GET Real ISC CISSP Exam Questions With 100% Refund Guarantee Jun 14, 2022 [Q510-Q532]

This is very obvious, the operators are responsible of making operative tasks that deals with the hardware and software implementations, they can handle the hardware and put t in condition for the user, be in charge of the backup and restore procedures and
Mounting the disk or tapes for the backup. Those are all common tasks. When we talk about the data entry, is the user who has to make does, If the operator do that too, what is the user going to do?

Explanation/Reference:
Explanation:
Backward chaining (or backward reasoning) is an inference method that can be described as working backward from the goal/hypothesis. It is used in automated theorem provers, inference engines, proof assistants and other artificial intelligence applications.
Incorrect Answers:
A: A blackboard system is an artificial intelligence application based on the blackboard architectural model, where a common knowledge base, the “blackboard”, is iteratively updated by a diverse group of specialist knowledge sources, starting with a problem specification and ending with a solution.
B: Lateral chaining is not one of the expert system operating modes.
C: Forward chaining is the opposite of backward chaining. Forward chaining starts with the available data and uses inference rules to extract more data until a goal (hypothesis) is reached.
References:
https://en.wikipedia.org/wiki/Backward_chaining

Explanation/Reference:
Explanation:
Event logging is available in both TACACS and TACACS+.
Incorrect Answers:
B: TACACS+ is XTACACS with extended two-factor user authentication.
C: TACACS uses fixed passwords for authentication, while TACACS+ allows users to employ dynamic (one-time) passwords, which provides more protection.
D: TACACS+ features security tokes, which is not included in TACACS.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 234

Explanation/Reference:
Explanation:
Secure MIME (S/MIME) is a standard for encrypting and digitally signing electronic mail and for providing secure data transmissions.
PGP is often used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications.
Incorrect Answers:
B: IPSec is not used to protect e-mails. IPsec is used to secure Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPSec can be implemented with the help of the IKE security architecture.
C: SSL and TLS are primarily used to protect HTTP traffic.
D: SSH is not used to protect e-mails. SSH allows remote login and other network services to operate securely over an unsecured network.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 850-851

The word NOT is used as a keyword in the question. You need to find out a security control from an given options which in not corrective control. System Monitoring is a detective control and not a corrective control. For your exam you should know below information about different security controls
Deterrent Controls Deterrent Controls are intended to discourage a potential attacker. Access controls act as a deterrent to threats and attacks by the simple fact that the existence of the control is enough to keep some potential attackers from attempting to circumvent the control. This is often because the effort required to circumvent the control is far greater than the potential reward if the attacker is successful, or, conversely, the negative implications of a failed attack (or getting caught) outweigh the benefits of success. For example, by forcing the identification and authentication of a user, service, or application, and all that it implies, the potential for incidents associated with the system is significantly reduced because an attacker will fear association with the incident. If there are no controls for a given access path, the number of incidents and the potential impact become infinite. Controls inherently reduce exposure to risk by applying oversight for a process. This oversight acts as a deterrent, curbing an attacker’s appetite in the face of probable repercussions. The best example of a deterrent control is demonstrated by employees and their propensity to intentionally perform unauthorized functions, leading to unwanted events. When users begin to understand that by authenticating into a system to perform a function, their activities are logged and monitored, and it reduces the likelihood they will attempt such an action. Many threats are based on the anonymity of the threat agent, and any potential for identification and association with their actions is avoided at all costs. It is this fundamental reason why access controls are the key target of circumvention by attackers. Deterrents also take the form of potential punishment if users do something unauthorized. For example, if the organization policy specifies that an employee installing an unauthorized wireless access point will be fired, that will determine most employees from installing wireless access points.
Preventative Controls Preventive controls are intended to avoid an incident from occurring. Preventative access controls keep a user from performing some activity or function. Preventative controls differ from deterrent controls in that the control is not optional and cannot (easily) be bypassed. Deterrent controls work on the theory that it is easier to obey the control rather than to risk the consequences of bypassing the control. In other words, the power for action resides with the user (or the attacker). Preventative controls place the power of action with the system, obeying the control is not optional. The only way to bypass the control is to find a flaw in the control’s implementation.
Compensating Controls Compensating controls are introduced when the existing capabilities of a system do not support the requirement of a policy. Compensating controls can be technical, procedural, or managerial. Although an existing system may not support the required controls, there may exist other technology or processes that can supplement the existing environment, closing the gap in controls, meeting policy requirements, and reducing overall risk. For example, the access control policy may state that the authentication process must be encrypted when performed over the Internet. Adjusting an application to natively support encryption for authentication purposes may be too costly. Secure Socket Layer (SSL), an encryption protocol, can be employed and layered on top of the authentication process to support the policy statement. Other examples include a separation of duties environment, which offers the capability to isolate certain tasks to compensate for technical limitations in the system and ensure the security of transactions. In addition, management processes, such as authorization, supervision, and administration, can be used to compensate for gaps in the access control environment.
Detective Controls Detective controls warn when something has happened, and are the earliest point in the post-incident timeline. Access controls are a deterrent to threats and can be aggressively utilized to prevent harmful incidents through the application of least privilege. However, the detective nature of access controls can provide significant visibility into the access environment and help organizations manage their access strategy and related security risk. As mentioned previously, strongly managed access privileges provided to an authenticated user offer the ability to reduce the risk exposure of the enterprise’s assets by limiting the capabilities that authenticated user has. However, there are few options to control what a user can perform once privileges are provided. For example, if a user is provided write access to a file and that file is damaged, altered, or otherwise negatively impacted (either deliberately or unintentionally), the use of applied access controls will offer visibility into the transaction. The control environment can be established to log activity regarding the identification, authentication, authorization, and use of privileges on a system. This can be used to detect the occurrence of errors, the attempts to perform an unauthorized action, or to validate when provided credentials were exercised. The logging system as a detective device provides evidence of actions (both successful and unsuccessful) and tasks that were executed by authorized users.
Corrective Controls When a security incident occurs, elements within the security infrastructure may require corrective actions. Corrective controls are actions that seek to alter the security posture of an environment to correct any deficiencies and return the environment to a secure state. A security incident signals the failure of one or more directive, deterrent, preventative, or compensating controls. The detective controls may have triggered an alarm or notification, but now the corrective controls must work to stop the incident in its tracks. Corrective controls can take many forms, all depending on the particular situation at hand or the particular security failure that needs to be dealt with.
Recovery Controls Any changes to the access control environment, whether in the face of a security incident or to offer temporary compensating controls, need to be accurately reinstated and returned to normal operations. There are several situations that may affect access controls, their applicability, status, or management. Events can include system outages, attacks, project changes, technical demands, administrative gaps, and full-blown disaster situations. For example, if an application is not correctly installed or deployed, it may adversely affect controls placed on system files or even have default administrative accounts unknowingly implemented upon install. Additionally, an employee may be transferred, quit, or be on temporary leave that may affect policy requirements regarding separation of duties. An attack on systems may have resulted in the implantation of a Trojan horse program, potentially exposing private user information, such as credit card information and financial data. In all of these cases, an undesirable situation must be rectified as quickly as possible and controls returned to normal operations.
For your exam you should know below information about different security controls
Deterrent Controls Deterrent Controls are intended to discourage a potential attacker. Access controls act as a deterrent to threats and attacks by the simple fact that the existence of the control is enough to keep some potential attackers from attempting to circumvent the control. This is often because the effort required to circumvent the control is far greater than the potential reward if the attacker is successful, or, conversely, the negative implications of a failed attack (or getting caught) outweigh the benefits of success. For example, by forcing the identification and authentication of a user, service, or application, and all that it implies, the potential for incidents associated with the system is significantly reduced because an attacker will fear association with the incident. If there are no controls for a given access path, the number of incidents and the potential impact become infinite. Controls inherently reduce exposure to risk by applying oversight for a process. This oversight acts as a deterrent, curbing an attacker’s appetite in the face of probable repercussions. The best example of a deterrent control is demonstrated by employees and their propensity to intentionally perform unauthorized functions, leading to unwanted events. When users begin to understand that by authenticating into a system to perform a function, their activities are logged and monitored, and it reduces the likelihood they will attempt such an action. Many threats are based on the anonymity of the threat agent, and any potential for identification and association with their actions is avoided at all costs. It is this fundamental reason why access controls are the key target of circumvention by attackers. Deterrents also take the form of potential punishment if users do something unauthorized. For example, if the organization policy specifies that an employee installing an unauthorized wireless access point will be fired, that will determine most employees from installing wireless access points.
Preventative Controls Preventive controls are intended to avoid an incident from occurring. Preventative access controls keep a user from performing some activity or function. Preventative controls differ from deterrent controls in that the control is not optional and cannot (easily) be bypassed. Deterrent controls work on the theory that it is easier to obey the control rather than to risk the consequences of bypassing the control. In other words, the power for action resides with the user (or the attacker). Preventative controls place the power of action with the system, obeying the control is not optional. The only way to bypass the control is to find a flaw in the control’s implementation.
Compensating Controls Compensating controls are introduced when the existing capabilities of a system do not support the requirement of a policy. Compensating controls can be technical, procedural, or managerial. Although an existing system may not support the required controls, there may exist other technology or processes that can supplement the existing environment, closing the gap in controls, meeting policy requirements, and reducing overall risk. For example, the access control policy may state that the authentication process must be encrypted when performed over the Internet. Adjusting an application to natively support encryption for authentication purposes may be too costly. Secure Socket Layer (SSL), an encryption protocol, can be employed and layered on top of the authentication process to support the policy statement. Other examples include a separation of duties environment, which offers the capability to isolate certain tasks to compensate for technical limitations in the system and ensure the security of transactions. In addition, management processes, such as authorization, supervision, and administration, can be used to compensate for gaps in the access control environment.
Detective Controls Detective controls warn when something has happened, and are the earliest point in the post-incident timeline. Access controls are a deterrent to threats and can be aggressively utilized to prevent harmful incidents through the application of least privilege. However, the detective nature of access controls can provide significant visibility into the access environment and help organizations manage their access strategy and related security risk.
As mentioned previously, strongly managed access privileges provided to an authenticated user offer the ability to reduce the risk exposure of the enterprise’s assets by limiting the capabilities that authenticated user has. However, there are few options to control what a user can perform once privileges are provided. For example, if a user is provided write access to a file and that file is damaged, altered, or otherwise negatively impacted (either deliberately or unintentionally), the use of applied access controls will offer visibility into the transaction. The control environment can be established to log activity regarding the identification, authentication, authorization, and use of privileges on a system. This can be used to detect the occurrence of errors, the attempts to perform an unauthorized action, or to validate when provided credentials were exercised. The logging system as a detective device provides evidence of actions (both successful and unsuccessful) and tasks that were executed by authorized users.
Corrective Controls When a security incident occurs, elements within the security infrastructure may require corrective actions. Corrective controls are actions that seek to alter the security posture of an environment to correct any deficiencies and return the environment to a secure state. A security incident signals the failure of one or more directive, deterrent, preventative, or compensating controls. The detective controls may have triggered an alarm or notification, but now the corrective controls must work to stop the incident in its tracks. Corrective controls can take many forms, all depending on the particular situation at hand or the particular security failure that needs to be dealt with.
Recovery Controls
Any changes to the access control environment, whether in the face of a security incident or to
offer temporary compensating controls, need to be accurately reinstated and returned to normal
operations. There are several situations that may affect access controls, their applicability, status,
or management.
Events can include system outages, attacks, project changes, technical demands, administrative
gaps, and full-blown disaster situations. For example, if an application is not correctly installed or
deployed, it may adversely affect controls placed on system files or even have default
administrative accounts unknowingly implemented upon install.
Additionally, an employee may be transferred, quit, or be on temporary leave that may affect policy
requirements regarding separation of duties. An attack on systems may have resulted in the
implantation of a Trojan horse program, potentially exposing private user information, such as
credit card information and financial data. In all of these cases, an undesirable situation must be
rectified as quickly as possible and controls returned to normal operations.
The following answers are incorrect:
The other examples are belongs to corrective control.
The following reference(s) were/was used to create this question:
CISA Review Manual 2014 Page number 44
and
Official ISC2 CISSP guide 3rd edition Page number 50 and 51

“RAID Level 7 is a variation of RAID 5 wherein the array functions as a single virtual disk in the hardware. This is sometimes simulated by software running over a RAID level 5 hardware implementation, which enables the drive array to continue to operate if any disk or any path to any disk fails. It also provides parity protection.” Pg 91 Krutz: CISSP Prep Guide: Gold Edition.

AES is comprised of the three key sizes, 128, 192, and 256 bits with
a fixed block size of 128 bits. The Advanced Encryption Standard
(AES) was announced on November 26, 2001 , as Federal Information
Processing Standard Publication (FIPS PUB 197). FIPS PUB 197 states
that This standard may be used by Federal departments and agencies
when an agency determines that sensitive (unclassified) information
(as defined in P.L. 100-235) requires cryptographic protection.
Other FIPS-approved cryptographic algorithms may be used in addition
to, or in lieu of, this standard. Depending upon which of the
three keys is used, the standard may be referred to as AES-128,
AES-192 or AES-256.
The number of rounds used in the Rijndael cipher is a function of
the key size as follows:
256-bit key 14 rounds
192-bit key 12 rounds
128-bit key 10 rounds
Rijndael has a symmetric and parallel structure that provides for
flexibility of implementation and resistance to cryptanalytic attacks.
Attacks on Rijndael would involve the use of differential and linear
cryptanalysis.

A server cluster is a group of independent servers, which are managed as a single system, that provides higher availability, easier manageability, and greater scalability.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 67.

Section: Software Development Security

Relevant Access Controls are not included as a Access Control
Technique.
Lattice-based access control models were developed in the early 1970s to deal with the confidentiality of military information. In the late 1970s and early 1980s, researchers applied these models to certain integrity concerns. Later, application of the models to the Chinese Wall policy, a confidentiality policy unique to the commercial sector, was demonstrated.
Discretionary control is the most common type of access control mechanism implemented in computer systems today. The basis of this kind of security is that an individual user, or program operating on the user’s behalf, is allowed to specify explicitly the types of access other users (or programs executing on their behalf) may have to information under the user’s control. Discretionary Access control security differs from mandatory access control security in that it implements the access control decisions of the user. Mandatory controls are driven by the results of a comparison between the user’s trust level or clearance and the sensitivity designation of the information.

Fiber is more secure because it is hard to tap into and gives off no EMI such as copper cabling.

A vulnerability is mostly a weakness, it could be a weakness in a piece of sotware, it
could be a weakness in your physical security, it could take many forms. It is a weakness that
could be exploited by a Threat. For example an open firewall port, a password that is never
changed, or a flammable carpet. A missing Control is also considered to be a Vulnerability.
The following answers are incorrect:
Risk:
It is the combination of a threat exploiting some vulnerability that could cause harm to some asset.
Management is concerned with many types of risk. Information Technology (IT) security risk
management addresses risks that arise from an organization’s use of information technology.
Usually a threat agent will give rise to the threat which will attempt to take advantage of one of
your vulnerability.
Risk is a function of the likelihood that a threat scenario will materialize, its resulting impact
(consequences) and the existence/effectiveness of safeguards. If the evaluation of the risk meets
the risk deemed acceptable by management, nothing needs to be done. Situations where
evaluation of the risk exceeds the accepted risk (target risk) will necessitate a risk management
decision such as implementing a safeguard to bring the risk down to an acceptable level.
Threat:
Possibility that vulnerability may be exploited to cause harm to a system, environment, or
personnel. Any potential danger. The risk level associated with a threat is evaluated by looking at
the likelihood which is how often it could happen and the impact (which is how much exposure or
lost you would suffer) it would have on the asset. A low impact threat that repeats itself multiple
times would have to be addressed. A high impact threat that happen not very often would have to
be addressed as well.
Target of evaluation:
The term Target of evaluation is a term used under the common criteria evaluation scheme. It
defines the product being evaluated. It was only a detractor in this case and it is not directly
related to risk management.
Risk management info
Risk Management is an iterative process, which ensures that reasonable and cost-effective steps
are taken to protect the:
Confidentiality of information stored, processed, or transmitted electronically
Integrity of the information and related processes
Availability of the information, systems and services against accidental and deliberate threats
Value of the asset and the cost of its replacement if it is compromised
You can manage risk by:
Confirming the appropriateness of minimum standards
Supplementing the standards when necessary
Eliminating unnecessary expenditures and administrative barriers
Managing risk therefore, means defining:
What is at risk
Magnitude of the risk
Causal factors
What to do about the risk
The following reference(s) were/was used to create this question:
http://www.cse-cst.gc.ca/tutorials/english/section2/m2/index_e.htm
and
The official CEH courseware Version 6 Module 1

White-box testing (also known as clear box testing, glass box testing, transparent box testing, and structural testing) is a method of testing software that tests internal structures or workings of an application, as opposed to its functionality (i.e. black-box testing). In white-box testing an internal perspective of the system, as well as programming skills, are used to design test cases. The tester chooses inputs to exercise paths through the code and determine the appropriate outputs. This is analogous to testing nodes in a circuit, e.g. in-circuit testing (ICT). White-box testing can be applied at the unit, integration and system levels of the software testing process. Although traditional testers tended to think of white-box testing as being done at the unit level, it is used for integration and system testing more frequently today. It can test paths within a unit, paths between units during integration, and between subsystems during a system-level test. Though this method of test design can uncover many errors or problems, it has the potential to miss unimplemented parts of the specification or missing requirements.
For your exam you should know the information below: Alpha and Beta Testing – An alpha version is early version is an early version of the application system submitted to the internal user for testing. The alpha version may not contain all the features planned for the final version. Typically software goes to two stages testing before it consider finished.The first stage is called alpha testing is often performed only by the user within the organization developing the software. The second stage is called beta testing, a form of user acceptance testing, generally involves a limited number of external users. Beta testing is the last stage of testing, and normally involves real world exposure, sending the beta version of the product to independent beta test sites or offering it free to interested user.
Pilot Testing – A preliminary test that focuses on specific and predefined aspect of a system. It is
not meant to replace other testing methods, but rather to provide a limited evaluation of the
system. Proof of concept are early pilot tests – usually over interim platform and with only basic
functionalities.
White box testing – Assess the effectiveness of a software program logic. Specifically, test data are
used in determining procedural accuracy or conditions of a program’s specific logic path. However
testing all possible logical path in large information system is not feasible and would be cost
prohibitive, and therefore is used on selective basis only.
Black Box Testing – An integrity based form of testing associated with testing components of an
information system’s “functional” operating effectiveness without regards to any specific internal
program structure. Applicable to integration and user acceptance testing.
Function/validation testing – It is similar to system testing but it is often used to test the
functionality of the system against the detailed requirements to ensure that the software that has
been built is traceable to customer requirements.
Regression Testing – The process of rerunning a portion of a test scenario or test plan to ensure
that changes or corrections have not introduced new errors. The data used in regression testing
should be same as original data.
Parallel Testing – This is the process of feeding test data into two systems – the modified system
and an alternative system and comparing the result.
Sociability Testing – The purpose of these tests is to confirm that new or modified system can
operate in its target environment without adversely impacting existing system. This should cover
not only platform that will perform primary application processing and interface with other system
but , in a client server and web development, changes to the desktop environment. Multiple
application may run on the users desktop, potentially simultaneously , so it is important to test the
impact of installing new dynamic link libraries (DLLs), making operating system registry or
configuration file modification, and possibly extra memory utilization.
The following answers are incorrect:
Parallel Testing – This is the process of feeding test data into two systems – the modified system
and an alternative system and comparing the result.
Regression Testing – The process of rerunning a portion of a test scenario or test plan to ensure
that changes or corrections have not introduced new errors. The data used in regression testing
should be same as original data.
Pilot Testing – A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests – usually over interim platform and with only basic functionalities
The following reference(s) were/was used to create this question: CISA review manual 2014 Page number 167 Official ISC2 guide to CISSP CBK 3rd Edition Page number 176
Topic 2, Telecommunication and Network Security

Explanation/Reference:
Explanation:
Biometrics is based on “what you are” or “what you do”. It is not based on what you know.
Incorrect Answers:
A: Behavioral (what you do), is one of the two categories that biometrics are divided into.
B: The physiological biometric category refers to traits that are physical attributes unique to a specific individual.
D: When determining a biometric system’s accuracy, the CER metric is the most important measurement.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 187, 188

Explanation/Reference:
Explanation:
When power companies are experiencing high demand, they frequently reduce the voltage in an electrical grid, which is referred to as a brownout. Constant voltage transformers can be used to regulate this fluctuation of power. They can use different ranges of voltage and only release the expected 120 volts of alternating current to devices.
Interference interrupts the flow of an electrical current, and fluctuations can actually deliver a different level of voltage than what was expected. Each fluctuation can be damaging to devices and people.
The following explains the different types of voltage fluctuations possible with electric power:
Power excess:
Spike Momentary high voltage

Surge Prolonged high voltage

Power loss:
Fault Momentary power outage

Blackout Prolonged, complete loss of electric power

Power degradation:
Sag/dip Momentary low-voltage condition, from one cycle to a few seconds

Brownout Prolonged power supply that is below normal voltage

In-rush current Initial surge of current required to start a load

Incorrect Answers:
B: A blackout is a prolonged complete loss of power, not a prolonged low voltage. Therefore, this answer is incorrect.
C: A surge is a prolonged high voltage, not a prolonged low voltage. Therefore, this answer is incorrect.
D: A fault is a momentary power outage, not a prolonged low voltage. Therefore, this answer is incorrect.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 462-463

CAPI is designed for software developers to call functions from the library and, thus, make it easier to implement security services. An example of a CAPI is the Generic Security Service API (GSSAPI.) The GSS-API provides data confidentiality, authentication, and data integrity services and supports the use of both public and secret key mechanisms. The GSS-API is described in the Internet Proposed Standard RFC 2078. The other answers are made-up distracters.