ISC CISSP Deluxe Study Guide with Online Test Engine [Q513-Q537]

If every one of the 100 clerks makes 1 error 12 times per year, it makes a total of 1200 errors. The Annnualized Rate of Occurence (ARO) is a value that represents the estimated frequency in which a threat is expected to occur. The range can be from 0.0 to a large number. Having an average of 1200 errors per year means an ARO of 1200.

The keyword PRIMARY is used in the question. Accountability should be the primary concern if critical servers can be accessed only by using shared user id and password. It would be very difficult to track the changes done by employee on critical server.
For your exam you should know the information below:
Accountability
Ultimately one of the drivers behind strong identification, authentication, auditing and session management is accountability. Accountability is fundamentally about being able to determine who or what is responsible for an action and can be held responsible. A closely related information assurance topic is non-repudiation. Repudiation is the ability to deny an action, event, impact or result. Non-repudiation is the process of ensuring a user may not deny an action. Accountability relies heavily on non-repudiation to ensure users, processes and actions may be held responsible for impacts.
The following contribute to ensuring accountability of actions:
Strong identification
Strong authentication
User training and awareness
Comprehensive, timely and thorough monitoring
Accurate and consistent audit logs
Independent audits
Policies enforcing accountability
Organizational behaviour supporting accountability
The following answers are incorrect:
The other options are also valid concern. But the primary concern should be accountability.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 328 and 329
Official ISC2 guide to CISSP CBK 3rd Edition Page number 114

Explanation/Reference:
Explanation:
An online transaction processing system is used in conjunction with a database to commit transactions to a database in real time. The database must maintain its integrity, meaning the data in the database must be accurate at all times. Therefore, transactions must occur correctly or not at all to ensure that that only accurate data are entered into the database. If any of the steps in a transaction fails to complete to due invalid data, all the steps of the transaction are rolled back (dropped).
Incorrect Answers:
B: Invalid transactions should not be processed as it would affect the accuracy of the data and the integrity of the database. Instead, the transaction should be dropped.
C: Writing the transaction to a report for later review would help identify potential problems and/or threats.
However, the database must maintain its integrity, meaning the data in the database must be accurate at all times. This means that the invalid transactions should not be allowed as it would compromise the database integrity. Therefore, the transaction should be dropped.
D: Generally, an online transaction processing system does not have mechanisms to correct invalid transactions. These transactions are made by information entered into a web form or other front-end interface. The user needs to correct their error and resubmit the information.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1180-1182,
1187-1188
http://en.wikipedia.org/wiki/Online_transaction_processing
http://databases.about.com/od/administration/g/concurrency.htm

Imprisonment or probation is not a type of punishment available for
conviction of a civil crime. Answer a refers to awards set by law.
Answer b, punitive damages, are usually determined by the jury and
are intended to punish the offender. Compensatory awards are used to
provide restitution and compensate the victim for such items as costs
of investigations and attorneys fees.

Section: Security Architecture and Engineering
Explanation/Reference:

L2TP and PPTP were both designed for individual client to server connections; they enable only a single point-to-point connection per session. Dial-up VPNs use L2TP often. Both L2TP and PPTP operate at the data link layer (layer 2) of the OSI model. PPTP uses native PPP authentication and encryption services and L2TP is a combination of PPTP and Layer 2 Forwarding protocol (L2F). Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 95).

Biometric authentication systems take advantage of an individual’s unique physical characteristics in order to authenticate that person’s identity. Various forms of biometric authentication include face, voice, eye, hand, signature, and fingerprint, each have their own advantages and disadvantages. When combined with the use of a PIN it can provide two factors authentication.

Explanation/Reference:
Explanation:
Black box testing examines the functionality of an application without peering into its internal structures or workings. Black box testing provides the tester with no internal details; the software is treated as a black box that receives inputs.
Incorrect Answers:
B: Parallel Testing is the process of entering the same inputs in two different versions of the application and reporting the anomalies.
C: Regression Testing is the process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors.
D: Pilot Testing is a preliminary test that focuses on specific and predefined aspect of a system.
References:
Conrad, Eric, Seth Misenar, Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham, 2012, p. 194
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 1105
https://en.wikipedia.org/wiki/Black-box_testing
http://www.tutorialspoint.com/software_testing_dictionary/parallel_testing.htm
http://soft-engineering.blogspot.co.za/2010/12/what-is-difference-between-pilot-and.html

These laws reflected different views concerning wiretapping as
technology progresseD. The Federal Intelligence Surveillance Act
(FISA) of 1978 limited wiretapping for national security purposes as a
result of the record of the Nixon Administration in using illegal wiretaps.
The Electronic Communications Privacy Act (ECPA) of 1986
prohibited eavesdropping or the interception of message contents
without distinguishing between private or public systems. The Communications
Assistance for Law Enforcement Act (CALEA) of 1994
required all communications carriers to make wiretaps possible in
ways approved by the FBI.

Vibration sensors are similar and are also implemented to detect forced entry. Financial institutions may choose to implement these types of sensors on exterior walls, where bank robbers may attempt to drive a vehicle through. They are also commonly used around the ceiling and flooring of vaults to detect someone trying to make an unauthorized bank withdrawal.
Such sensors are proned to false positive. If there is a large truck with heavy equipment driving by it may trigger the sensor. The same with a storm with thunder and lighting, it may trigger the alarm
even thou there are no adversarial threat or disturbance.
The following are incorrect answers:
All of the other choices are incorrect.
Reference used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (pp. 495-496). McGraw-Hill
. Kindle Edition.

PPTP operates at the data link layer (layer 2) of the OSI model and uses native PPP authentication and encryption services. Designed for individual client to server connections, it enables only a single point-to-point connection per session. PPTP – Point-to-Point Tunneling Protocol – extends the Point to Point Protocol (PPP) standard for traditional dial-up networking. PPTP is best suited for the remote access applications of VPNs, but it also supports LAN internetworking.
PPTP operates at Layer 2 of the OSI model. Using PPTP PPTP packages data within PPP packets, then encapsulates the PPP packets within IP packets (datagrams) for transmission through an Internet-based VPN tunnel. PPTP supports data encryption and compression of these packets. PPTP also uses a form of General Routing Encapsulation (GRE) to get data to and from its final destination.
Reference(s) used for this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 95). and http://compnetworking.about.com/od/vpn/l/aa030103a.htm
and http://technet.microsoft.com/en-us/library/cc768084.aspx

The IAAB considers the Internet a privilege, not a right, and as such considers it unethical to purposely disrupt communications.

The equation defines a single layer ANN as shown in Figure.

Each input, in, is multiplied by a weight, wn , and these products are
fed into a summation transfer function, , that generates an output,
Z. Most neural networks have multiple layers of summation and
weighting functions, whose interconnections can also be changed.
There are a number of different learning paradigms for neural networks, including reinforcement learning and back propagation. In reinforcement learning a training set of inputs is provided to the ANN along with a measure of how close the network is coming to a solution.
Then, the weights and connections are readjusted. In back propagation,
information is fed back inside the neural network from the
output and is used by the ANN to make weight and connection
adjustments.
*Answers An expert system and A knowledge-based system are distracters that describe systems that use knowledge-based rules of experts to solve problems using an inferencing mechanism.
*A knowledge acquisition system refers to the means of identifying and acquiring the knowledge to be entered into the knowledge base of an expert system.

A known plain text attack is an attack against the organization’s cryptosystem, not a direct attack against operations.

There are several different categories of access control. The main categories are: –Physical Access Control –Administrative Access Control –Logical Access Control –Data Access Control

Explanation/Reference:
Explanation:
With load balancing, often through clustering, each system takes a part of the processing load, and if one system fails there is an automatic failover to the other systems which continue to work. This guarantees a high availability of the service.
Incorrect Answers:
A: Systems backups only protects against data loss. It does not product a failure of server.
B: Electronic vaulting and remote journaling are transaction redundancy solutions. It protect the system by copying transaction information to a remote location. In case of server failure the database can be restored, but it would require a rebuild of the database.
C: RAID protects against a hard disk failures, but it does not protect against other type of server failures.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 1272

Explanation:

Exam 1 Q103-2
Security, like other aspects of an IT system, is best managed if
planned for throughout the IT system life cycle. There are many models
for the IT system life cycle, but most contain five basic phases: initiation, development/acquisition, implementation, operation, and disposal.
The order of these phases is:
A. Initiation phase During the initiation phase, the need for a system
is expressed and the purpose of the system is documented.
B. Development/acquisition phase During this phase, the system is
designed, purchased, programmed, developed, or otherwise
constructed.
C. Implementation phase During implementation, the system is
tested and installed or fielded.
D. Operation/maintenance phase During this phase, the system
performs its work. The system is almost always being continuously
modified by the addition of hardware and software and by
numerous other events.
E. Disposal phase The disposal phase of the IT system life cycle
involves the disposition of information, hardware, and software.
Source: NIST Special Publication 800-14, Generally Accepted Principles
and Practices for Securing Information Technology Systems.

Explanation/Reference:
Explanation:
Detective controls include Motion detectors, Closed-circuit TVs, Monitoring and Supervising, Job rotation, Investigations, Audit logs, and IDS.
Incorrect Answers:
A: Preventive controls include Locks, Badge system, Security guard, Security policy, Testing, ACLs, Encryption, and Smart cards.
C: Recovery controls include Offsite facility, and Data backup.
D: Directive controls, which are also known as administrative controls, include Security policy, Monitoring and Supervising, Separation of duties, Job rotation, Information Classification, Personnel Procedures, Testing, and Security-awareness training.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 32, 33

A differential backup is a partial backup that copies a selected file to tape only if the archive bit for that file is turned on, indicating that it has changed since the last full backup. A differential backup leaves the archive bits unchanged on the files it copies.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3:
Telecommunications and Network Security (page 69).
Also see: http://e-articles.info/e/a/title/Backup-Types/
Backup software can use or ignore the archive bit in determining which files to back up, and can either turn the archive bit off or leave it unchanged when the backup is complete.
How the archive bit is used and manipulated determines what type of backup is done, as follows
Full backup
A full backup, which Microsoft calls a normal backup, backs up every selected file, regardless of the status of the archive bit. When the backup completes, the backup software turns off the archive bit for every file that was backed up. Note that “full” is a misnomer because a full backup backs up only the files you have selected, which may be as little as one directory or even a single file, so in that sense Microsoft’s terminology is actually more accurate. Given the choice, full backup is the method to use because all files are on one tape, which makes it much easier to retrieve files from tape when necessary.
Relative to partial backups, full backups also increase redundancy because all files are on all tapes. That means that if one tape fails, you may still be able to retrieve a given file from another tape.
Differential backup
A differential backup is a partial backup that copies a selected file to tape only if the archive bit for that file is turned on, indicating that it has changed since the last full backup. A differential backup leaves the archive bits unchanged on the files it copies. Accordingly, any differential backup set contains all files that have changed since the last full backup. A differential backup set run soon after a full backup will contain relatively few files. One run soon before the next full backup is due will contain many files, including those contained on all previous differential backup sets since the last full backup. When you use differential backup, a complete backup set comprises only two tapes or tape sets: the tape that contains the last full backup and the tape that contains the most recent differential backup.
Incremental backup
An incremental backup is another form of partial backup. Like differential backups,
Incremental Backups copy a selected file to tape only if the archive bit for that file is turned on. Unlike the differential backup, however, the incremental backup clears the archive bits for the files it backs up. An incremental backup set therefore contains only files that have changed since the last full backup or the last incremental backup. If you run an incremental backup daily, files changed on Monday are on the Monday tape, files changed on Tuesday are on the Tuesday tape, and so forth. When you use an incremental backup scheme, a complete backup set comprises the tape that contains the last full backup and all of the tapes that contain every incremental backup done since the last normal backup. The only advantages of incremental backups are that they minimize backup time and keep multiple versions of files that change frequently. The disadvantages are that backed-up files are scattered across multiple tapes, making it difficult to locate any particular file you need to restore, and that there is no redundancy. That is, each file is stored only on one tape.
Full copy backup
A full copy backup (which Microsoft calls a copy backup) is identical to a full backup except for the last step. The full backup finishes by turning off the archive bit on all files that have been backed up. The full copy backup instead leaves the archive bits unchanged. The full copy backup is useful only if you are using a combination of full backups and incremental or differential partial backups. The full copy backup allows you to make a duplicate “full” backup-e.g., for storage offsite, without altering the state of the hard drive you are backing up, which would destroy the integrity of the partial backup rotation.
Some Microsoft backup software provides a bizarre backup method Microsoft calls a daily copy backup. This method ignores the archive bit entirely and instead depends on the date- and timestamp of files to determine which files should be backed up. The problem is, it’s quite possible for software to change a file without changing the date- and timestamp, or to change the date- and timestamp without changing the contents of the file. For this reason, we regard the daily copy backup as entirely unreliable and recommend you avoid using it.

By ensuring that all content flows through a single point, proxies provide a
checkpoint for network data, which is an advantage rather than a liability, as are other choices.
Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 8:
Application-Level Proxies.

The Computer Security Policy Model Orange Book is based is the Bell-LaPadula
Model. Orange Book Glossary.
The Data Encryption Standard (DES) is a cryptographic algorithm. National Information Security
Glossary.
TEMPEST is related to limiting the electromagnetic emanations from electronic equipment.
Reference: U.S. Department of Defense, Trusted Computer System Evaluation Criteria (Orange
Book), DOD 520028-STD. December 1985 (also available here).

Explanation/Reference:
Explanation:
The reason a company implements countermeasures is to reduce its overall risk to an acceptable level. No system or environment is 100 percent secure, which means there is always some risk left over to deal with.
This is called residual risk.
Residual risk is different from total risk, which is the risk a company faces if it chooses not to implement any type of safeguard.
There is an important difference between total risk and residual risk and which type of risk a company is willing to accept. The following are conceptual formulas:
threats × vulnerability × asset value = total risk

(threats × vulnerability × asset value) × controls gap = residual risk

You may also see these concepts illustrated as the following:
total risk – countermeasures = residual risk

Incorrect Answers:
B: The weakness of an asset which can be exploited by a threat is not the definition of residual risk.
C: Risk that remains after risk assessment has been performed (with no countermeasures in place) is total risk, not residual risk.
D: A security risk intrinsic to an asset being audited, where no mitigation has taken place) is total risk of the asset, not residual risk.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 87

The use of passphrases is a good way of having very strong passwords. A passphrase is easier to remember, it offers numerous characters, and it is almost impossible to crack using brute force with today’s processing power. An example of a passphrase could be: “Once upon a time in the CISSP world”