Exam (elaborations)
CISSP - Mock Exam Questions. Questions & answers
CISSP - Mock Exam Questions. Questions & answers
[Show more]
Content preview
CISSP - Mock Exam QuestionsDescribe the differences between SOC-1, SOC-2, and SOC-3, as well as Type 1 vs
Type 2 reports - ANS-SOC-1 assess organization controls related to financial reporting
SOC-2 assess organization controls related to security, availability, integrity, and
confidentiality and produce results intended only for internal distribution
SOC-3 assess organization controls related to security, availability, integrity, and
confidentiality, and produce results intended for general distribution
Type 1: address the design and implementation of the controls in place at an
organization at a specific point in time
Type 2: assess organizational controls over a period of time and evaluate their
operation and effectiveness
Describe diffusion and transposition in ciphertext - ANS-Diffusion is introduced using
transposition. Diffusion means that if a single change in the plain text occurs, multiple
ciphertext changes will also occur. Transposition is the rearrangement of data.
Describe Forward Secrecy (FS) - ANS-AKA Perfect Forward Secrecy (PFS), is used to
prevent the compromise of a long-term secret key from affecting the confidentiality of
past transmissions.
What technologies does WPA3 replace with Simultaneous Authentication of Equals
(SAE)? - ANS-Pre-Shared Keys (PSK)
Describe SAE - ANS-Uses zero-knowledge proof instead of sending a hash of the
password to the access point.
What key exchange method does WPA3 use? - ANS-Dragonfly Key Exchange
What does WPA3 use to encrypt all wireless transmissions? - ANS-AES-CCMP
Describe SRTP - ANS-Secure Real-Time Transport Protocol is a profile for Real-time
Transport Protocol (RTP) intended to provide encryption, message authentication and
, integrity, and replay attack protection to the RTP data in both unicast and multicast
applications.
What should software developers include in their code to ensure user input is an
acceptable length that doesn't make it vulnerable to Buffer Overflows? - ANS-Bounds
checks
What is needed most to provide accountability for a system? - ANS-Identification &
Authentication
Which of the following protocols or standards is least likely to provide authentication?
OpenID, OAuth, SAML, OpenID Connect - ANS-OAuth
What defines the scope and enforcement of security within an organization? -
ANS-Policy
What are mandatory rules for a given subset of technology? - ANS-Standards
What are recommended steps for a given subset of technology? - ANS-Guidelines
What are the step-by-step tasks that should be performed for a given subset of
technology? - ANS-Procedures
What does the Clark-Wilson model rely on? - ANS-Separation of duties and separation
of subjects from objects
Which security model has the "access triple", and what is the access triple? -
ANS-Clark-Wilson. Subject/Program/Object.
What does the Clark-Wilson model define and confirm? - ANS-Constrained Data Items
(CDI) and integrity verification procedures and confirms transformation procedures
(TPs).
W/ the [CI]A triad, what does the CBC-MAC encryption mode provide, and which does it
not provide? - ANS-It provides integrity, but not confidentiality
What are the steps of the SSL/TLS handshake? - ANS-1. Client --> "Hello" --> Server
2. Server --> "Server hello" [encrypted w/ private key] --> Client
3. Client decrypts the message using the public key
4. Client --> pre-master secret encrypted w/ public key --> Server
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller EXAMQA. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for CA$16.48. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
83100 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now