BONUS!!! Download part of Pass4cram CISSP dumps for free: https://drive.google.com/open?id=1_x_DTErhzLjXH0XGeEP8EAks1bH4qq5b
Therefore, you have the option to use ISC CISSP PDF questions anywhere and anytime. CISSP dumps are designed according to the Certified Information Systems Security Professional (CISSP) (CISSP) certification exam standard and have hundreds of questions similar to the actual CISSP Exam. Pass4cram Certified Information Systems Security Professional (CISSP) (CISSP) web-based practice exam software also works without installation.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Security and Risk Management | 15% | - Apply supply chain risk management concepts
|
| Topic 2: Identity and Access Management | 13% | - Manage identification and authentication
|
| Topic 3: Security Architecture and Engineering | 13% | - Research and implement security models
|
| Topic 4: Communication and Network Security | 13% | - Implement secure communication channels
|
| Topic 5: Software Development Security | 11% | - Identify and mitigate vulnerabilities
|
| Topic 6: Security Assessment and Testing | 12% | - Collect and analyze test outputs
|
| Topic 7: Security Operations | 13% | - Operate and maintain preventive measures
|
| Topic 8: Asset Security | 10% | - Identify and classify information and assets
|
If you prefer to Practice CISSP Exam dumps on paper, you can try the exam dumps of us. CISSP PDF version is printable, and you can take some notes on it and can practice them anytime. Besides through using CISSP e questions and answers of us, you can pass the exam and get a certificate successfully. We offer you pass guarantee and money back guarantee if you fail to pass the exam. Once you have made your decision, just add them into your cart and pay for it, we will send the downloading link in ten minutes.
NEW QUESTION # 866
Which of the following is NOT an advantage of a stream cipher?
Answer: A
Explanation:
The transmitter and receiver must be synchronized since they must
use the same keystream bits for the same bits of the text that are to be enciphered and deciphered. Usually, synchronizing frames must be sent to effect the synchronization and, thus, additional overhead is required for the transmissions.
* Answer "The same equipment can be used for encryption and decryption" describes an advantage since stream ciphers commonly use Linear Feedback Shift Registers (LFSRs) to generate the keystream and use XORs to operate on the plaintext input stream.
Because of the characteristics of the XOR, the same XOR gates and LFSRs can also decrypt the message. Since LFSRs and XORs are used in a stream cipher to encrypt and decrypt, these components are amenable to hardware implementation, which means higher speeds of operation. Thus, answer "It is amenable to hardware implementations that result in higher speeds" describes an advantage.
For answer "Since encryption takes place bit by bit, there is no error propagation", stream ciphers encrypt individual bits with no feedback of the generated ciphertext bits and, therefore, errors do not propagate.
NEW QUESTION # 867
When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?
Answer: A
Explanation:
The question mentions clearly "operating together". Which means the BEST answer is Dual Control.
Two mechanisms necessary to implement high integrity environments where separation of duties is paramount are dual control or split knowledge.
Dual control enforces the concept of keeping a duo responsible for an activity. It requires more than one employee available to perform a task. It utilizes two or more separate entities (usually persons), operating together, to protect sensitive functions or information.
Whenever the dual control feature is limited to something you know., it is often called split knowledge (such as part of the password, cryptographic keys etc.) Split knowledge is the unique "what each must bring" and joined together when implementing dual control.
To illustrate, let say you have a box containing petty cash is secured by one combination lock and one keyed lock. One employee is given the combination to the combo lock and another employee has possession of the correct key to the keyed lock. In order to get the cash out of the box both employees must be present at the cash box at the same time. One cannot open the box without the other. This is the aspect of dual control. On the other hand, split knowledge is exemplified here by the different objects (the combination to the combo lock and the correct physical key), both of which are unique and necessary, that each brings to the meeting.
This is typically used in high value transactions / activities (as per the organizations risk appetite) such as:
Approving a high value transaction using a special user account, where the password of this user account is split into two and managed by two different staff. Both staff should be present to enter the password for a high value transaction. This is often combined with the separation of duties principle. In this case, the posting of the transaction would have been performed by another staff. This leads to a situation where collusion of at least 3 people are required to make a fraud transaction which is of high value.
Payment Card and PIN printing is separated by SOD principles. Now the organization can even enhance the control mechanism by implementing dual control / split knowledge. The card printing activity can be modified to require two staff to key in the passwords for initiating the printing process. Similarly, PIN printing authentication can also be made to be implemented with dual control. Many Host Security modules (HSM) comes with built in controls for dual controls where physical keys are required to initiate the PIN printing process.
Managing encryption keys is another key area where dual control / split knowledge to be implemented.
PCI DSS defines Dual Control as below. This is more from a cryptographic perspective, still useful:
Dual Control: Process of using two or more separate entities (usually persons) operating in concert to protect sensitive functions or information. Both entities are equally responsible for the physical protection of materials involved in vulnerable transactions. No single person is permitted to access or use the materials (for example, the cryptographic key). For manual key generation, conveyance, loading, storage, and retrieval, dual control requires dividing knowledge of the key among the entities. (See also Split Knowledge).
Split knowledge: Condition in which two or more entities separately have key components that individually convey no knowledge of the resultant cryptographic key.
It is key for information security professionals to understand the differences between Dual Control and Separation of Duties. Both complement each other, but are not the same.
The following were incorrect answers:
Segregation of Duties address the splitting of various functions within a process to different users so that it will not create an opportunity for a single user to perform conflicting tasks.
For example, the participation of two or more persons in a transaction creates a system of checks and balances and reduces the possibility of fraud considerably. So it is important for an organization to ensure that all tasks within a process has adequate separation.
Let us look at some use cases of segregation of duties
A person handling cash should not post to the accounting records A loan officer should not disburse loan proceeds for loans they approved Those who have authority to sign cheques should not reconcile the bank accounts The credit card printing personal should not print the credit card PINs Customer address changes must be verified by a second employee before the change can be activated.
In situations where the separation of duties are not possible, because of lack of staff, the senior management should set up additional measure to offset the lack of adequate controls. To summarise, Segregation of Duties is about Separating the conflicting duties to reduce fraud in an end to end function.
Need To Know (NTK): The term "need to know", when used by government and other organizations (particularly those related to the military), describes the restriction of data which is considered very sensitive. Under need-to-know restrictions, even if one has all the necessary official approvals (such as a security clearance) to access certain information, one would not be given access to such information, unless one has a specific need to know; that is, access to the information must be necessary for the conduct of one's official duties. As with most security mechanisms, the aim is to make it difficult for unauthorized access to occur, without inconveniencing legitimate access. Need-toknow also aims to discourage "browsing" of sensitive material by limiting access to the smallest possible number of people.
EXAM TIP: HOW TO DECIPHER THIS QUESTION
First, you probably nototiced that both Separation of Duties and Segregation of Duties are
synonymous with each others. This means they are not the BEST answers for sure. That was an
easy first step.
For the exam remember:
Separation of Duties is synonymous with Segregation of Duties
Dual Control is synonymous with Split Knowledge
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 16048-16078). Auerbach Publications. Kindle Edition.
and
http://www.ciso.in/dual-control-or-segregation-of-duties/
NEW QUESTION # 868
A channel within a computer system or network that is designed for the authorized transfer of information is identified as a(n)?
Answer: A
Explanation:
"An overt channel is a channel of communication that was developed specifically for communication purposes. Processes should be communicating through overt channels, not covert channels." Pg 237 Shon Harris: All-In-One CISSP Certification Guide.
NEW QUESTION # 869
When it comes to magnetic media sanitization, what difference can be made between clearing and purging information?
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The removal of information from a storage medium is called sanitization. Different kinds of sanitization provide different levels of protection. A distinction can be made between clearing information (rendering it unrecoverable by a keyboard attack) and purging (rendering it unrecoverable against laboratory attack).
There are three general methods of purging media: overwriting, degaussing, and destruction.
There should be continuous assurance that sensitive information is protected and not allowed to be placed in a circumstance wherein a possible compromise can occur. There are two primary levels of threat that the protector of information must guard against: keyboard attack (information scavenging through system software capabilities) and laboratory attack (information scavenging through laboratory means).
Procedures should be implemented to address these threats before the Automated Information System (AIS) is procured, and the procedures should be continued throughout the life cycle of the AIS.
Incorrect Answers:
A: It is not true that clearing completely erases the media or that purging only removes file headers, allowing the recovery of files.
C: Clearing does not involve rewriting the media.
D: It is not true that clearing renders information unrecoverable against a laboratory attack or purging renders information unrecoverable to a keyboard attack.
NEW QUESTION # 870
During the Security Assessment and Authorization process, what is the PRIMARY purpose for conducting a hardware and software inventory?
Answer: A
Explanation:
Section: Software Development Security
NEW QUESTION # 871
......
If you want to get a higher salary or a promotion on your position, you need to work harder! Purchase our CISSP learning materials and stick with it. Then your strength will protect you. For as long as you study with our CISSP exam questions, then you will find that the content of our CISSP praparation braindumps is all the hot hit of the newest knowledage and keypoints of the subject, you will learn so much to master the skills which will help you solve your problems in your work. And besides, you can achieve the certification for sure with our CISSP study guide.
CISSP Relevant Questions: https://www.pass4cram.com/CISSP_free-download.html
DOWNLOAD the newest Pass4cram CISSP PDF dumps from Cloud Storage for free: https://drive.google.com/open?id=1_x_DTErhzLjXH0XGeEP8EAks1bH4qq5b