Easily To Pass New ISC CISSP Dumps with 1811 Questions [Q1078-Q1101]

Access Control Techniques
Discretionary Access Control
Mandatory Access Control
Lattice Based Access Control
Rule-Based Access Control
Role-Based Access Control
Source: DUPUIS, Clement, Access Control Systems and Methodology, Version 1, May
2002, CISSP Open Study Group Study Guide for Domain 1, Page 13

*Answer A volatile device is incorrect because a PLD is non-volatile.
*Answer “Random Access Memory (RAM) that contains the software to perform specific tasks” is incorrect because random access memory is volatile memory that is not a nonvolatile logic device.
*Answer “A program resident on disk memory that executes a specific function” is a distracter.

Explanation/Reference:
Explanation:
The ability of a TCB to correctly enforce a security policy depends solely on the mechanisms within it and the correct input by system administrative personnel of parameters related to security policy. For example, if Jane only has a “CONFIDENTIAL” clearance, a system administrator could foil the correct operation of a TCB by providing input to the system that gave her a “SECRET” clearance. “It is defined in the Orange Book” is an incorrect choice. The TCB is defined in the Orange Book (TCSEC or Trusted Computer System Evaluation Criteria). “It includes hardware, firmware and software” is incorrect. The TCB does includes the combination of all hardware, firmware and software responsible for enforcing the security policy. “A higher TCB rating will require that details of their testing procedures and documentation be reviewed with more granularity” is incorrect. As the level of trust increases (D through A), the level of scrutiny required during evaluation increases as well.
References: CBK, pp. 323 – 324, 329 – 330 AIO3, pp.269 – 272.

An access control matrix is a table of subjects and objects indicating what actions individual subjects can take upon individual objects. Matrices are data structures that programmers implement as table lookups that will be used and enforced by the operating system.
This type of access control is usually an attribute of DAC models. The access rights can be assigned directly to the subjects (capabilities) or to the objects (ACLs).
Capability Table
A capability table specifies the access rights a certain subject possesses pertaining to specific objects. A capability table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL.
Access control lists (ACLs)
ACLs are used in several operating systems, applications, and router configurations. They are lists of subjects that are authorized to access a specific object, and they define what level of authorization is granted. Authorization can be specific to an individual, group, or role. ACLs map values from the access control matrix to the object.
Whereas a capability corresponds to a row in the access control matrix, the ACL corresponds to a column of the matrix.
NOTE: Ensure you are familiar with the terms Capability and ACLs for the purpose of the exam.
Resource(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations
5264-5267). McGraw-Hill. Kindle Edition.
or
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition, Page 229 and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 1923-1925). Auerbach Publications. Kindle
Edition.

Section: Security Architecture and Engineering

An advantage of an effective release control strategy from a configuration control standpoint is that it ensures that a trace for all deliverables is maintained and auditable. Release control is a process that manages the distribution and installation of software releases into the operational environment. Configuration control is a process that maintains the integrity and consistency of the software configuration items throughout the software development life cycle. An effective release control strategy can help to ensure that a trace for all deliverables is maintained and auditable, which means that the origin, history, and status of each software release can be tracked and verified. This can help to prevent unauthorized or incompatible changes, as well as to facilitate troubleshooting and recovery. Enforcing backward compatibility, ensuring no loss of functionality, and allowing for future enhancements are not advantages of release control from a configuration control standpoint, but from a functionality or performance standpoint. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Software Development Security, page 969; Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 7: Software Development Security, page 895.

A Kerberos server must be well protected from unauthorized access because it contains the keys of all clients. Kerberos is a network authentication protocol that uses symmetric cryptography and a trusted third party, called the Key Distribution Center (KDC), to provide secure and mutual authentication between clients and servers2. The KDC consists of two components: the Authentication Server (AS) and the Ticket Granting Server (TGS). The AS issues a Ticket Granting Ticket (TGT) to the client after verifying its identity and password. The TGS issues a service ticket to the client after validating its TGT and the requested service. The client then uses the service ticket to access the service. The KDC stores the keys of all clients and services in its database, and uses them to encrypt and decrypt the tickets. If an attacker gains access to the KDC, they can compromise the keys and the tickets, and impersonate any client or service on the network. References: 2:
CISSP For Dummies, 7th Edition, Chapter 4, page 91.

The correct answer is “Luring the perpetrator to an attractive area or presenting the perpetrator with a lucrative target after the crime has already been initiated”, the definition of enticement.
*Answer “Encouraging the commission of a crime when there was initially no intent to commit a crime” is the definition of entrapment.
The other answers are distracters.

A Polymorphic virus produces varied but operational copies of itself in hopes of
evading anti-virus software.
The following answers are incorrect:
boot sector. Is incorrect because it is not the best answer. A boot sector virus attacks the boot
sector of a drive. It describes the type of attack of the virus and not the characteristics of its
composition.
parasitic. Is incorrect because it is not the best answer. A parasitic virus attaches itself to other
files but does not change its characteristics.
stealth. Is incorrect because it is not the best answer. A stealth virus attempts to hide changes of
the affected files but not itself.

According to the CISSP For Dummies, the best way to determine the priority of the remediation efforts after a vulnerability assessment has been conducted is to use a risk-based approach. A vulnerability assessment is the process of identifying and measuring the weaknesses and exposures in a system, network, or application, that may be exploited by threats and cause harm to the organization or its assets. A risk-based approach is a method that prioritizes the remediation efforts based on the level of risk associated with each vulnerability, which is calculated by considering the impact and likelihood of the threat exploiting the vulnerability. A risk-based approach helps to allocate the resources and efforts to the most critical and urgent vulnerabilities, and to reduce the overall risk to an acceptable level. Using an impact-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the potential consequences of the threat exploiting the vulnerability, but not the probability of the occurrence. An impact-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities. Using a criticality-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the importance or value of the asset or system that is affected by the vulnerability, but not the threat or the vulnerability itself. A criticality-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities. Using a threat-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the characteristics and capabilities of the threat that may exploit the vulnerability, but not the vulnerability or the impact itself. A threat-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities.

A Class C fire extinguisher is preferable when a fire involves electrical equipment including wiriing. Common Class C suppression includes: gas (i.e. Halon, FM-200, Carbon Dioxide, etc) or soda acid.
To aid in memorization of Fire Class write on a paper the classes A through D, simply think of my firstname which is CLEMENT then put the word CLEM vertically as shown below:
Class A -> C = Combustible Class B -> L = Liquid Class C -> E = Electrical Class D -> M = Metals
Below you will find a more detailed model.
Class A = Combustible Type of Fire: Common Combustibles Elements of Fire: wood products, paper, and laminates Suppression Method: water, foam
Class B = Liquid Type of Fire: Liquid Elements of Fire: Petroleum products and coolants Suppression Method: Gas, CO2, foam, dry powders.
Class C = Electrical Type of Fire: Electrical Elements of Fire: Electrical equipment and wires Suppression Method: Gas, CO2, dry powders.
Class D = Metals Type of Fire: Combustible Metals Elements of Fire: Magnesium, sodium, potassium Suppression Method: Dry powder.
The following answers are incorrect:
When the fire involves paper products Class A fires involve paper products and would not require a Class C extinguisher.
When the fire is caused by flammable products This is a distractor When the fire is in an enclosed area This is not the best answer, because a paper product fire could still be extinguished by a Class A extinguisher, even in an enclosed area.
The following references was/were used to create this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 10: Physical security (page 335). and https://en.wikipedia.org/wiki/Fire_classes

Explanation/Reference:
Explanation:
Controls can be administrative, logical or technical, and physical.
Administrative controls include policies and procedures, security awareness training, background

checks, work habit checks, a review of vacation history, and increased supervision.
Logical or technical controls involve the restriction of access to systems and the protection of

information. Examples of these types of controls are encryption, smart cards, access control lists, and transmission protocols.
Physical controls incorporate guards and building security in general, such as the locking of doors,

securing of server rooms or laptops, the protection of cables, the separation of duties, and the backing up of files.
Incorrect Answers:
A: The controls listed in this answer are all administrative controls (including a review of vacation history).
B: Technical controls DO include encryption, smart cards, access lists, and transmission protocols.
D: The controls listed in this answer are all administrative controls.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p. 47

Section: Communication and Network Security

As session key is a symmetric key that is used to encrypt messages between two users. A session key is only good for one communication session between users.
For example , If Tanya has a symmetric key that she uses to encrypt messages between
Lance and herself all the time , then this symmetric key would not be regenerated or changed. They would use the same key every time they communicated using encryption.
However , using the same key repeatedly increases the chances of the key being captured and the secure communication being compromised. If , on the other hand , a new symmetric key were generated each time Lance and Tanya wanted to communicate , it would be used only during their dialog and then destroyed. if they wanted to communicate and hour later , a new session key would be created and shared.
The other answers are not correct because :
Public Key can be known to anyone.
Private Key must be known and used only by the owner.
Secret Keys are also called as Symmetric Keys, because this type of encryption relies on each user to keep the key a secret and properly protected.
REFERENCES:
SHON HARRIS , ALL IN ONE THIRD EDITION : Chapter 8 : Cryptography , Page : 619-
620

Risk management provides a mechanism to the organization to ensure that executive management knows current risks, and informed decisions can be made to use one of the risk management principles: risk avoidance, risk transfer, risk mitigation, or risk acceptance,
Risk Acceptance is when the risk has been identified, understood and evaluated to be acceptable in order to conduct business operations. Acceptance goes hand-in-hand with mitigation but they’re slightly different.
At the end of the day, there is always a particle of risk we must undertake to perform business in a complex computing world. Whether it is operating a website, hosting a VPN connection or
connections for employees to the open internet, there is risk.
Managers can either accept, avoid or transfer risk to another party. Either way, risk must be dealt
with to conduct business operations.
The following answers are incorrect:
Risk Avoidance: Avoiding risk is when we avoid it altogether to deal with the risk. Whether it is by
not hosting a website, not operating your own web proxy or any other computing task. Choosing
not to perform the process is risk avoidance. This isn’t correct because accepting risk is clearly not
avoiding the risk.
Risk Transference: When we transfer risk, we pay someone else to undertake the risk on our
behalf so that we may conduct operations, benefit from the risk but don’t undertake the risky
operation ourselves. Accepting the risk is different from transferring the risk to another
organization apart from your own in that you’re not accepting it at all. Someone else does for you.
Risk Mitigation: Mitigating risk means you accept it AND work around the risk to benefit from it. A
good example could be a locked down web server or firewall. You benefit from the service they
provide but mitigate risks involved by technical measures. Mitigation is incorrect because it goes
beyond merely accepting the risk by mitigating the risk to make it more acceptable.
The following reference(s) was used to create this question:
Gregg, Michael; Haines, Billy (2012-02-16). CASP: CompTIA Advanced Security Practitioner
Study Guide Authorized Courseware: Exam CAS-001 (p. 218). Wiley. Kindle Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 8884-8886). Auerbach Publications. Kindle Edition.

Explanation/Reference:
Explanation:
Controls are implemented to mitigate risk and reduce the potential for loss. Controls can be preventive, detective, or corrective. Preventive controls are put in place to inhibit harmful occurrences; detective controls are established to discover harmful occurrences; corrective controls are used to restore systems that are victims of harmful attacks.
Technical controls are the software tools used to restrict subjects’ access to objects. They are core components of operating systems, add-on security packages, applications, network hardware devices, protocols, encryption mechanisms, and access control matrices. These controls work at different layers within a network or system and need to maintain a synergistic relationship to ensure there is no unauthorized access to resources and that the resources’ availability, integrity, and confidentiality are guaranteed. Technical controls protect the integrity and availability of resources by limiting the number of subjects that can access them and protecting the confidentiality of resources by preventing disclosure to unauthorized subjects.
Incorrect Answers:
A: Administrative controls are commonly referred to as “soft controls” because they are more management-oriented. Examples of administrative controls are security documentation, risk management, personnel security, and training. Administrative controls do not use technology to enforce access control policies.
C: Physical controls are items put into place to protect facility, personnel, and resources. Examples of physical controls are security guards, locks, fencing, and lighting. Physical controls do not use technology to enforce access control policies.
D: Detective controls are established to discover harmful occurrences after they have happened.
Administrative controls are commonly referred to as “soft controls” because they are more management- oriented. Examples of administrative controls are security documentation, risk management, personnel security, and training. Detective controls and administrative controls do not use technology to enforce access control policies.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 28, 245

Explanation:
The following is a possible answer for the drag and drop question:

According to the CISSP CBK Official Study Guide1, access control is the process of granting or denying access to resources, data, or information, based on the identity, role, or credentials of the subject or the entity, as well as the security policies and rules of the system or the network. Access control can be classified into four types, which are:
* Administrative: Access control that is implemented through the policies, procedures, and processes that govern the management and monitoring of the access control system, such as the identification, authentication, authorization, and accountability of the subjects and the entities, as well as the classification, labeling, and handling of the resources, data, or information. An example of administrative access control is labeling of sensitive data, which is the process of applying security attributes or tags to the data that indicate the classification, sensitivity, or clearance of the data, such as top secret, secret, or confidential. Labeling of sensitive data helps to identify and distinguish the data based on their security attributes, as well as to inform and instruct the users or handlers of the data about the proper and secure handling and disposal of them.
* Technical: Access control that is implemented through the hardware, software, or firmware components or mechanisms that enforce and execute the access control policies and rules, such as the encryption, decryption, hashing, or digital signature of the data, or the biometrics, tokens, or certificates of the subjects or the entities. An example of technical access control is biometrics for authentication, which is the process of verifying and confirming the identity of the subject or the entity based on their physical or behavioral characteristics, such as the fingerprint, iris, voice, or signature of the subject or the entity.
Biometrics for authentication helps to ensure the authenticity and uniqueness of the subject or the entity, as it uses the characteristics that are inherent and distinctive to the subject or the entity, and that are difficult to forge, copy, or share.
* Logical: Access control that is implemented through the software or application components or mechanisms that restrict and regulate the access or use of the resources, data, or information, based on the logic, function, or operation of the system or the network, such as the passwords, usernames, roles, or permissions of the subjects or the entities, or the firewalls, routers, or switches of the system or the network. An example of logical access control is constrained user interface, which is the process of limiting or hiding the features or functions of the system or the network that are not relevant or authorized for the subject or the entity, such as the menus, buttons, or commands of the system or the network. Constrained user interface helps to reduce the complexity and confusion of the system or the network, as well as to prevent or minimize the errors or problems that may occur from the misuse or abuse of the system or the network.
* Physical: Access control that is implemented through the physical or tangible components or mechanisms that prevent or deter the unauthorized or unintended access or entry to the resources, data, or information, such as the locks, keys, doors, or windows of the premises or the facilities, or the
* badges, cards, or tags of the subjects or the entities. An example of physical access control is Radio Frequency Identification (RFID) badge, which is a device or a material that emits or responds to radio waves, and that contains or stores the identification or the information of the subject or the entity, such as the name, number, or photo of the subject or the entity. RFID badge helps to identify and locate the subject or the entity, as well as to grant or deny the access or entry to the premises or the facilities.