Free ISC2 Certified Information Systems Security Professional CISSP Exam Questions

The primary characteristic of a Distributed Denial of Service (DDoS) attack is that it looks like normal network activity. A DDoS attack is a type of attack or a threat that aims or intends to disrupt or to degrade the availability or the performance of a system or a service, by overwhelming or flooding the system or the service with a large amount or a high volume of traffic or requests, from multiple or distributed sources or locations, such as the compromised or infected computers, devices, or networks, that are controlled or coordinated by the attacker or the malicious actor. The primary characteristic of a DDoS attack is that it looks like normal network activity, which means that it is difficult or challenging to detect or to prevent the DDoS attack, as it is hard or impossible to distinguish or to differentiate the legitimate or the authentic traffic or requests from the illegitimate or the malicious traffic or requests, and as it is hard or impossible to block or to filter the illegitimate or the malicious traffic or requests, without affecting or impacting the legitimate or the authentic traffic or requests.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4, page 115;Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4, page 172

Identification of data location is a must-have clause in a contract to support electronic discovery of data stored in a cloud environment.Electronic discovery, or e-discovery, is the process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information (ESI) that is relevant to a legal case or investigation1. In a cloud environment, where data may be stored in multiple locations, jurisdictions, or servers, it is essential to have a clear and contractual agreement on how and where the data can be accessed, retrieved, and produced for e-discovery purposes. Identification of data location can help ensure the availability, integrity, and admissibility of the data as evidence.Integration with organizational directory services for authentication, tokenization of data, and accommodation of hybrid deployment models are not mandatory clauses for e-discovery support, as they are more related to the security, privacy, and flexibility of the cloud service, rather than the legal aspects of data discovery.Reference:1: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 10, page 647.

The recommended alternative to an integrated email encryption system is to encrypt sensitive data separately in attachments. An integrated email encryption system is a system or a service that provides or offers the encryption or the protection for the email messages or the email communications, by using or applying the cryptographic techniques or the mechanisms, such as the public key encryption, the symmetric key encryption, or the digital signatures. An integrated email encryption system can protect the confidentiality, the integrity, or the authenticity of the email messages or the email communications, as it can prevent or reduce the risk of unauthorized or inappropriate access, disclosure, modification, or spoofing of the email messages or the email communications by the third parties or the attackers who intercept or capture the email messages or the email communications over the network. However, an integrated email encryption system can also have some limitations or challenges, such as the compatibility, the usability, or the cost. Therefore, the recommended alternative to an integrated email encryption system is to encrypt sensitive data separately in attachments, which means that instead of encrypting the entire email message or the email communication, only the sensitive data or the information that is attached or appended to the email message or the email communication, such as the documents, the files, or the images, are encrypted or protected, using the cryptographic techniques or the mechanisms, such as the password, the passphrase, or the key. Encrypting sensitive data separately in attachments can provide a similar level of security or protection for the email messages or the email communications, as it can prevent or reduce the risk of unauthorized or inappropriate access, disclosure, modification, or spoofing of the sensitive data or the information by the third parties or the attackers who intercept or capture the email messages or the email communications over the network, and it can also overcome or address some of the limitations or challenges of the integrated email encryption system, such as the compatibility, the usability, or the cost.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4, page 116;Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4, page 173

The most appropriate action when reusing media that contains sensitive data is to sanitize the media. Sanitization is the process of removing or destroying all data from the media in such a way that it cannot be recovered by any means. Sanitization can be achieved by various methods, such as overwriting, degaussing, or physical destruction. Sanitization ensures that the sensitive data is not exposed or compromised when the media is reused or disposed of. Erase, encrypt, and degauss are not the most appropriate actions when reusing media that contains sensitive data, although they may be related or useful steps. Erase is the process of deleting data from the media by using the operating system or application commands or functions. Erase does not guarantee that the data is completely removed from the media, as it may leave traces or remnants that can be recovered by using special tools or techniques. Encrypt is the process of transforming data into an unreadable form by using a cryptographic algorithm and a key. Encrypt can protect the data from unauthorized access or disclosure, but it does not remove the data from the media. Encrypt also requires that the key is securely managed and stored, and that the encryption algorithm is strong and reliable. Degauss is the process of applying a strong magnetic field to the media to erase or scramble the data. Degauss can effectively sanitize magnetic media, such as hard disks or tapes, but it does not work on optical media, such as CDs or DVDs. Degauss also renders the media unusable, as it destroys the servo tracks and the firmware that are needed for the media to function properly.

Two-factor authentication (2FA) is a method of authentication that requires two independent factors to verify the identity of a user. The factors are usually classified into three categories: something you know (such as a password or a PIN), something you have (such as a hardware token or a smart card), and something you are (such as a fingerprint or a retinal scan). A hardware token and a password provide the most secure means of authentication among the given options, as they belong to different categories and are less susceptible to theft, duplication, or compromise. A username and a PIN are both something you know, and thus do not constitute 2FA. A fingerprint and a retinal scanner are both something you are, and thus do not constitute 2FA. A Short Message Service (SMS) and a smartphone authenticator are both something you have, and thus do not constitute 2FA. Moreover, SMS is not a secure channel for transmitting authentication codes, as it can be intercepted or spoofed by attackers.Reference:1,2,6

The primary concern regarding the database information, aside from the potential records which may have been viewed, is the unauthorized database changes. The unauthorized database changes are the modifications or the alterations of the database information or structure, such as the data values, the data types, the data formats, the data relationships, or the data schemas, by an unauthorized individual or a malicious actor, such as the one who accessed the system hosting the database. The unauthorized database changes can compromise the integrity, the accuracy, the consistency, and the reliability of the database information, and can cause serious damage or harm to the organization's operations, decisions, or reputation. The unauthorized database changes can also affect the availability, the performance, or the functionality of the database, and can create or exploit the vulnerabilities or the weaknesses of the database. Integrity of security logs, availability of the database, and confidentiality of the incident are not the primary concerns regarding the database information, aside from the potential records which may have been viewed, as they are related to the evidence, the accessibility, or the secrecy of the security incident, not the modification or the alteration of the database information.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7, Security Operations, page 865.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 7, Security Operations, page 881.

Penetration testing is a type of test that an organization performs in order to locate and target exploitable defects in its information systems and networks. Penetration testing simulates a real-world attack scenario, where a tester, also known as a penetration tester or ethical hacker, tries to find and exploit the vulnerabilities in the system or network, using the same tools and techniques as a malicious attacker. The goal of penetration testing is to identify the weaknesses and gaps in the security posture of the organization, and to provide recommendations and solutions to mitigate or eliminate them. Penetration testing can help the organization improve its security awareness, compliance, and resilience, and prevent potential breaches or incidents.

A bastion host is a hardened system that acts as a gateway between a secure environment and an untrusted network, such as the internet. A bastion host can be used to maintain network separation from a secure environment while allowing remote users to work in the secure environment, by providing controlled access and logging services. A bastion host can also implement additional security measures, such as encryption, authentication, and firewalls, to protect the communication and data. Reference: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4: Communication and Network Security, page 181; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4: Communication and Network Security, page 255]

Business continuity planning (BCP) is a process of identifying, analyzing, and preparing for the potential impacts of disruptive events on the organization's critical business functions and processes. BCP involves developing and implementing strategies and plans to ensure the continuity and recovery of the organization's operations in the event of a disaster or disruption. One of the strategies and plans for BCP is to establish an alternate facility, which is a location, other than the normal facility, that can be used to resume the business functions and processes in case the normal facility is unavailable or unusable. There are different types of alternate facilities, depending on the level of readiness and resources they provide. A warm site is an area partially equipped with equipment and resources to recover business functions, but it requires some additional setup and configuration before it can be fully operational. A warm site typically has some hardware, software, network, and backup systems in place, but it may not have the most current data or applications. A warm site can usually become operational within a few hours or days. Therefore, the correct answer is B. The other options are incorrect because they describe different types of alternate facilities. A hot site is an alternate facility that allows for immediate cutover to enable continuation of business functions. A hot site is fully equipped and configured with the most current data and applications, and it can be activated within minutes or seconds. A cold site is a place void of any resources or equipment except air conditioning and raised flooring. A cold site requires a lot of setup and installation before it can be used to recover business functions, and it can take several days or weeks to become operational. A mobile site is a location, other than the normal facility, used to process data on a daily basis. A mobile site is a portable facility that can be moved and deployed quickly to any location, and it usually has limited capacity and functionality.Reference:Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 8: Security Operations, Section: Foundational Security Operations Concepts, Subsection: Business Continuity Planning and Disaster Recovery Planning;CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Security Operations, Section: Business Continuity and Disaster Recovery Planning.

The primary motivation for writing a data retention policy based on applicable laws is to dispose of data in order to limit liability. A data retention policy is a document that defines the rules and guidelines for retaining and disposing of the data that is created, received, or maintained by an organization. A data retention policy is based on various factors, such as the business needs, the legal requirements, the regulatory compliance, and the security risks of the data. The main purpose of a data retention policy is to dispose of the data that is no longer needed, used, or relevant for the organization, in order to limit the liability that may arise from keeping the data. For example, if the data is subject to litigation, discovery, or breach, the organization may face legal, financial, or reputational consequences. By disposing of the data according to the data retention policy, the organization can reduce the exposure and damage of the data, and avoid unnecessary costs and penalties.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 21.CISSP Practice Exam | Boson, Question 9.

Encasing exposed cable runs in metal conduit is the most effective countermeasure to prevent electromagnetic emanations on unshielded data cable. Electromagnetic emanations are the unintentional radiation of electromagnetic signals from electronic devices, such as computers, monitors, or cables. These signals can be intercepted and analyzed by attackers to obtain sensitive information. Unshielded data cable, such as twisted pair or coaxial cable, is more susceptible to electromagnetic emanations than shielded cable, such as fiber optic cable. Encasing unshielded cable in metal conduit can reduce the amount of emanations and provide physical protection from tampering. Reference: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4: Communication and Network Security, page 164; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4: Communication and Network Security, page 238]

The most likely step to determine the cause of the issue is to verify the session time-out configuration on the captive portal settings. A captive portal is a web page that requires the user to authenticate or accept some terms of service before accessing the Internet through a wireless network. A session time-out is a parameter that defines how long the user can stay connected to the network without re-authenticating or re-accepting the terms of service. If the session time-out is set too low, the user may experience intermittent Internet connectivity, as they will have to disconnect and reconnect frequently, using the web authentication process each time. The network administrator can check the session time-out configuration on the captive portal settings and adjust it accordingly to prevent or reduce the issue. The other options are less likely to determine the cause of the issue, as they either do not relate to the web authentication process, do not explain the intermittent connectivity, or do not match the network administrator's observation.Reference:CISSP - Certified Information Systems Security Professional, Domain 4. Communication and Network Security, 4.1 Implement secure design principles in network architectures, 4.1.3 Secure network components, 4.1.3.1 Wireless access points;CISSP Exam Outline, Domain 4. Communication and Network Security, 4.1 Implement secure design principles in network architectures, 4.1.3 Secure network components, 4.1.3.1 Wireless access points

Granularity is the degree of detail or precision that an access control system can provide. A granular access control system can specify different levels of access for different users, groups, resources, or conditions.For example, a granular firewall can allow or deny traffic based on the source, destination, port, protocol, time, or other criteria

The best place to specify the permitted access for each department and job classification combination is the security standards. Security standards are the documents that define the specific and measurable requirements or rules for the implementation and maintenance of the security policies and procedures. Security standards can help to ensure the consistency and the compliance of the security controls and measures across the organization, and to support the security objectives and principles, such as the least privilege and the separation of duties. Specifying the permitted access for each department and job classification combination in the security standards can help to enforce the role-based access control (RBAC) methodology, which assigns the permissions and privileges to the users or the devices based on their roles or functions in the organization. Security procedures, human resource policy, and human resource standards are not the best places to specify the permitted access for each department and job classification combination, as they are related to the steps or actions for the execution or operation of the security controls or measures, the general and strategic guidelines or objectives for the management or administration of the human resources, or the specific and measurable requirements or rules for the implementation and maintenance of the human resource policy, not the role-based access control methodology.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1, Security and Risk Management, page 46.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1, Security and Risk Management, page 61.

Gratuitous ARP is a special type of ARP message that a sender device broadcasts on the network without any other device requesting it. It can be useful for updating the ARP table, changing the address of an interface, or informing the network of the sender's own MAC address. However, it also introduces the risk of a Man-in-the-Middle (MITM) attack, where an attacker can send a spoofed gratuitous ARP message to trick other devices into associating a legitimate IP address with a malicious MAC address. This way, the attacker can intercept, modify, or redirect the traffic intended for the legitimate device. Therefore, the network architect likely designed the VoIP system with gratuitous ARP disabled to prevent such attacks and ensure the security and integrity of the voice communication.Reference:Gratuitous ARP -- Definition and Use Cases - Practical Networking .net;Gratuitous_ARP - Wireshark