DOWNLOAD the newest ActualTestsIT CISSP PDF dumps from Cloud Storage for free: https://drive.google.com/open?id=1vIdD7gS4p63xi8eQQRDlypCpukeMZpuK
There are only key points in our CISSP training materials. From the experience of our former customers, you can finish practicing all the contents in our CISSP guide quiz within 20 to 30 hours, which is enough for you to pass the CISSP Exam as well as get the related certification. That is to say, you can pass the CISSP exam as well as getting the related certification only with the minimum of time and efforts under the guidance of our study prep.
| Section | Weight | Objectives |
|---|---|---|
| Security and Risk Management | 16% | - Professional ethics - Legal, regulatory, and ethical issues - Governance, risk management, and compliance - Security principles, concepts, and structures |
| Software Development Security | 10% | - Security in software development lifecycle - Secure coding practices - Software security testing - Security controls in development |
| Security Operations | 13% | - Business continuity and disaster recovery - Security administration - Incident management and response - Security operations concepts - Physical security |
| Security Architecture and Engineering | 13% | - Site and facility security - Security design principles - Cryptography - Security capabilities of information systems - Security models and frameworks |
| Identity and Access Management (IAM) | 13% | - Identity management concepts - Access control mechanisms - Access control attacks and mitigation - Identity and access provisioning |
| Asset Security | 10% | - Asset classification and ownership - Protecting privacy - Asset retention and disposal - Data security controls |
| Communication and Network Security | 13% | - Secure communication channels - Network architecture and design - Network security controls - Network attacks and countermeasures |
| Security Assessment and Testing | 12% | - Vulnerability assessment and remediation - Security control testing - Security audit and review - Assessment and testing strategies |
>> CISSP Examcollection Questions Answers <<
Many customers may be doubtful about our price. The truth is our price is relatively cheap among our peer. The inevitable trend is that knowledge is becoming worthy, and it explains why good CISSP resources, services and data worth a good price. We always put our customers in the first place. Thus we offer discounts from time to time, and you can get 50% discount at the second time you buy our CISSP question dumps after a year. Lower price with higher quality, thatโs the reason why you should choose our CISSP prep guide.
NEW QUESTION # 137
Which of the following is NOT a known type of Message Authentication Code (MAC)?
Answer: C
Explanation:
There is no such thing as a Signature-Based MAC. Being the wrong choice in the
list, it is the best answer to this question.
WHAT IS A Message Authentication Code (MAC)?
In Cryptography, a MAC (Message Authentication Code) also known as a cryptographic
checksum, is a small block of data that is generated using a secret key and then appended to the
message. When the message is received, the recipient can generate their own MAC using the
secret key, and thereby know that the message has not changed either accidentally or
intentionally in transit. Of course, this assurance is only as strong as the trust that the two parties
have that no one else has access to the secret key.
A MAC is a small representation of a message and has the following characteristics:
A MAC is much smaller than the message generating it.
Given a MAC, it is impractical to compute the message that generated it.
Given a MAC and the message that generated it, it is impractical to find another message
generating the same MAC.
See the graphic below from Wikipedia showing the creation of a MAC value:
Message Authentication Code MAC HMAC
In the example above, the sender of a message runs it through a MAC algorithm to produce a
MAC data tag. The message and the MAC tag are then sent to the receiver. The receiver in turn
runs the message portion of the transmission through the same MAC algorithm using the same
key, producing a second MAC data tag. The receiver then compares the first MAC tag received in
the transmission to the second generated MAC tag. If they are identical, the receiver can safely
assume that the integrity of the message was not compromised, and the message was not altered
or tampered with during transmission.
However, to allow the receiver to be able to detect replay attacks, the message itself must contain
data that assures that this same message can only be sent once (e.g. time stamp, sequence
number or use of a one-time MAC). Otherwise an attacker could - without even understanding its
content - record this message and play it back at a later time, producing the same result as the
original sender.
NOTE: There are many ways of producing a MAC value. Below you have a short list of some
implementation.
The following were incorrect answers for this question:
They were all incorrect answers because they are all real type of MAC implementation.
In the case of DES-CBC, a MAC is generated using the DES algorithm in CBC mode, and the
secret DES key is shared by the sender and the receiver. The MAC is actually just the last block of
ciphertext generated by the algorithm. This block of data (64 bits) is attached to the unencrypted
message and transmitted to the far end. All previous blocks of encrypted data are discarded to
prevent any attack on the MAC itself. The receiver can just generate his own MAC using the
secret DES key he shares to ensure message integrity and authentication. He knows that the
message has not changed because the chaining function of CBC would significantly alter the last
block of data if any bit had changed anywhere in the message. He knows the source of the
message (authentication) because only one other person holds the secret key.
A Keyed-hash message authentication code (HMAC) is a specific construction for calculating a
message authentication code (MAC) involving a cryptographic hash function in combination with a
secret cryptographic key. As with any MAC, it may be used to simultaneously verify both the data
integrity and the authentication of a message. Any cryptographic hash function, such as MD5,
SHA-1, may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-
MD5 or HMAC-SHA1 accordingly. The cryptographic strength of the HMAC depends upon the
cryptographic strength of the underlying hash function, the size of its hash output, and on the size
and quality of the key.
A message authentication code based on universal hashing, or UMAC, is a type of message
authentication code (MAC) calculated choosing a hash function from a class of hash functions
according to some secret (random) process and applying it to the message. The resulting digest or fingerprint is then encrypted to hide the identity of the hash function used. As with any MAC, it may be used to simultaneously verify both the data integrity and the authenticity of a message. UMAC is specified in RFC 4418, it has provable cryptographic strength and is usually a lot less computationally intensive than other MACs.
What is the MicMac (confusion) with MIC and MAC? The term message integrity code (MIC) is frequently substituted for the term MAC, especially in communications, where the acronym MAC traditionally stands for Media Access Control when referring to Networking. However, some authors use MIC as a distinctly different term from a MAC; in their usage of the term the MIC operation does not use secret keys. This lack of security means that any MIC intended for use gauging message integrity should be encrypted or otherwise be protected against tampering. MIC algorithms are created such that a given message will always produce the same MIC assuming the same algorithm is used to generate both. Conversely, MAC algorithms are designed to produce matching MACs only if the same message, secret key and initialization vector are input to the same algorithm. MICs do not use secret keys and, when taken on their own, are therefore a much less reliable gauge of message integrity than MACs. Because MACs use secret keys, they do not necessarily need to be encrypted to provide the same level of assurance.
Reference(s) used for this question: Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 15799-15815). Auerbach Publications. Kindle Edition. and http://en.wikipedia.org/wiki/Message_authentication_code and http://tools.ietf.org/html/rfc4418
NEW QUESTION # 138
Which of the following would best describe secondary evidence?
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Secondary evidence is defined as a copy of evidence or oral description of its contents. It is considered not as reliable as best evidence. Evidence that proves or disproves a specific act through oral testimony based on information gathered through he witness's five senses is considered direct evidence. The fact that testimony is given by an expert only affects the witness's ability to offer an opinion instead of only testifying of the facts.
References: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 9: Law, Investigation, and Ethics (page 310).
NEW QUESTION # 139
Which of the following was designed to support multiple network types over the same serial link?
Answer: A
Explanation:
The Point-to-Point Protocol (PPP) was designed to support multiple network types over the same serial link, just as Ethernet supports multiple network types over the same LAN. PPP replaces the earlier Serial Line Internet Protocol (SLIP) that only supports
IP over a serial link. PPTP is a tunneling protocol.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000,
Chapter 3: TCP/IP from a Security Viewpoint.
NEW QUESTION # 140
During an investigation of database theft from an organization's web site, it was determined that the Structured Query Language (SQL) injection technique was used despite input validation with client-side scripting. Which of the following provides the GREATEST protection against the same attack occurring again?
Answer: D
NEW QUESTION # 141
Which of the following is NOT a component of configuration
management?
Answer: B
Explanation:
The correct answer is "Configuration review", a distracter.
*Answer configuration control involves controlling changes to configuration items and issuingversions of configuration items from the software library.
*Configuration status accountingis the processing of changes.
* Configuration audit is the process of controlling the quality of configuration management procedures.
NEW QUESTION # 142
......
ActualTestsIT provide training tools included ISC certification CISSP exam study materials and simulation training questions and more importantly, we will provide you practice questions and answers which are very close with real certification exam. Selecting ActualTestsIT can guarantee that you can in a short period of time to learn and to strengthen the professional knowledge of IT and pass ISC Certification CISSP Exam with high score.
CISSP Examcollection: https://www.actualtestsit.com/ISC/CISSP-exam-prep-dumps.html
What's more, part of that ActualTestsIT CISSP dumps now are free: https://drive.google.com/open?id=1vIdD7gS4p63xi8eQQRDlypCpukeMZpuK