Nov-2022 Free ISC cissp Exam Question Practice Exams [Q56-Q70]

Policies are high-level statements, beliefs, goals and objectives and the general means for their attainment for a specific subject area. Standards are mandatory activities, action, rules or regulations designed to provide policies with the support structure and specific direction they require to be effective. Guidelines are more general statements of how to achieve the policies objectives by providing a framework within which to implement procedures. Procedures spell out the specific steps of how the policy and supporting standards and how guidelines will be implemented.
Source: HARE, Chris, Security management Practices CISSP Open Study Guide, version
1.0, april 1999.

“Kerberos relies upon symmetric key cryptography, specifically Data Encryption Standard (DES), and provides end-to-end security for authentication traffic between the client and the Key Distribution Center (KDC).” Pg. 15 Tittel: CISSP Study Guide

In link encryption, each entity has keys in common with its two neighboring nodes in the transmission chain.
Thus, a node receives the encrypted message from its predecessor, decrypts it, and then re-encrypts it with a new key, common to the successor node. Obviously, this mode does not provide protection if anyone of the nodes along the transmission path is compromised.
Encryption can be performed at different communication levels, each with different types of protection and implications. Two general modes of encryption implementation are link encryption and end-to-end encryption.
Link encryption encrypts all the data along a specific communication path, as in a satellite link, T3
line, or telephone circuit. Not only is the user information encrypted, but the header, trailers,
addresses, and routing data that are part of the packets are also encrypted. The only traffic not
encrypted in this technology is the data link control messaging information, which includes
instructions and parameters that the different link devices use to synchronize communication
methods. Link encryption provides protection against packet sniffers and eavesdroppers.
In end-to-end encryption, the headers, addresses, routing, and trailer information are not
encrypted, enabling attackers to learn more about a captured packet and where it is headed.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (pp. 845-846). McGraw-Hill.
And:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of
Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 132).

The security term that is concerned with
the same primary key existing at different classification levels in the same database is polyinstantiation.
Answer Polymorphism is incorrect because
polymorphism is defined as objects of many different classes that are
related by some common superclass; thus, any object denoted by this
name is able to respond to some common set of operations in a different way.
Answer Normalization is incorrect because normalization refers to
removing redundant or incorrect data from a database.
Answer Inheritance is incorrect because inheritance refers to methods from a class inherited by another subclass.

The first activity in every recovery plan is damage assessment, immediately
followed by damage mitigation.
This first activity would typically include assessing the damage to all network and server
components (including cables, boards, file servers, workstations, printers, network equipment),
making a list of all items to be repaired or replaced, selecting appropriate vendors and relaying
findings to Emergency Management Team.
Following damage mitigation, equipment can be recovered and LAN communications network and
servers can be reinstalled.
Source: BARNES, James C. & ROTHSTEIN, Philip J., A Guide to Business Continuity Planning,
John Wiley & Sons, 2001 (page 135).

Section: Software Development Security

Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 35

Availability refers to the accessibility of information used by the entity’s systems as well as the products or services provided to its customers. The availability objective does not, in itself, set a minimum acceptable performance level; it does not address system functionality (the specific functions a system performs) or usability (the ability of users to apply system functions to the performance of specific tasks or problems). However, it does address whether systems include controls to support accessibility for operation, monitoring, and maintenance.

Not D: does not make much sense. The purpose of the one-way hash it to create a message
digest.
Not C.
“To generate a digital signature, the digital signal program passes the file to be sent through a
one-way hash function. This hash function produces a fixed size output from a variable size input.”
Pg. 208 Krutz: The CISSP Prep Guide: Gold Edition.

With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as doctor, nurse, teller, manager). The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization.

All passwords must be changed if the root password is compromised or disclosure is suspected. (This is a separate case; the optimal solution would be to reload the compromised computer. A computer that has been downgraded can never be upgraded to higher security level)

The Trusted Computer System Evaluation Criteria [Orange Book]
defines major hierarchical classes of security by the letters D (least
secure) through A (most secure):
D. Minimal protection
C. Discretionary protection (C1&C2)
B. Mandatory protection (B1, B2, B3)
A. Verified protection; formal methods (A1)
Source: DoD 5200.28-STD Department of Defense Trusted Computer
System Evaluation Criteria.