Pass Your ISC CISSP Exam with Correct 1811 Questions and Answers [Q185-Q203]

The best design approach to securing a WAN environment that connects sites holding information at various levels of sensitivity, and that requires a high degree of interconnectedness, is to align risk across all interconnected elements to ensure critical threats are detected and handled. A WAN is a type of network that spans a large geographic area, such as a country or a continent, and that connects multiple local area networks (LANs) or metropolitan area networks (MANs), using various technologies, such as routers, switches, or gateways. A WAN can enable the communication and collaboration among the sites or the users that are located in different locations, and that share the same organization or the same purpose. A WAN can also pose a security challenge, as it can expose the sites or the users to various threats, such as eavesdropping, interception, modification, or denial of service, and as it can involve different levels of sensitivity, such as public, private, or confidential, for the information or the data that are transmitted or stored over the WAN. A design approach to securing a WAN environment that connects sites holding information at various levels of sensitivity, and that requires a high degree of interconnectedness, is to align risk across all interconnected elements to ensure critical threats are detected and handled. This design approach involves identifying, assessing, and prioritizing the risks that affect the WAN environment, and applying the appropriate security controls and measures to mitigate or reduce the risks, according to the level of sensitivity and the degree of interconnectedness of the WAN elements, such as the sites, the users, the information, or the data. This design approach can improve the security, performance, and reliability of the WAN environment, and ensure the protection and availability of the information or the data that are transmitted or stored over the WAN
. References: [CISSP CBK, Fifth Edition, Chapter 4, page 351]; [100 CISSP Questions, Answers and Explanations, Question 17].

When using symmetric cryptography, both parties will be using the same key for encryption and decryption. Symmetric cryptography is generally fast and can be hard to break, but it offers limited overall security in the fact that it can only provide confidentiality. Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 2).

Applying the principle of least privilege is the best approach for controlling access to highly sensitive information when employees have the same level of security clearance. The principle of least privilege is a security concept that states that every user or process should have the minimum amount of access rights and permissions that are necessary to perform their tasks or functions, and nothing more. The principle of least privilege can provide several benefits, such as:
Improving the security and confidentiality of the information by limiting the access and exposure of the sensitive data to the authorized users and purposes Reducing the risk and impact of unauthorized access or disclosure of the information by minimizing the attack surface and the potential damage Increasing the accountability and auditability of the information by tracking and logging the access and usage of the sensitive data Enhancing the performance and efficiency of the system by reducing the complexity and overhead of the access control mechanisms Applying the principle of least privilege is the best approach for controlling access to highly sensitive information when employees have the same level of security clearance, because it can ensure that the employees can only access the information that is relevant and necessary for their tasks or functions, and that they cannot access or manipulate the information that is beyond their scope or authority. For example, if the highly sensitive information is related to a specific project or department, then only the employees who are involved in that project or department should have access to that information, and not the employees who have the same level of security clearance but are not involved in that project or department.

Section: Software Development Security

Padded cells complement Intrusion Detection Systems (IDSs) and are not related to DBMS security. Padded cells are simulated environments to which IDSs seamlessly transfer detected attackers and are designed to convince an attacker that the attack is going according to the plan. Cell suppression is a technique used against inference attacks by not revealing information in the case where a statistical query produces a very small result set. Perturbation also addresses inference attacks but involves making minor modifications to the results to a query. Partitioning involves splitting a database into two or more physical or logical parts; especially relevant for multilevel secure databases.
Source: LaROSA, Jeanette (domain leader), Application and System Development Security
CISSP Open Study Guide, version 3.0, January 2002.

A system that is structured to isolate different classes of information from one another and segregate them by user jurisdiction can help the organization to vary its system policies to comply with conflicting national laws. Different classes of information may have different levels of sensitivity, confidentiality, or classification, and may require different security measures and controls to protect them. Different user jurisdictions may have different legal or regulatory requirements, standards, or expectations for the information, and may impose different obligations or restrictions on the organization. By isolating and segregating the information by class and jurisdiction, the organization can tailor its system policies to meet the specific needs and demands of each class and jurisdiction, and avoid any conflicts or violations of the national laws.

The biggest drawback of HIDS, and the reason many organizations resist its use, is that it can be very invasive to the host operating system. HIDS must have the capability to monitor all processes and activities on the host system and this can sometimes interfere with normal system processing.
HIDS versus NIDS
A host-based IDS (HIDS) can be installed on individual workstations and/ or servers to watch for inappropriate or anomalous activity. HIDSs are usually used to make sure users do not delete system files, reconfigure important settings, or put the system at risk in any other way.
So, whereas the NIDS understands and monitors the network traffic, a HIDS’s universe is limited to the computer itself. A HIDS does not understand or review network traffic, and a NIDS does not
“look in” and monitor a system’s activity. Each has its own job and stays out of the other’s way.
The ISC2 official study book defines an IDS as:
An intrusion detection system (IDS) is a technology that alerts organizations to adverse or
unwanted activity. An IDS can be implemented as part of a network device, such as a router,
switch, or firewall, or it can be a dedicated IDS device monitoring traffic as it traverses the network.
When used in this way, it is referred to as a network IDS, or NIDS. IDS can also be used on
individual host systems to monitor and report on file, disk, and process activity on that host. When
used in this way it is referred to as a host-based IDS, or HIDS.
An IDS is informative by nature and provides real-time information when suspicious activities are
identified. It is primarily a detective device and, acting in this traditional role, is not used to directly
prevent the suspected attack.
What about IPS?
In contrast, an intrusion prevention system (IPS), is a technology that monitors activity like an IDS
but will automatically take proactive preventative action if it detects unacceptable activity. An IPS
permits a predetermined set of functions and actions to occur on a network or system; anything
that is not permitted is considered unwanted activity and blocked. IPS is engineered specifically to
respond in real time to an event at the system or network layer. By proactively enforcing policy,
IPS can thwart not only attackers, but also authorized users attempting to perform an action that is
not within policy. Fundamentally, IPS is considered an access control and policy enforcement
technology, whereas IDS is considered network monitoring and audit technology.
The following answers were incorrect:
All of the other answer were advantages and not drawback of using HIDS
TIP FOR THE EXAM:
Be familiar with the differences that exists between an HIDS, NIDS, and IPS. Know that IDS’s are
mostly detective but IPS are preventive. IPS’s are considered an access control and policy
enforcement technology, whereas IDS’s are considered network monitoring and audit technology.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 5817-
5822). McGraw-Hill. Kindle Edition.
and
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Access
Control ((ISC)2 Press), Domain1, Page 180-188 or on the kindle version look for Kindle Locations
3199-3203 Auerbach Publications.

Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

Section: Software Development Security

Explanation/Reference:
Explanation:
The data owner (information owner) is usually a member of management who is in charge of a specific business unit, and who is ultimately responsible for the protection and use of a specific subset of information. The data owner has due care responsibilities and thus will be held responsible for any negligent act that results in the corruption or disclosure of the data. The data owner decides upon the classification of the data she is responsible for and alters that classification if the business need arises.
This person is also responsible for ensuring that the necessary security controls are in place, defining security requirements per classification and backup requirements, approving any disclosure activities, ensuring that proper access rights are being used, and defining user access criteria. The data owner approves access requests or may choose to delegate this function to business unit managers.
Incorrect Answers:
A: While the data owner is usually a member of management, this is not always the case. Therefore, the person authorized to grant information access to other people is not always the manager so this answer is incorrect.
B: A Group Leader is not the person authorized to grant information access to other people (unless the group leader is also the data owner).
C: The role of Security Manager does not give you the authority to grant information access to other people.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 121

Something you know and a password fits within only one of the three ways authentication could be done. A password is an example of something you know, thereby something you know and a password does not constitute a two-factor authentication as both are in the same category of factors.
A two-factor (strong) authentication relies on two different kinds of authentication factors out of a list of three possible choice:
something you know (e.g. a PIN or password),
something you have (e.g. a smart card, token, magnetic card),
something you are is mostly Biometrics (e.g. a fingerprint) or something you do (e.g.
signature dynamics).
TIP FROM CLEMENT:
On the real exam you can expect to see synonyms and sometimes sub-categories under the main categories. People are familiar with Pin, Passphrase, Password as subset of
Something you know.
However, when people see choices such as Something you do or Something you are they immediately get confused and they do not think of them as subset of Biometrics where you have Biometric implementation based on behavior and physilogical attributes. So something you do falls under the Something you are category as a subset.
Something your do would be signing your name or typing text on your keyboard for example.
Strong authentication is simply when you make use of two factors that are within two different categories.
Reference(s) used for this question:
Shon Harris, CISSP All In One, Fifth Edition, pages 158-159

Secure Sockets Layer (SSL). An encryption technology that is used to provide secure transactions such as the exchange of credit card numbers. SSL is a socket layer security protocol and is a two-layered protocol that contains the SSL Record Protocol and the SSL Handshake Protocol. Similiar to SSH, SSL uses symmetric encryption for private connections and asymmetric or public key cryptography (certificates) for peer authentication. It also uses a Message Authentication Code for message integrity checking.
Krutz: The CISSP Prep Guide pg. 89. It prevents a man in the middle attack by confirming that you are authenticating with the server desired prior entering your user name and password. If the server was not authenticated, a man-in-the-middle could retrieve the username and password then use it to login.
The SSL protocol has been known to be vulnerable to some man-in-the-middle attacks. The attacker injects herself right at the beginning of the authentication phase so that she obtains both parties’ keys. This enables her to decrypt and view messages that were not intended for her. Using digital signatures during the session-key exchange can circumvent the man-in-the-middle attack. If using kerberos, when Lance and Tanya obtain each other’s public keys from the KDC, the public keys are signed by the KDC. Because Tanya and Lanace have the public key of the KDC, they both can decrypt and verify the signature on each other’s public key and be sure that it came from the KDC itself. Because David does not have the private key of the KDC, he cannot substitute his pubic key during this type of transmission. Shon Harris All-In-One CISSP Certification pg. 579.
One of the most important pieces a PKI is its public key certificate. A certificate is the mechanism
used to associate a public key with a collection of components sufficient to uniquely authenticate
the claimed owner. Shon Harris All-In-One CISSP Certification pg. 540.

The Prototype Phase is also called the “Proof of Concept” Phase. Whether it’s called one or the other depends on what the creator is trying to “prove.” If the main deliverable of the Phase includes a working version of the product’s technical features, it’s a “prototype.” If the main deliverable just looks like it has the product’s technical features, then it’s a “proof of concept.” Prototypes can save time and money because you can test some functionality earlier in the process. You don’t have to make the whole final product to begin testing it.

An access control model defines a computer and/or network system’s rules for user access to information resources. Access control models provide confidentiality, integrity and also provide accountability through audit trails. An audit trail documents the access of an object by a subject with a record of what operations were performed.
Operations include: read, write, execute and own.
Non-Discretionary Access Control is usually role-based, centrally administered with authorization decisions based on the roles individuals have within an organization (e.g.
bank teller, loan officer, etc. in a banking model). A system’s security administrator grants and/or revokes system privileges based on a user’s role. This model works well for corporations with a large turnover of personnel.

The Prototype Phase is also called the “Proof of Concept” Phase.
Whether it’s called one or the other depends on what the creator is trying to “prove.”
If the main deliverable of the Phase includes a working version of the product’s technical features, it’s a “prototype.” If the main deliverable just looks like it has the product’s technical features, then it’s a “proof of concept.”
Prototypes can save time and money because you can test some functionality earlier in the process. You don’t have to make the whole final product to begin testing it.

Accountability is another facet of access control. Individuals on a system are responsible for their actions. This accountability property enables system activities to be traced to the proper individuals. Accountability is supported by audit trails that record events on the system and on the network. Audit trails can be used for intrusion detection and for the reconstruction of past events. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 65