types may differ between two networks, yet their topologies may be identical.
A good example is a local area network (LAN): Any given node in the LAN has one or more physical links to other devices in the network; graphically mapping these links results in a geometric shape that can be used to describe the physical topology of the network.
Conversely, mapping the data flow between the components determines the logical topology of the network.
MEDIA ACCESS CONTROL METHODS (Polling, Token Passing, Contention ):
This method decides the presentation and possibilities from the network
Polling: Making periodic requests is called polling. Polling also reduces the burden on the network because the polls originate from a single system are at a predictable rate. The shortcoming of polling is that it does not allow for real-time updates. If a problem occurs on a managed device, the manager does not find out until the agent polled. Mostly used in a star network topology.
Token passing: Token passing that every device on the network receives a periodic opportunity to transmit. The token consists of a special frame that circulates from device to device around the ring. Only the device that possesses the token is permitted to transmit.
After transmitting, the device restarts the token, enabling other devices the opportunity to transmit.
Contention (CSMA/CA of CSMA/CD): A condition occuring in some LAN's wherin the
Media Access Control sublayer allows more than one node to transmit at the same time, risking collisions.
The following are incorrect answers:
Token passing configuration is not correct because token passing is a channel access method, not a network topology.
Point-to-point configuration is not correct because it is not a network topology.
Ring configuration is not correct because, while each host has two neighbors, messages only pass in one direction; so any break in the ring kills half the communications on the network.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 7554-7555). Auerbach Publications. Kindle
Edition.
and
http://en.wikipedia.org/wiki/Network_topology
NEW QUESTION # 627
Which choice below is NOT an accurate statement about an
organization's incident-handling capability?
- A. It should be used to prevent future damage from incidents.
- B. The organization's incident-handling capability should be used to contain and repair damage done from incidents.
- C. It should be used to provide the ability to respond quickly and effectively to an incident.
- D. The organization's incident-handling capability should be used to detect and punish senior-level executive wrong-doing.
Answer: D
Explanation:
An organization should address computer security incidents by developing an incident-handling capability. The incident-handling capability should be used to: Provide the ability to respond quickly and effectively. Contain and repair the damage from incidents. When left unchecked, malicious software can significantly harm an organization's computing, depending on the technology and its connectivity. Containing the incident should include an assessment of whether the incident is part of a targeted attack on the organization or an isolated incident. Prevent future damage. An incident-handling capability should assist an organization in preventing (or at least minimizing) damage from future incidents. Incidents can be studied internally to gain a better understanding of the organization's threats and vulnerabilities. Source: NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems.
NEW QUESTION # 628
Which choice below is the first priority in an emergency?
- A. Notifying external support resources for recovery and restoration
- B. Protecting the health and safety of everyone in the facility
- C. Communicating with employees families the status of the
emergency - D. Warning customers and contractors of a potential interruption of service
Answer: B
Explanation:
Life safety, or protecting the health and safety of everyone in the
facility is the first priority in an emergency or disaster. Evacuation
routes, assembly areas, and accounting for personnel (head counts
and last-known locations) are the most important function of emergency
procedures, before anything else. Once all personnel have been
accounted for and emergency teams have arrived to prevent further
damage or hazard, family members should be notified of the status of
the event. Providing restoration and recovery, and implementing
alternative production methods also comes later. Source: Emergency
Management Guide for Business and Industry, Federal Emergency
Management Agency, August, 1998.
NEW QUESTION # 629
What is the FIRST step when developing an Information Security Continuous Monitoring (ISCM) program?
- A. Establish an ISCM program determining metrics, status monitoring frequencies, and control assessment frequencies.
- B. Establish an ISCM technical architecture.
- C. Collect the security-related information required for metrics, assessments, and reporting.
- D. Define an ISCM strategy based on risk tolerance.
Answer: D
NEW QUESTION # 630
A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?
- A. Protection from loss of organization resources
- B. Guaranteed recovery of all business functions
- C. Insurance against litigation following a disaster
- D. Minimization of the need decision making during a crisis
Answer: A
Explanation:
Section: Security Operations
NEW QUESTION # 631
Virus scanning and content inspection of S/MIME encrypted e-mail without doing any further processing is:
- A. It is possible only if X509 Version 3 certificates are used
- B. Only possible with key recovery scheme of all user keys
- C. It is possible only by "brute force" decryption
- D. Not possible
Answer: D
Explanation:
Explanation/Reference:
Explanation:
E-mail encryption solutions such as S/MIME have been available for a long time. These encryption solutions have seen varying degrees of adoption in organizations of different types. However, such solutions present some challenges:
Inability to apply messaging policies: Organizations also face compliance requirements that require inspection of messaging content to make sure it adheres to messaging policies. However, messages encrypted with most client-based encryption solutions, including S/MIME, prevent content inspection on the server. Without content inspection, an organization can't validate that all messages sent or received by its users comply with messaging policies.
Decreased security: Antivirus software is unable to scan encrypted message content, further exposing an organization to risk from malicious content such as viruses and worms. Encrypted messages are generally considered to be trusted by most users, thereby increasing the likelihood of a virus spreading throughout your organization.
Incorrect Answers:
B: Virus scanning and content inspection of S/MIME encrypted e-mail is not possible even with a key recovery scheme of all user keys.
C: Virus scanning and content inspection of S/MIME encrypted e-mail is not possible even if X509 Version
3 certificates are used.
D: Using "brute force" decryption on S/MIME encrypted e-mail for the purpose of virus scanning and content inspection is not practical and unlikely to be successful.
References:
https://technet.microsoft.com/en-us/library/dd638122(v=exchg.150).aspx
NEW QUESTION # 632
In Unix, which file is required for you to set up an environment such that every user on the other host is a trusted user that can log into this host without authentication?
- A. /etc/shadow
- B. /etc/passwd
- C. None of the choices.
- D. /etc/host.equiv
Answer: D
Explanation:
The /etc/hosts.equiv file is saying that every user on the other host is a trusted user and allowed to log into this host without authentication (i.e. NO PASSWORD). The only thing that must exist for a user to log in to this system is an /etc/passwd entry by the same login name the user is currently using. In other words, if there is a user trying to log into this system whose login name is "bhope", then there must be a "bhope" listed in the /etc/passwd file.
NEW QUESTION # 633
During a fingerprint verification process, which of the following is used to verify identity and authentication?
- A. Sets of digits are matched with stored values
- B. A pressure value is compared with a stored template
- C. A hash table is matched to a database of stored value
- D. A template of minutiae is compared with a stored template
Answer: D
NEW QUESTION # 634
Which of the following is an effective method for avoiding magnetic media data remanence?
- A. Data Loss Prevention (DLP)
- B. Authentication
- C. Degaussing
- D. Encryption
Answer: C
NEW QUESTION # 635
Which of the following is an open standard for exchanging authentication and authorization data between parties?
- A. Hypertext Markup Language (HTML)
- B. Wired markup language
- C. Extensible Markup Language (XML)
- D. Security Assertion Markup Language (SAML)
Answer: D
NEW QUESTION # 636
In Mandatory Access Control, sensitivity labels attached to object contain what information?
- A. The item's classification
- B. The item's category
- C. The item's classification and category set
- D. The item's need to know
Answer: C
Explanation:
Explanation/Reference:
Explanation:
A sensitivity label is required for every subject and object when using the Mandatory Access Control (MAC) model. The sensitivity label is made up of a classification and different categories.
Incorrect Answers:
A: The item's classification on its own is incorrect. It has to have a category as well.
C: The item's category on its own is incorrect. It has to have a classification as well.
D: Need-to-know rules are applied by the categories section of the label.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 223
http://en.wikipedia.org/wiki/Mandatory_Access_Control
NEW QUESTION # 637
......
The Best ISC CISSP Study Guides and Dumps of 2023: https://www.pass4sures.top/ISCCertification/CISSP-testking-braindumps.html
Top ISC CISSP Exam Audio Study Guide! Practice Questions Edition: https://drive.google.com/open?id=1eaYN__ERJdB1kjNLgBKtLY3OeEOywncd