CISSP-ISSAP: Information Systems Security Architecture ProfessionalDemo

A full-interruption test halts production operations at the primary location and moves them to the recovery site, validating that the disaster recovery plan can support an actual failover.

Social engineering uses deception and interpersonal manipulation to persuade someone to disclose sensitive information. Impersonating a remote administrator and gaining the technician’s trust to obtain the root password is a social-engineering attack.

Public-key infrastructure authentication binds identities to verified public keys, secret-key authentication can authenticate parties that share a protected key, and off-channel verification independently confirms identity or transaction details. Basic authentication by itself does not prevent a man in the middle from intercepting or relaying credentials.

A certificate server implements PKI by issuing and managing digital certificates that bind identities to public/private key pairs. Those certificates support encryption, authentication, and secure network communications.

Certification and Accreditation (C&A) includes an initiation phase and a continuous-monitoring phase, in addition to security certification and security accreditation. Detection and auditing are not defined C&A process phases.

A circuit-level firewall operates at the OSI Session layer (Layer 5), controlling connections by validating or relaying communication sessions. Packet-filtering firewalls primarily use network- and transport-layer information, while application-level firewalls inspect application-layer traffic.

Elliptic-curve cryptography is a public-key approach based on the mathematics of elliptic curves rather than integer factorization. It can provide comparable security with substantially shorter key sizes than RSA.

Technical controls use hardware, software, or system configuration to enforce security. Auditing creates technology-based records of activity, network architecture can implement technical protections such as segmentation and boundary controls, and system access is enforced through mechanisms such as authentication and authorization. Data backups are generally operational recovery controls.

Network Address Translation (NAT) maps private internal IP addresses to a public IP address for traffic leaving the network. External systems therefore see the public translated address rather than the internal private addresses.

An application-level firewall examines application-layer data, including packet payloads, to apply rules based on the content and protocol behavior.

Thumb impressions are fingerprint-based physiological identifiers, so they are used for biometric authentication.

DNS maps host names to IP addresses. Because the site is accessible directly through its IP address, the web server is reachable; failure only when using www.company.com indicates that the hostname lacks an available DNS entry that resolves it to the server address.

A router connects a LAN to external networks such as the Internet by routing packets between the local network and the WAN or ISP network.

The seven OSI layers, from the physical transmission medium upward to end-user network services, are Physical, Data Link, Network, Transport, Session, Presentation, and Application.

Authorization determines the actions and resources that a subject is permitted to access based on assigned permissions or policy.

Service-oriented architecture enables heterogeneous applications and platforms to interoperate by exposing and consuming loosely coupled services through standardized interfaces and web-based protocols.

SOMF concentrates on realizing the SOA value proposition through reusable software assets and abstracted architectural components, while maintaining traceability to business concerns. Disaster-recovery planning is outside these core modeling principles.

A block cipher processes plaintext in fixed-length blocks of bits, encrypting each block as a unit rather than handling one bit or character at a time.

A Certificate Revocation List (CRL) is the PKI mechanism that publishes the serial numbers of certificates revoked before their scheduled expiration, allowing relying parties to determine that those certificates are no longer valid.

AppLocker applies centrally managed allow or deny rules to applications and files, including rules for particular users or groups. It can allow the approved software needed for critical work while preventing unapproved or potentially malicious software from running.

The Session, Presentation, and Application layers (5–7) provide session control, data formatting or representation, and application-level network services. The Physical, Data Link, Network, and Transport layers (1–4) handle physical connectivity, framing and encapsulation, IP addressing and routing, and end-to-end transport functions such as error recovery.

Off-site storage keeps backup media and document copies at a separate physical location from the computer center, helping protect them from an incident affecting the primary site.

PPTP uses TCP port 1723 for its control connection. Although PPTP also requires GRE traffic for tunneling, TCP 1723 is the applicable firewall port listed.

A brownout is a sustained reduction in supplied voltage or available power when demand exceeds capacity but the grid remains operational. It differs from a blackout, which is a complete interruption of electrical service.