P.S. Free & New CISSP dumps are available on Google Drive shared by Exam4PDF: https://drive.google.com/open?id=1VNxZSvhuUGb_6lX6KqNRSxGZgT-yUwUq
Some of our customers are white-collar workers with no time to waste, and need a ISC certification urgently to get their promotions, meanwhile the other customers might aim at improving their skills. So we try to meet different requirements by setting different versions of our CISSP question and answers. The special one is online CISSP engine version. As an online tool, it is convenient and easy to study, supports all Web Browsers and system including Windows, Mac, Android, iOS and so on. You can apply this version of CISSP exam questions on all eletric devices.
| Section | Weight | Objectives |
|---|---|---|
| Security Architecture and Engineering | 13% | - Secure Design Principles - Security Models and Frameworks |
| Asset Security | 10% | - Data Lifecycle Management - Information and Asset Classification |
| Security Operations | 13% | - Incident Response - Disaster Recovery and Business Continuity |
| Software Development Security | 11% | - Secure Software Development Lifecycle (SDLC) - Application Security Controls |
| Security and Risk Management | 14% | - Professional Ethics - Compliance and Legal Requirements - Security Governance Principles |
| Security Assessment and Testing | 12% | - Audit Processes - Security Testing Methods |
| Identity and Access Management (IAM) | 13% | - Authentication and Authorization - Identity Lifecycle Management |
| Communication and Network Security | 13% | - Secure Network Components - Network Architecture and Design |
>> CISSP Reliable Learning Materials <<
In fact, many candidates have the willing and ambition to pass the CISSP exam and achieve the certification for they want to challege themself to become better. The efficiency of going it alone is very low, and it is easy to go to a dead end. You really need a helper. Take a look at the development of CISSP Guide quiz and you will certainly be attracted to it. The advantages of CISSP study materials are numerous and they are all you need!
NEW QUESTION # 1762
Suppose that you are the COMSEC - Communications Security custodian for a large, multinational corporation. Susie, from Finance approaches you in the break room saying that she lost her smart ID Card that she uses to digitally sign and encrypt emails in the PKI.
What happens to the certificates contained on the smart card after the security officer takes appropriate action?
Answer: D
Explanation:
Smart ID Cards can contain digital certifications user for establishing identity and for digitally encrypting and decrypting messages.
Commonly, there are three types of certificates on an ID Card: Identity certificate, private certificate and public certificate:
-Identity Certificate: This is the cert used to guarantee your identity, as when you swipe to enter a facility or when logging onto a computer
-Public Certificate: This is freely shared with the public. All who have it can use it to decrypt messages that you encrypt with your private key.
-Private Certificate: This is the key that you use to encrypt messages. It is a complimentary key to your public key. Only your public key can decrypt messages encrypted with the private key.
Otherwise known as PKI - Public Key Infrastructure, this is how the keys are used on your card.
Ordinarily, there is software on the computer that can, given the appropriate PIN number, log on,
digitally sign, encrypt and decrypt messages.
If you should lose your card the only certificate that is vital to be kept secret is your private key
because that can decrypt messages encrypt with your public key.
If this happens, the private key is added to the CRL - Certificate Revocation List. It is published by
the Certificate Authority or CA server and must periodically be downloaded so that the system
knows which certificates to trust and which not to trust.
Notably, revocation lists can become quite large and slow to download, especially over slower or
tactical military networks. Also, certificates can be in one of two states on the CRL: Revoked or
Hold. A hold can be reversed but once in revoked status, it is gone forever
ABOUT OCSP
Another way of validating if a certificate is valid is using OCSP.
The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. It is described in RFC 6960 and is on the Internet standards track. It was created as an alternative to certificate revocation lists (CRL), specifically addressing certain problems associated with using CRLs in a public key infrastructure (PKI). Messages communicated via OCSP are encoded in ASN.1 and are usually communicated over HTTP. The "request/response" nature of these messages leads to OCSP servers being termed OCSP responders.
The following answers are incorrect:
-They are reissued to the user: This isn't correct because once a private certificate is lost, it may never again be trusted because it has been out of control of the user.
-New certificates are issued to the user: This is actually correct but not what happens first. Ordinarily the previous certificates for the users are added to the CRL and THEN the new certificates are issued to the user. This way there is no chance a double set of certs are out there for a single user.
-The user may no longer have certificates: This isn't correct, unless the user is fired or quits. Users must have certificates to operate in a PKI environment. (Public Key Infrastructure)
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum.
NEW QUESTION # 1763
Physical security is accomplished through proper facility construction, fire and water protection, anti-theft mechanisms, intrusion detection systems, and security procedures that are adhered to and enforced. Which of the following is not a component that achieves this type of security?
Answer: B
Explanation:
Integrity Controls Mechanisms are not part of physical security. All of the other
detractors were correct this one was the wrong one that does not belong to Physical Security.
Below you have more details extracted from the SearchSecurity web site:
Information security depends on the security and management of the physical space in which
computer systems operate. Domain 9 of the CISSP exam's Common Body of Knowledge
addresses the challenges of securing the physical space, its systems and the people who work
within it by use of administrative, technical and physical controls. The following topics are covered:
Facilities management: The administrative processes that govern the maintenance and protection
of the physical operations space, from site selection through emergency response.
Risks, issues and protection strategies: Risk identification and the selection of security protection
components.
Perimeter security: Typical physical protection controls.
Facilities management
Facilities management is a complex component of corporate security that ranges from the
planning of a secure physical site to the management of the physical information system
environment. Facilities management responsibilities include site selection and physical security
planning (i.e. facility construction, design and layout, fire and water damage protection, antitheft
mechanisms, intrusion detection and security procedures.) Protections must extend to both people
and assets. The necessary level of protection depends on the value of the assets and data.
CISSP@ candidates must learn the concept of critical-path analysis as a means of determining a
component's business function criticality relative to the cost of operation and replacement.
Furthermore, students need to gain an understanding of the optimal location and physical
attributes of a secure facility. Among the topics covered in this domain are site inspection, location,
accessibility and obscurity, considering the area crime rate, and the likelihood of natural hazards
such as floods or earthquakes.
This domain also covers the quality of construction material, such as its protective qualities and
load capabilities, as well as how to lay out the structure to minimize risk of forcible entry and
accidental damage. Regulatory compliance is also touched on, as is preferred proximity to civil
protection services, such as fire and police stations. Attention is given to computer and equipment
rooms, including their location, configuration (entrance/egress requirements) and their proximity to
wiring distribution centers at the site.
Physical risks, issues and protection strategies
An overview of physical security risks includes risk of theft, service interruption, physical damage, compromised system integrity and unauthorized disclosure of information. Interruptions to business can manifest due to loss of power, services, telecommunications connectivity and water supply. These can also seriously compromise electronic security monitoring alarm/response devices. Backup options are also covered in this domain, as is a strategy for quantifying the risk exposure by simple formula.
Investment in preventive security can be costly. Appropriate redundancy of people skills, systems and infrastructure must be based on the criticality of the data and assets to be preserved. Therefore a strategy is presented that helps determine the selection of cost appropriate controls. Among the topics covered in this domain are regulatory and legal requirements, common standard security protections such as locks and fences, and the importance of establishing service level agreements for maintenance and disaster support. Rounding out the optimization approach are simple calculations for determining mean time between failure and mean time to repair (used to estimate average equipment life expectancy) - essential for estimating the cost/benefit of purchasing and maintaining redundant equipment.
As the lifeblood of computer systems, special attention is placed on adequacy, quality and protection of power supplies. CISSP candidates need to understand power supply concepts and terminology, including those for quality (i.e. transient noise vs. clean power); types of interference (EMI and RFI); and types of interruptions such as power excess by spikes and surges, power loss by fault or blackout, and power degradation from sags and brownouts. A simple formula is presented for determining the total cost per hour for backup power. Proving power reliability through testing is recommended and the advantages of three power protection approaches are discussed (standby UPS, power line conditioners and backup sources) including minimum requirements for primary and alternate power provided.
Environmental controls are explored in this domain, including the value of positive pressure water drains and climate monitoring devices used to control temperature, humidity and reduce static electricity. Optimal temperatures and humidity settings are provided. Recommendations include strict procedures during emergencies, preventing typical risks (such as blocked fans), and the use of antistatic armbands and hygrometers. Positive pressurization for proper ventilation and monitoring for air born contaminants is stressed.
The pros and cons of several detection response systems are deeply explored in this domain. The concept of combustion, the classes of fire and fire extinguisher ratings are detailed. Mechanisms behind smoke-activated, heat-activated and flame-activated devices and Automatic Dial-up alarms are covered, along with their advantages, costs and shortcomings. Types of fire sources are distinguished and the effectiveness of fire suppression methods for each is included. For instance, Halon and its approved replacements are covered, as are the advantages and the inherent risks to equipment of the use of water sprinklers.
Administrative controls The physical security domain also deals with administrative controls applied to physical sites and assets. The need for skilled personnel, knowledge sharing between them, separation of duties, and appropriate oversight in the care and maintenance of equipment and environments is stressed. A list of management duties including hiring checks, employee maintenance activities and recommended termination procedures is offered. Emergency measures include accountability for evacuation and system shutdown procedures, integration with disaster and business continuity plans, assuring documented procedures are easily available during different types of emergencies, the scheduling of periodic equipment testing, administrative reviews of documentation, procedures and recovery plans, responsibilities delegation, and personnel training and drills.
Perimeter security Domain nine also covers the devices and techniques used to control access to a space. These include access control devices, surveillance monitoring, intrusion detection and corrective actions. Specifications are provided for optimal external boundary protection, including fence heights and placement, and lighting placement and types. Selection of door types and lock characteristics are covered. Surveillance methods and intrusion-detection methods are explained, including the use of video monitoring, guards, dogs, proximity detection systems, photoelectric/photometric systems, wave pattern devices, passive infrared systems, and sound and motion detectors, and current flow sensitivity devices that specifically address computer theft. Room lock types - both preset and cipher locks (and their variations) -- device locks, such as portable laptop locks, lockable server bays, switch control locks and slot locks, port controls, peripheral switch controls and cable trap locks are also covered. Personal access control methods used to identify authorized users for site entry are covered at length, noting social engineering risks such as piggybacking. Wireless proximity devices, both user access and system sensing readers are covered (i.e. transponder based, passive devices and field powered devices) in this domain.
Now that you've been introduced to the key concepts of Domain 9, watch the Domain 9, Physical Security video Return to the CISSP Essentials Security School main page See all SearchSecurity.com's resources on CISSP certification training
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2001, Page 280.
NEW QUESTION # 1764
Which of the following statements is TRUE regarding state-based analysis as a functional software testing technique?
Answer: B
Explanation:
Section: Software Development Security
NEW QUESTION # 1765
Which of the following BEST describes "Privilege Creep"?
Answer: A
Explanation:
Privilege creep refers to the gradual, often unintentional accumulation of unnecessary access rights and permissions by a user over time-commonly occurring as an employee changes roles, departments, or takes on temporary project responsibilities without having their previous, no- longer-needed access properly reviewed and revoked-violating the principle of least privilege and increasing organizational risk, which periodic access reviews and recertification processes are designed to address.
NEW QUESTION # 1766
What can be defined as a table of subjects and objects indicating what actions individual subjects can take upon individual objects?
Answer: A
Explanation:
Explanation/Reference:
Explanation:
An access control matrix is a table of subjects and objects that specifies the actions individual subjects can take upon individual objects.
Incorrect Answers:
A: A capacity table is not valid with regards to the context of this question.
B: Access control lists define subjects that are authorized to access a specific object, and includes the level of authorization that subjects are granted.
D: A capability table stipulates the access rights that a specified subject has in relation to detailed objects.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 229-231
NEW QUESTION # 1767
......
Exam4PDF online digital ISC CISSP exam questions are the best way to prepare. Using our ISC CISSP exam dumps, you will not have to worry about whatever topics you need to master. To practice for a ISC CISSP Certification Exam in the Exam4PDF (free test), you should perform a self-assessment. The CISSP practice test Exam4PDF keeps track of each previous attempt and highlights the improvements with each attempt.
New CISSP Exam Notes: https://www.exam4pdf.com/CISSP-dumps-torrent.html
P.S. Free & New CISSP dumps are available on Google Drive shared by Exam4PDF: https://drive.google.com/open?id=1VNxZSvhuUGb_6lX6KqNRSxGZgT-yUwUq