BONUS！！！ GoShiken CISSPダンプの一部を無料でダウンロード：https://drive.google.com/open?id=1e6IFGm_wUA-AKoYjzXMcY83d_SfFjKlV
購入した前にISCのCISSPソフトのような商品の適用性をあなたに感じさせるために、我々はISCのCISSPソフトのデモを提供して、あなたはGoShikenで無料でダウンロードして体験できます。何か疑問があれば、我々の係員を問い合わせたり、メールで我々を連絡したりすることができます。あなたは弊社を選ぶとき、ISCのCISSP試験に合格する最高の方法を選びます。
| Section | Weight | Objectives |
|---|---|---|
| Software Development Security | 11% | - Identify and mitigate vulnerabilities
|
| Security Operations | 13% | - Implement disaster recovery processes
|
| Identity and Access Management | 13% | - Integrate identity as a service
|
| Security Assessment and Testing | 12% | - Design and validate assessment strategies
|
| Security and Risk Management | 15% | - Understand and apply security concepts
|
| Communication and Network Security | 13% | - Implement secure communication channels
|
| Asset Security | 10% | - Identify and classify information and assets
|
| Security Architecture and Engineering | 13% | - Assess vulnerabilities of architectures
|
何事でもはじめが一番難しいです。CISSP試験への復習に悩んでいますか？弊社の提供するソフトを買うのはあなたの必要の第一歩です。弊社の保証がある問題集を入手して、試験に合格するチャンスが大きくなります。疑問がありましたら、GoShikenで無料のデモをダウンロードしてやってみることができます。
質問 # 606
In a data classification scheme, the data is owned by the
正解：A
解説：
In a data classification scheme, the data is owned by the business managers. Business managers are the persons or entities that have the authority and accountability for the creation, collection, processing, and disposal of a set of data. Business managers are also responsible for defining the purpose, value, and classification of the data, as well as the security requirements and controls for the data. Business managers should be able to determine the impact the information has on the mission of the organization, which means assessing the potential consequences of losing, compromising, or disclosing the data. The impact of the information on the mission of the organization is one of the main criteria for data classification, which helps to establish the appropriate level of protection and handling for the data.
質問 # 607
What is the BEST approach to addressing security issues in legacy web applications?
正解：D
解説：
Migrating to newer, supported applications where possible is the best approach to addressing security issues in legacy web applications. Legacy web applications are web applications that are outdated, unsupported, or incompatible with the current technologies and standards. Legacy web applications may have various security issues, such as:
Vulnerabilities and bugs that are not fixed or patched by the developers or vendors Weak or obsolete encryption and authentication mechanisms that are easily broken or bypassed by attackers Lack of compliance with the security policies and regulations that are applicable to the web applications Incompatibility or interoperability issues with the newer web browsers, operating systems, or platforms that are used by the users or clients Migrating to newer, supported applications where possible is the best approach to addressing security issues in legacy web applications, because it can provide several benefits, such as:
Enhancing the security and performance of the web applications by using the latest technologies and standards that are more secure and efficient Reducing the risk and impact of the web application attacks by eliminating or minimizing the vulnerabilities and bugs that are present in the legacy web applications Increasing the compliance and alignment of the web applications with the security policies and regulations that are applicable to the web applications Improving the compatibility and interoperability of the web applications with the newer web browsers, operating systems, or platforms that are used by the users or clients
質問 # 608
Which of the following is a set of data processing elements that increases the performance in a computer by overlapping the steps of different instructions?
正解：D
解説：
Pipelining is a natural concept in everyday life, e.g. on an assembly line. Consider the assembly of a car: assume that certain steps in the assembly line are to install the engine,
install the hood, and install the wheels (in that order, with arbitrary interstitial steps). A car on the
assembly line can have only one of the three steps done at once. After the car has its engine
installed, it moves on to having its hood installed, leaving the engine installation facilities available
for the next car. The first car then moves on to wheel installation, the second car to hood
installation, and a third car begins to have its engine installed. If engine installation takes 20
minutes, hood installation takes 5 minutes, and wheel installation takes 10 minutes, then finishing
all three cars when only one car can be assembled at once would take 105 minutes. On the other
hand, using the assembly line, the total time to complete all three is 75 minutes. At this point,
additional cars will come off the assembly line at 20 minute increments.
In computing, a pipeline is a set of data processing elements connected in series, so that the
output of one element is the input of the next one. The elements of a pipeline are often executed in
parallel or in time-sliced fashion; in that case, some amount of buffer storage is often inserted
between elements. Pipelining is used in processors to allow overlapping execution of multiple
instructions within the same circuitry. The circuitry is usually divided into stages, including
instruction decoding, arithmetic, and register fetching stages, wherein each stage processes one
instruction at a time.
The following were not correct answers:
CISC: is a CPU design where single instructions execute several low-level operations (such as a
load from memory, an arithmetic operation, and a memory store) within a single instruction.
RISC: is a CPU design based on simplified instructions that can provide higher performance as
the simplicity enables much faster execution of each instruction.
Multitasking: is a method where multiple tasks share common processing resources, such as a
CPU, through a method of fast scheduling that gives the appearance of parallelism, but in reality
only one task is being performed at any one time.
Reference:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of
Computer Security, pages 188-189.
Also see
http://en.wikipedia.org/wiki/Pipeline_(computing)
質問 # 609
According to private sector data classification levels, how would salary levels and medical information be classified?
正解：C
解説：
Typically there are three to four levels of information classification used by most organizations: Confidential: Information that, if released or disclosed outside of the organization, would create severe problems for the organization. For example, information that provides a competitive advantage is important to the technical or financial success (like trade secrets, intellectual property, or research designs), or protects the privacy of individuals would be considered confidential. Information may include payroll information, health records, credit information, formulas, technical designs, restricted regulatory information, senior management internal correspondence, or business strategies or plans. These may also be called top secret, privileged, personal, sensitive, or highly confidential. In other words this information is ok within a defined group in the company such as marketing or sales, but is not suited for release to anyone else in the company without permission.
The following answers are incorrect: Public: Information that may be disclosed to the general public without concern for harming the company, employees, or business partners. No special protections are required, and information in this category is sometimes referred to as unclassified. For example, information that is posted to a company's public Internet site, publicly released announcements, marketing materials, cafeteria menus, and any internal documents that would not present harm to the company if they were disclosed would be classified as public. While there is little concern for confidentiality, integrity and availability should be considered.
Internal Use Only: Information that could be disclosed within the company, but could harm the company if disclosed externally. Information such as customer lists, vendor pricing, organizational policies, standards and procedures, and internal organization announcements would need baseline security protections, but do not rise to the level of protection as confidential information. In other words, the information may be used freely within the company but any unapproved use outside the company can pose a chance of harm.
Restricted: Information that requires the utmost protection or, if discovered by unauthorized personnel, would cause irreparable harm to the organization would have the highest level of
classification. There may be very few pieces of information like this within an organization, but
data classified at this level requires all the access control and protection mechanisms available to
the organization. Even when information classified at this level exists, there will be few copies of it
Reference(s) Used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 952-976). Auerbach Publications. Kindle Edition.
質問 # 610
When conducting a third-party risk assessment of a new supplier, which of the following reports should be reviewed to confirm the operating effectiveness of the security, availability, confidentiality, and privacy trust principles?
正解：D
解説：
Service Organization Control (SOC) reports are audit reports that provide information about the internal controls and processes of a service organization, such as a cloud provider, a data center, or a payroll service. There are three types of SOC reports: SOC 1, SOC 2, and SOC 3. SOC 1 reports focus on the controls that affect the financial reporting of the user entities (the clients of the service organization). SOC 2 reports focus on the controls that affect the security, availability, confidentiality, and privacy of the user entities' data and systems, as well as the processing integrity of the service organization. SOC 3 reports are similar to SOC 2 reports, but they are less detailed and more accessible to the general public. Each SOC report can be either Type 1 or Type 2. Type 1 reports describe the design and implementation of the controls at a specific point in time. Type 2 reports describe the operating effectiveness of the controls over a period of time, usually six to twelve months. When conducting a third-party risk assessment of a new supplier, the best report to review to confirm the operating effectiveness of the security, availability, confidentiality, and privacy trust principles is the SOC 2, Type 2 report. This report provides assurance that the service organization has implemented and maintained the controls that are relevant to the protection of the user entities' data and systems, and that the controls have been tested and verified by an independent auditor. International Organization for Standardization (ISO) 27001 and ISO 27002 are not audit reports, but rather standards for information security management systems (ISMS). ISO 27001 specifies the requirements for establishing, implementing, maintaining, and improving an ISMS. ISO 27002 provides guidelines and best practices for implementing the controls of the ISMS. While these standards can be used as a reference for evaluating the security posture of a service organization, they do not provide the same level of assurance and evidence as a SOC 2, Type 2 report.
質問 # 611
......
君はまだISC CISSP認証試験を通じての大きい難度が悩んでいますか？ 君はまだISC CISSP認証試験に合格するために寝食を忘れて頑張って復習しますか？ 早くてISC CISSP認証試験を通りたいですか？GoShikenを選択しましょう！GoShikenはきみのIT夢に向かって力になりますよ。
CISSP参考書: https://www.goshiken.com/ISC/CISSP-mondaishu.html
BONUS！！！ GoShiken CISSPダンプの一部を無料でダウンロード：https://drive.google.com/open?id=1e6IFGm_wUA-AKoYjzXMcY83d_SfFjKlV