[2024] Use Valid New Free CISSP Exam Dumps & Answers [Q401-Q420]

Users can obtain certificates with various levels of assurance. Here is a list that describe each of them:
–
Class 1/Level 1 for individuals, intended for email, no proof of identity
For example, level 1 certificates verify electronic mail addresses. This is done through the use of a personal information number that a user would supply when asked to register. This level of certificate may also provide a name as well as an electronic mail address; however, it may or may not be a genuine name (i.e., it could be an alias). This proves that a human being will reply back if you send an email to that name or email address.
–
Class 2/Level 2 is for organizations and companies for which proof of identity is required Level 2 certificates verify a user’s name, address, social security number, and other information against a credit bureau database.
–
Class 3/Level 3 is for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing certificate authority Level 3 certificates are available to companies. This level of certificate provides photo identification to accompany the other items of information provided by a level 2 certificate.
–
Class 4 for online business transactions between companies
–
Class 5 for private organizations or governmental security
References:
http://en.wikipedia.org/wiki/Digital_certificate veriSign introduced the concept of classes of digital
certificates:
Also see:
Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management Handbook, 4th
edition (volume 1), 2000, CRC Press, Chapter 3, Secured Connections to External Networks
(page 54).

The opening of a mechanical lock without the proper key by carefully aligning the pins in the lock is defined as lock picking. A mechanical lock is a device that secures an entry point, such as a door, a window, or a cabinet, by using a physical mechanism, such as a pin tumbler, a wafer, or a disc detainer. A mechanical lock requires a proper key to unlock it, which matches the configuration of the mechanism. Lock picking is a technique of manipulating the mechanism of the lock without the proper key, usually by using tools, such as picks, tension wrenches, or rakes. Lock picking can exploit the flaws or weaknesses of the lock, such as the variations, tolerances, or defects of the pins or the cylinder. Lock picking can be used for legitimate purposes, such as locksmithing, hobby, or sport, or for illegitimate purposes, such as burglary, espionage, or sabotage.
References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3: Security Engineering, p. 136; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 3: Security Engineering, p. 297.

“The environment that must be protected through physical security controls includes all personnel, equipment, data, communication devices, power supplies, and wiring. The necessary level of protection depends on the value of the data, the computer systems, and the company assets within the facility. The value of these items can be determined by a critical-path analysis, which lists each piece of the infrastructure and what is necessary to keep those pieces healthy and operational.” Pg 255 Shon Harris: All-in-One CISSP Certification

Access to session state variables is required to validate web session management. Web session management is the process of maintaining the state and information of a user across multiple requests and interactions with a web application. Web session management relies on session state variables, which are data elements that store the user’s preferences, settings, authentication status, and other relevant information for the duration of the session. Session state variables can be stored on the client side (such as cookies or local storage) or on the server side (such as databases or files). To validate web session management, it is necessary to access the session state variables and verify that they are properly generated, maintained, and destroyed by the web application. This can help to ensure the security, functionality, and performance of the web application and the user experience. The other options are not required to validate web session management. Log timestamp is a data element that records the date and time of a user’s activity or event on the web application, but it does not store the user’s state or information. Live session traffic is the network data that is exchanged between the user and the web application during the session, but it does not reflect the session state variables that are stored on the client or the server side. Test scripts are code segments that are used to automate the testing of the web application’s features and functions, but they do not access the session state variables directly.
References: Session Management – OWASP Cheat Sheet Series; Session Management: An Overview | SecureCoding.com; Session Management in HTTP – GeeksforGeeks.

Service Organization Control 1 (SOC1) is a report that provides information about the controls at a service organization that may affect the user entities’ internal control over financial reporting. It is intended for users who have a reasonable understanding of the nature and significance of the service provided, the service organization’s system, and the applicable trust services criteria. A SOC 1 report can help an organization evaluate the effectiveness of the service organization’s controls that are relevant to users internal control over financial reporting.

Section: Software Development Security

An Ethernet address is a 48-bit address that is hard-wired into the Network Interface Cards
(NIC) of the network node.
A Media Access Control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies and most IEEE 802 network technologies, including
Ethernet. Logically, MAC addresses are used in the Media Access Control protocol sub- layer of the OSI reference model.
MAC addresses are most often assigned by the manufacturer of a network interface card
(NIC) and are stored in its hardware, the card’s read-only memory, or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer’s registered identification number and may be referred to as the burned-in address. It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. A network node may have multiple NICs and will then have one unique MAC address per NIC.
MAC addresses are formed according to the rules of one of three numbering name spaces managed by the Institute of Electrical and Electronics Engineers (IEEE): MAC-48, EUI-48, and EUI-64. The IEEE claims trademarks on the names EUI-48 and EUI-64, in which EUI is an abbreviation for Extended Unique Identifier.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 87.
and
https://en.wikipedia.org/wiki/MAC_address

As protocol was introduced by Visa and Mastercard to allow for more credit card
transaction possibilities. It is comprised of three different pieces of software, running on the
customer’s PC (an electronic wallet), on the merchant’s Web server and on the payment server of
the merchant’s bank. The credit card information is sent by the customer to the merchant’s Web
server, but it does not open it and instead digitally signs it and sends it to its bank’s payment
server for processing.
The following answers are incorrect because :
SSH (Secure Shell) is incorrect as it functions as a type of tunneling mechanism that provides
terminal like access to remote computers.
S/MIME is incorrect as it is a standard for encrypting and digitally signing electronic mail and for
providing secure data transmissions.
SSL is incorrect as it uses public key encryption and provides data encryption, server
authentication, message integrity, and optional client authentication.
Reference : Shon Harris AIO v3 , Chapter-8: Cryptography , Page : 667-669

Something you know and something you have is two authentication factors and is better than a single authentication factor. Strong Authentication or Two Factor
Authentication is widely accepted as the best practice for authentication.
There are three type of authentication factors:
Type 1 – Something you know (password, pin)
Type 2 – Something you have (token, smart card, magnetic card)
Type 3 – Something you are (biometics)
Whenever two of the three types of factors are used together, this is called strong authentication or two factors authentication
The following answers are incorrect:
Establish biometric access through a secured server or Web site:
This is a single factor authentication and it could be weaker than two factors, in most cases it is . Biometric devices can be tricked or circumvented in some cases, this is why they
MUST be supplemented with a second factor of authentication. Multiple attacks have been done on different types of biometric devices. Two factors is always the best to authenticate a user.
Maintain correct and accurate ACLs (access control lists) to allow access to applications:
ACL are attached to objects. They are used within the access control matrix to define what level of access each of the subjects have on the object. It is a column within the Access
Control matrix. This is related to authorization and not authentication.
Allow access only through user ID and password:
This is once again a single factor of authentication because both are something the person knows.

Explanation
WS-Authorization
Reference: Java Web Services: Up and Running” By Martin Kalin page 228

Retina based biometric involves analyzing the layer of blood vessels situated at the back of the eye.
An established technology, this technique involves using a low-intensity light source through an optical coupler to scan the unique patterns of the retina. Retinal scanning can be quite accurate but does require the user to look into a receptacle and focus on a given point. This is not particularly convenient if you wear glasses or are concerned about having close contact with the reading device. For these reasons, retinal scanning is not warmly accepted by all users, even though the technology itself can work well.
For your exam you should know the information below:
Biometrics
Biometrics verifies an individual’s identity by analyzing a unique personal attribute or behavior, which is one of the most effective and accurate methods of verifying identification and not well received by society. Biometrics is a very sophisticated technology; thus, it is much more expensive and complex than the other types of identity verification processes.
A biometric system can make authentication decisions based on an individual’s behavior, as in signature dynamics, but these can change over time and possibly be forged.
Biometric systems that base authentication decisions on physical attributes (such as iris, retina, or fingerprint) provide more accuracy because physical attributes typically don’t change, absent some disfiguring injury, and are harder to impersonate
Biometrics is typically broken up into two different categories. The first is the physiological.
These are traits that are physical attributes unique to a specific individual. Fingerprints are a common example of a physiological trait used in biometric systems. The second category of biometrics is known as behavioral. The behavioral authentication is also known as continuous authentication. The behavioral/continuous authentication prevents session hijacking attack. This is based on a characteristic of an individual to confirm his identity. An example is signature Dynamics. Physiological is “what you are” and behavioral is “what you do.”
When a biometric system rejects an authorized individual, it is called a Type I error (false rejection rate). When the system accepts impostors who should be rejected, it is called a
Type II error (false acceptance rate). The goal is to obtain low numbers for each type of error, but Type II errors are the most dangerous and thus the most important to avoid.
When comparing different biometric systems, many different variables are used, but one of the most important metrics is the crossover error rate (CER). This rating is stated as a percentage and represents the point at which the false rejection rate equals the false acceptance rate. This rating is the most important measurement when determining the system’s accuracy. A biometric system that delivers a CER of 3 will be more accurate than a system that delivers a CER of 4 Crossover error rate (CER) is also called equal error rate
(EER).
Throughput describes the process of authenticating to a biometric system. This is also referred to as the biometric system response time. The primary consideration that should be put into the purchasing and implementation of biometric access control are user acceptance, accuracy and processing speed.
Biometric Considerations
In addition to the access control elements of a biometric system, there are several other considerations that are important to the integrity of the control environment. These are:
Resistance to counterfeiting
Data storage requirements
User acceptance
Reliability and
Target User and approach
Fingerprint
Fingerprints are made up of ridge endings and bifurcations exhibited by friction ridges and other detailed characteristics called minutiae. It is the distinctiveness of these minutiae that gives each individual a unique fingerprint. An individual places his finger on a device that reads the details of the fingerprint and compares this to a reference file. If the two match, the individual’s identity has been verified.
Palm Scan
The palm holds a wealth of information and has many aspects that are used to identify an individual. The palm has creases, ridges, and grooves throughout that are unique to a specific person. The palm scan also includes the fingerprints of each finger. An individual places his hand on the biometric device, which scans and captures this information. This information is compared to a reference file, and the identity is either verified or rejected.
Hand Geometry
The shape of a person’s hand (the shape, length, and width of the hand and fingers) defines hand geometry. This trait differs significantly between people and is used in some biometric systems to verify identity. A person places her hand on a device that has grooves for each finger. The system compares the geometry of each finger, and the hand as a whole, to the information in a reference file to verify that person’s identity.
Retina Scan
A system that reads a person’s retina scans the blood-vessel pattern of the retina on the backside of the eyeball. This pattern has shown to be extremely unique between different people. A camera is used to project a beam inside the eye and capture the pattern and compare it to a reference file recorded previously.
Iris Scan
An iris scan is a passive biometric control
The iris is the colored portion of the eye that surrounds the pupil. The iris has unique patterns, rifts, colors, rings, coronas, and furrows. The uniqueness of each of these characteristics within the iris is captured by a camera and compared with the information gathered during the enrollment phase.
When using an iris pattern biometric system, the optical unit must be positioned so the sun does not shine into the aperture; thus, when implemented, it must have proper placement within the facility.
Signature Dynamics
When a person signs a signature, usually they do so in the same manner and speed each time. Signing a signature produces electrical signals that can be captured by a biometric system. The physical motions performed when someone is signing a document create these electrical signals. The signals provide unique characteristics that can be used to distinguish one individual from another. Signature dynamics provides more information than a static signature, so there are more variables to verify when confirming an individual’s identity and more assurance that this person is who he claims to be.
Keystroke Dynamics
Whereas signature dynamics is a method that captures the electrical signals when a person signs a name, keystroke dynamics captures electrical signals when a person types a certain phrase. As a person types a specified phrase, the biometric system captures the speed and motions of this action. Each individual has a certain style and speed, which translate into unique signals. This type of authentication is more effective than typing in a password, because a password is easily obtainable. It is much harder to repeat a person’s typing style than it is to acquire a password.
Voice Print
People’s speech sounds and patterns have many subtle distinguishing differences. A biometric system that is programmed to capture a voice print and compare it to the information held in a reference file can differentiate one individual from another. During the enrollment process, an individual is asked to say several different words.
Facial Scan
A system that scans a person’s face takes many attributes and characteristics into account.
People have different bone structures, nose ridges, eye widths, forehead sizes, and chin shapes. These are all captured during a facial scan and compared to an earlier captured scan held within a reference record. If the information is a match, the person is positively identified.
Hand Topography
Whereas hand geometry looks at the size and width of an individual’s hand and fingers, hand topology looks at the different peaks and valleys of the hand, along with its overall shape and curvature. When an individual wants to be authenticated, she places her hand on the system. Off to one side of the system, a camera snaps a side-view picture of the hand from a different view and angle than that of systems that target hand geometry, and thus captures different data. This attribute is not unique enough to authenticate individuals by itself and is commonly used in conjunction with hand geometry.
Vascular Scan
Valcular Scan uses the blood vessel under the first layer of skin.
The following answers are incorrect:
Fingerprint – Fingerprints are made up of ridge endings and bifurcations exhibited by friction ridges and other detailed characteristics called minutiae. It is the distinctiveness of these minutiae that gives each individual a unique fingerprint. An individual places his finger on a device that reads the details of the fingerprint and compares this to a reference file. If the two match, the individual’s identity has been verified.
Hand Geometry – The shape of a person’s hand (the shape, length, and width of the hand and fingers) defines hand geometry. This trait differs significantly between people and is used in some biometric systems to verify identity. A person places her hand on a device that has grooves for each finger. The system compares the geometry of each finger, and the hand as a whole, to the information in a reference file to verify that person’s identity.
Palm Scan – The palm holds a wealth of information and has many aspects that are used to identify an individual. The palm has creases, ridges, and grooves throughout that are unique to a specific person. The palm scan also includes the fingerprints of each finger. An individual places his hand on the biometric device, which scans and captures this information. This information is compared to a reference file, and the identity is either verified or rejected.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 330 and 331
Official ISC2 guide to CISSP CBK 3rd Edition Page number 924

When you consider top priority tickets for the data center, security, data protection, and power consumption rise to the top. But the one thing that every data center should have, that we often throw on the back burner, is fire protection. Right now, if you heard that your data center was engulfed in flames, you would likely sit in shock, especially if you were not equipped with the proper protection. Fortunately, you can avoid this reality by taking the proper steps to protect your data center.
Dave Admirand, chief data center engineer at PTS Data Center Solutions (www.ptsdcs.com), says in his own experience, electrical fires are the most common types of fires in data centers. He says, “These are typically caused by electronic equipment failures or failures of the branch circuits powering the data center equipment, including UPS and air-conditioning equipment-if located in the data center.”
So what does the industry offer when it comes to fire detectors and extinguishing systems designed for the data center? According to Ziemba, there is a myriad of different smoke and heat detectors available, and some, he says, are so sophisticated that they can detect-and help extinguish-a fire even before it reaches the incipient, or flame, stage. He says, “Detectors that provide early warning capabilities are very effective in this type of situation. Addressable control panels serve as the brains for the overall fire suppression system in that they receive the signals from the detectors, provide some type of warning to the occupants, and then discharge the system.”
The following Reference(s) were used for this question: http://xtralis.com/resources/article_level1/838/Processor_Editorial__Data_Center_Fire_Protection_January_5x_2007.pdf and http://www.interfire.org/features/electric_wiring_faults.asp

Information security policies area high-level plans that describe the goals of the procedures. Policies are not guidelines or standards, nor are they procedures or controls. Policies describe security in general terms, not specifics. They provide the blueprints for an overall security program just as a specification defines your next product – Roberta Bragg CISSP Certification Training Guide (que) pg 206

The attack surface is the number of all possible points, or attack vectors, where an unauthorized user can access a system and extract data. The smaller the attack surface, the easier it is to protect.

The others refer to other laws or guidelines.

In most projects the conditions for failure are established at the beginning of the
project. Thus risk management should be established at the commencement of the project with a
risk assessment during project initiation.
As it is clearly stated in the ISC2 book: Security should be included at the first phase of
development and throughout all of the phases of the system development life cycle. This is a key
concept to understand for the purpose for the exam.
The most useful time is to undertake it at project initiation, although it is often valuable to update
the current risk analysis at later stages.
Attempting to retrofit security after the SDLC is completed would cost a lot more money and might
be impossible in some cases. Look at the family of browsers we use today, for the past 8 years
they always claim that it is the most secure version that has been released and within days
vulnerabilities will be found.
Risks should be monitored throughout the SDLC of the project and reassessed when appropriate.
The phases of the SDLC can very from one source to another one. It could be as simple as
Concept, Design, and Implementation. It could also be expanded to include more phases such as
this list proposed within the ISC2 Official Study book:
Project Initiation and Planning
Functional Requirements Definition
System Design Specification
Development and Implementation
Documentations and Common Program Controls
Testing and Evaluation Control, certification and accreditation (C&A)
Transition to production (Implementation)
And there are two phases that will extend beyond the SDLC, they are:
Operation and Maintenance Support (O&M)
Revisions and System Replacement (Disposal)
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor
2002 review manual, chapter 6: Business Application System Development, Acquisition,
Implementation and Maintenance (page 291).
and
The Official ISC2 Guide to the CISSP CBK , Second Edition, Page 182-185

According to the AIO 3rd edition, these are the necessary steps for a proper classification program:
1.Define classification levels.
2.Specify the criteria that will determine how data is classified.
3.Have the data owner indicate the classification of the data she is responsible for.
4.Identify the data custodian who will be responsible for maintaining data and its security level.
5.Indicate the security controls, or protection mechanisms, that are required for each classification level.
6.Document any exceptions to the previous classification issues.
7.Indicate the methods that can be used to transfer custody of the information to a different data owner.
8.Create a procedure to periodically review the classification and ownership. Communicate any changes to the data custodian.
9.Indicate termination procedures for declassifying the data.
10.
Integrate these issues into the security-awareness program so that all employees understand how to handle data at different classification levels.
Domain: Information security and risk management Reference: AIO 3rd edition page 50

Operation as a process owner should give requirement to IT. HR is responsible for access control provision not business process provision.