BONUS!!! 免費下載Testpdf CISSP考試題庫的完整版：https://drive.google.com/open?id=13ovU41UpSwYseewru7DYGW2_b4q7pcoo
不要再因為準備一個考試浪費太多的時間了。快點購買Testpdf的CISSP考古題吧。有了這個考古題，你將更好地知道該怎麼準備考試才更有效率。這是一個可以讓你輕鬆就通過考試的難得的工具，錯過這個機會你將會後悔。所以，不要犹豫赶紧行动吧。
| Section | Weight | Objectives |
|---|---|---|
| Security Architecture and Engineering | 13% | - Security Models and Frameworks - Secure Design Principles |
| Security Assessment and Testing | 12% | - Audit Processes - Security Testing Methods |
| Security and Risk Management | 14% | - Security Governance Principles - Professional Ethics - Compliance and Legal Requirements |
| Software Development Security | 11% | - Application Security Controls - Secure Software Development Lifecycle (SDLC) |
| Communication and Network Security | 13% | - Secure Network Components - Network Architecture and Design |
| Asset Security | 10% | - Information and Asset Classification - Data Lifecycle Management |
| Identity and Access Management (IAM) | 13% | - Authentication and Authorization - Identity Lifecycle Management |
| Security Operations | 13% | - Disaster Recovery and Business Continuity - Incident Response |
Testpdf擁有龐大的IT專家團隊，他們不斷利用自己的知識和經驗研究很多過去幾年的IT認證考試試題。他們的研究成果即是我們的Testpdf的產品，因此Testpdf提供的ISC CISSP練習題和真實的考試練習題有很大的相似性，可以幫助很多人實現他們的夢想。Testpdf可以確保你成功通過考試，你是可以大膽地將Testpdf加入你的購物車。有了Testpdf你的夢想馬上就可以實現了。
問題 #1125
Which of the following control helps to identify an incident's activities and potentially an intruder?
答案：D
解題說明：
Detective control helps identify an incident's activities and potentially an intruder For your exam you should know below information about different security controls
Deterrent Controls Deterrent Controls are intended to discourage a potential attacker. Access controls act as a deterrent to threats and attacks by the simple fact that the existence of the control is enough to keep some potential attackers from attempting to circumvent the control. This is often because the effort required to circumvent the control is far greater than the potential reward if the attacker is successful, or, conversely, the negative implications of a failed attack (or getting caught) outweigh the benefits of success. For example, by forcing the identification and authentication of a user, service, or application, and all that it implies, the potential for incidents associated with the system is significantly reduced because an attacker will fear association with the incident. If there are no controls for a given access path, the number of incidents and the potential impact become infinite. Controls inherently reduce exposure to risk by applying oversight for a process. This oversight acts as a deterrent, curbing an attacker's appetite in the face of probable repercussions. The best example of a deterrent control is demonstrated by employees and their propensity to intentionally perform unauthorized functions, leading to unwanted events. When users begin to understand that by authenticating into a system to perform a function, their activities are logged and monitored, and it reduces the likelihood they will attempt such an action. Many threats are based on the anonymity of the threat agent, and any potential for identification and association with their actions is avoided at all costs. It is this fundamental reason why access controls are the key target of circumvention by attackers. Deterrents also take the form of potential punishment if users do something unauthorized. For example, if the organization policy specifies that an employee installing an unauthorized wireless access point will be fired, that will determine most employees from installing wireless access points.
Preventative Controls Preventive controls are intended to avoid an incident from occurring. Preventative access controls keep a user from performing some activity or function. Preventative controls differ from deterrent controls in that the control is not optional and cannot (easily) be bypassed. Deterrent controls work on the theory that it is easier to obey the control rather than to risk the consequences of bypassing the control. In other words, the power for action resides with the user (or the attacker). Preventative controls place the power of action with the system, obeying the control is not optional. The only way to bypass the control is to find a flaw in the control's implementation.
Compensating Controls Compensating controls are introduced when the existing capabilities of a system do not support the requirement of a policy. Compensating controls can be technical, procedural, or managerial. Although an existing system may not support the required controls, there may exist other technology or processes that can supplement the existing environment, closing the gap in controls, meeting policy requirements, and reducing overall risk. For example, the access control policy may state that the authentication process must be encrypted when performed over the Internet. Adjusting an application to natively support encryption for authentication purposes may be too costly. Secure Socket Layer (SSL), an encryption protocol, can be employed and layered on top of the authentication process to support the policy statement. Other examples include a separation of duties environment, which offers the capability to isolate certain tasks to compensate for technical limitations in the system and ensure the security of transactions. In addition, management processes, such as authorization, supervision, and administration, can be used to compensate for gaps in the access control environment.
Detective Controls Detective controls warn when something has happened, and are the earliest point in the post-incident timeline. Access controls are a deterrent to threats and can be aggressively utilized to prevent harmful incidents through the application of least privilege. However, the detective nature of access controls can provide significant visibility into the access environment and help organizations manage their access strategy and related security risk. As mentioned previously, strongly managed access privileges provided to an authenticated user offer the ability to reduce the risk exposure of the enterprise's assets by limiting the capabilities that authenticated user has. However, there are few options to control what a user can perform once privileges are provided. For example, if a user is provided write access to a file and that file is damaged, altered, or otherwise negatively impacted (either deliberately or unintentionally), the use of applied access controls will offer visibility into the transaction. The control environment can be established to log activity regarding the identification, authentication, authorization, and use of privileges on a system. This can be used to detect the occurrence of errors, the attempts to perform an unauthorized action, or to validate when provided credentials were exercised. The logging system as a detective device provides evidence of actions (both successful and unsuccessful) and tasks that were executed by authorized users.
Corrective Controls When a security incident occurs, elements within the security infrastructure may require corrective actions. Corrective controls are actions that seek to alter the security posture of an environment to correct any deficiencies and return the environment to a secure state. A security incident signals the failure of one or more directive, deterrent, preventative, or compensating controls. The detective controls may have triggered an alarm or notification, but now the corrective controls must work to stop the incident in its tracks. Corrective controls can take many forms, all depending on the particular situation at hand or the particular security failure that needs to be dealt with.
Recovery Controls Any changes to the access control environment, whether in the face of a security incident or to offer temporary compensating controls, need to be accurately reinstated and returned to normal operations. There are several situations that may affect access controls, their applicability, status, or management. Events can include system outages, attacks, project changes, technical demands, administrative gaps, and full-blown disaster situations. For example, if an application is not correctly installed or deployed, it may adversely affect controls placed on system files or even have default administrative accounts unknowingly implemented upon install. Additionally, an employee may be transferred, quit, or be on temporary leave that may affect policy requirements regarding separation of duties. An attack on systems may have resulted in the implantation of a Trojan horse program, potentially exposing private user information, such as credit card information and financial data. In all of these cases, an undesirable situation must be rectified as quickly as possible and controls returned to normal operations.
The following answers are incorrect:
Deterrent - Deterrent controls are intended to discourage a potential attacker
Preventive - Preventive controls are intended to avoid an incident from occurring
Compensating - Compensating Controls provide an alternative measure of control
The following reference(s) were/was used to create this question:
CISA Review Manual 2014 Page number 44 and Official ISC2 CISSP guide 3rd edition Page number 50 and 51
問題 #1126
Which of the following will have the MOST influence on the definition and creation of data classification and data ownership policies?
答案：B
問題 #1127
A gap analysis for Privacy
答案：C
問題 #1128
What would you call an attack where an attacker can influence the state of the resource between check and use?
This attack can happen with shared resources such as files, memory, or even variables in multithreaded programs. This can cause the software to perform invalid actions when the resource is in an unexpected state. The steps followed by this attack are usually the following: the software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
答案：D
解題說明：
The TOCTTOU acronym expands to "Time Of Check To Time Of Use". It is a type of File Access Race Condition.
The software checks the state of a resource before using that resource, but the resource's state
can change between the check and the use in a way that invalidates the results of the check. This
can cause the software to perform invalid actions when the resource is in an unexpected state.
This weakness can be security-relevant when an attacker can influence the state of the resource
between check and use. This can happen with shared resources such as files, memory, or even
variables in multithreaded programs.
See the reference below for more details and examples of how this attack could be carried out.
WHAT ARE RACE CONDITIONS:
A race condition or race hazard is the behavior of an electronic or software system where the
output is dependent on the sequence or timing of other uncontrollable events. It becomes a bug
when events do not happen in the order the programmer intended. The term originates with the
idea of two signals racing each other to influence the output first.
Race conditions can occur in electronics systems, especially logic circuits, and in computer
software, especially multithreaded or distributed programs.
Race conditions arise in software when an application depends on the sequence or timing of
processes or threads for it to operate properly. As with electronics, there are critical race
conditions that result in invalid execution and bugs as well as non-critical race-conditions that
result in unanticipated behavior. Critical race conditions often happen when the processes or
threads depend on some shared state. Operations upon shared states are critical sections that
must be mutually exclusive. Failure to obey this rule opens up the possibility of corrupting the
shared state.
Race conditions have a reputation of being difficult to reproduce and debug, since the end result is
nondeterministic and depends on the relative timing between interfering threads. Problems
occurring in production systems can therefore disappear when running in debug mode, when
additional logging is added, or when attaching a debugger, often referred to as a "Heisenbug". It is
therefore better to avoid race conditions by careful software design rather than attempting to fix
them afterwards.
The following answers are incorrect:
All of the other choices are incorrect and only bogus detractors
The following reference(s) were/was used to create this question:
http://cwe.mitre.org/data/definitions/367.html
and
https://www.owasp.org/index.php/File_Access_Race_Condition:_TOCTOU
and
http://en.wikipedia.org/wiki/Race_condition
問題 #1129
Of the various types of "Hackers" that exist, the ones who are not worried about being caught and spending time in jail and have a total disregard for the law or police force, are labeled as what type of hackers?
答案：A
解題說明：
Suicide Hackers are a type of hackers without fear, who disregard the authority, the police, or law. Suicide Hackers hack for a cause important to them and find the end goal more important than their individual freedom.
The term "Hacker" originally meant a Unix computer enthusiast but has been villainized in the media as a "Criminal Hacker" for a mass audience. A hacker used to be known as a good person who would add functionality within software or would make things work better.
To most people today "Hacker" means criminal "Criminal Cracker", it is synonymous with
Cracker or someone who get access to a system without the owner authorization.
As seen in news reports in 2011 and later hackers associated with the "Anonymous" movement have attacked finance and/or credit card companies, stolen enough information to make contributions to worthy charities on behalf of organizations they see as contrary to the public good. These sorts of attackers/hackers could be considered suicide hackers.
Some did get caught and prosecuted while carrying out their cause. Nobody can know if they knew their activities would land them in court and/or prison but they had to have known of the risk and proceeded anyway.
The following answers are incorrect:
Black Hat hackers are also known as crackers and are merely hackers who "violates computer security for little reason beyond maliciousness or for personal gain". Black Hat
Hackers are "the epitome of all that the public fears in a computer criminal". Black Hat
Hackers break into secure networks to destroy data or make the network unusable for those who are authorized to use the network.
White Hat Hackers are law-abiding, reputable experts defending assets and not breaking laws. A white hat hacker breaks security for non-malicious reasons, for instance testing their own security system. The term "white hat" in Internet slang refers to an ethical hacker.
This classification also includes individuals who perform penetration tests and vulnerability assessments within a contractual agreement. Often, this type of 'white hat' hacker is called an ethical hacker. The International Council of Electronic Commerce Consultants, also known as the EC-Council has developed certifications, courseware, classes, and online training covering the diverse arena of Ethical Hacking.
Note about White Hat: As reported by Adin Kerimov, a white hat would not be worried about going to jail as he is doing a test with authorization as well and he has a signed agreement. While this is a true point he BEST choice is Suicide Hackers for the purpose of the exam, a white hat hacker would not disregard law and the autority. .
Gray Hat Hackers work both offensively and defensively and can cross the border between legal/ethical behavior and illegal/unethical behavior. A grey hat hacker is a combination of a
Black Hat and a White Hat Hacker. A Grey Hat Hacker may surf the internet and hack into a computer system for the sole purpose of notifying the administrator that their system has been hacked, for example. Then they may offer to repair their system for a small fee.
OTHER TYPES OF HACKERS
Elite hacker is a social status among hackers, elite is used to describe the most skilled.
Newly discovered exploits will circulate among these hackers. Elite groups such as Masters of Deception conferred a kind of credibility on their members.
Script kiddie A script kiddie(or skiddie) is a non-expert who breaks into computer systems by using pre-packaged automated tools written by others, usually with little understanding of the underlying concept-hence the term script (i.e. a prearranged plan or set of activities) kiddie (i.e. kid, child-an individual lacking knowledge and experience, immature). Often time they do not even understand how they are taken advantage of the system, they do not underrstand the weakness being exploited, all they know is how to use a tool that somone else has built.
Neophyte A neophyte, "n00b", or "newbie" is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking.
Hacktivist A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hacktivism involves website defacement or denial-of-service attacks.
The following reference(s) were/was used to create this question:
2 011. EC-COUNCIL Official Curriculum, Ethical Hacking and Countermeasures, v7.1,
Module 1, Page. 15.
and
https://en.wikipedia.org/wiki/Hacker_%28computer_security%29
問題 #1130
......
想要通過CISSP認證考試？擔心考試會變體，來嘗試最新版本的題庫學習資料。我們提供的ISC CISSP考古題準確性高，品質好，是你想通過考試最好的選擇，也是你成功的保障。你可以免費下載100%準確的CISSP考古題資料，我們所有的ISC產品都是最新的，這是經過認證的網站。它覆蓋接近95%的真實問題和答案，快來訪問Testpdf網站，獲取免費的CISSP題庫試用版本吧！
CISSP考題免費下載: https://www.testpdf.net/CISSP.html
BONUS!!! 免費下載Testpdf CISSP考試題庫的完整版：https://drive.google.com/open?id=13ovU41UpSwYseewru7DYGW2_b4q7pcoo