Exam (elaborations)
CISSP Final Exam Questions And Verified Answers
- Course
- Institution
CISSP Final Exam Questions And Verified Answers...
[Show more]
Content preview
CISSP Final Exam Questions And Verified AnswersPlanning -Answer Strategic- long term 5 years
Tactical- one year
Operational-short term and highly detailed
Policy, Standards, Baseline Procedures, Guidelines -Answer- high level documentation
(mandatory) Why?
Not track
-Specific Technology to utilize or what's implemented (mandatory) With What?
-minimum amount of security
-Step by Step process (mandatory) How?
-best practice (Optional)
Military Data Classification -Answer-Top secret-grave damage to national security.
-Secret- serious damage to national security
-Confidential- will have noticeable effects
Industry Data Classifications -Answer -Confidential- Significant damage
-Private- Internal use (privacy) Significant
sn, credit info
-Sensitive- More classified than public
-Public- protect integrity of info
,Comparison of the Ind. VS. Mil:
TS = Confidential/Prop
Secret = Private
Confidential = sensitive
Senior Management -Answer -Highest level of management
-Provide oversight, funding, ensures testing, common vision, sign off
Steering Committee -Answer -Oversight of the infosec programs
-Liaison between mgmt, business, IT
-Ensure stakeholders interest are met
CISO - Chief Information Security Officer: The chief officer who shall oversee the
management of organization information system and information security. Reports to
the CIO.
Strategic planning, policy dev, process improvement, capital planning
Business Managers: Responsible for the business operation.
Giving directions to meet business objectives
Responsible for day-to-day monitoring, reporting, compliance
Data Owner VS System Owner: Data owner - Responsible for classifying, categorizing,
and capability assignment information for placement and protection within the security
solution.
EX: Department manager, user manager, data controller, process manager
System owner -Select Security Controls and Update the system security plan when the
system they are responsible for has a major change
, Data Custodian/ Steward-Question-Things to do in order to provide CIA
-Day to day task/ implement controls
-Testing backups, validating data integrity, deploying, QA, security solutions, and
managing data storage based on classification.
Due Care vs Due Diligence - Answer Take immediate action in a reasonable manner
(Action)
Due Diligence - Answer Taking reasonable measures to investigate security risks.
practicing the activities of maintenance
Research
Threat Modeling - Answer The security process where potential threats are identified,
categorized, and analyzed. Should be completed early and be secure by design
Threat modeling: STRIDE - Answer The security process whereby potential threats are
identified, classified and analysed Should be completed early and be secure by design
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
Threat Identification Focus - Answer Asset, Attacker, Software
Threat Models - Answer Dread Rating System for threats by answering questions
What's the Damage potential, Reproducibility, Exploitability, Affected users,
Discoverability?
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller Easton. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $11.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
67866 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now