CISSP: Certified Information Systems Security ProfessionalDemo

Planning is a high-level audit phase in which the audit scope, objectives, approach, resources, and relevant risks are established. Risk assessment is typically a planning activity, while requirements are an SDLC phase rather than an audit phase.

An IEEE 802.1X bridge can authenticate to the network for devices that do not have an IEEE 802.1X supplicant, allowing the printers to remain connected under the NAC design.

A circuit-level firewall works at the session layer, monitoring and validating the establishment of network sessions (such as TCP handshakes) without performing deep inspection of application-layer content.

OSPFv3 is a link-state interior gateway protocol designed to support IPv6 routing and to scale across an enterprise or campus network. Cisco documents OSPFv3 as supporting IPv6 unicast address families.

Simultaneously providing comparable security services to a competitor creates a conflict of interest and compromises the duty of loyalty owed to the employing organization. The applicable (ISC)2 canon is to provide diligent and competent service to principals.

Unnecessary enabled services create avoidable attack surface and indicate inadequate security hardening, which is a security misconfiguration. OWASP identifies unnecessary ports, services, pages, accounts, and privileges as examples of this category.

DevOps integrates development, testing, operations, and security practices around rapid, continuous delivery and deployment. Its small, cross-functional teams can independently deliver cloud-based code, making a DevOps Integrated Product Team the appropriate fit.

Non-executable memory protection helps mitigate exploits that place malicious code in data buffers and attempt to execute it, such as many buffer-overflow code-injection attacks.

The information security strategy is business-aligned; major changes to the business can change strategic objectives, risk exposure, regulatory obligations, and resource priorities. The plan must therefore be reviewed whenever such changes occur to preserve alignment. ISACA notes that shifts in business strategy and direction can require changes to the cybersecurity strategy.

Data leakage is the most common mobile-device security risk because sensitive information can be exposed when a device is lost, stolen, improperly configured, or used with insecure applications and data-sharing practices.

Digital signatures use asymmetric cryptography: the signer applies a private key, and others verify the signature with the corresponding public key. Because only the private-key holder should be able to create that signature, this provides the basis for non-repudiation. Hashes and message digests support integrity within the signing process but do not independently provide non-repudiation.

Covert channels are generally categorized as storage channels and timing channels. A storage channel conveys information by changing the state of a shared resource in a way another party can detect.

Federated Identity Management enables an identity provider to authenticate a user once and establish trust with multiple applications or service providers, allowing the same credentials to be used across those applications. SAML is a protocol commonly used to implement this federation.

Outdoor-air intakes should be made physically inaccessible by extending or elevating them; this reduces the opportunity to introduce contaminants into the HVAC system. A pre-action sprinkler system requires fire detection before water enters the sprinkler piping, which reduces the chance of accidental water discharge onto sensitive server equipment while retaining automatic fire protection. The upper floors already use pre-action suppression, so changing that protection does not address the identified risk. The CDC/NIOSH guidance specifically recommends extending outdoor-air intake vents and establishing security around them.

A business impact analysis (BIA) documents the consequences of disruptions to critical business processes, including financial, operational, customer-service, and regulatory impacts. It is therefore the appropriate document for evaluating whether a transaction-processing database failure and resulting delayed deposits constituted a material weakness.

Encryption with current cryptographic algorithms protects the confidentiality of data both in transit and at rest, reducing the risk of unauthorized disclosure if network traffic or stored data is accessed. Policy enforcement, MFA with separation of duties, and perimeter defenses are important complementary controls but do not provide the same direct, end-to-end protection for the data itself.

A system risk assessment establishes the threats, vulnerabilities, consequences, and priorities that drive appropriate security architecture and controls. Network topology, attacker detection, and resilience measures should be selected based on those identified risks.

A SOC 2 Type 2 report evaluates controls relevant to security, availability, processing integrity, confidentiality, and privacy, and tests whether those controls operated effectively over a defined period. This provides the most useful assurance for a vendor that handles and processes company data.

Logical access controls authenticate and authorize users or systems to limit access to information assets to permitted entities.

Log reviews, synthetic transactions, and code reviews provide evidence that security safeguards are implemented and operating as expected, so they are forms of security control testing. NIST security assessment guidance recognizes testing and examination techniques as ways to assess security controls and their effectiveness.

Negligence requires proof that the defendant’s conduct was a proximate cause of the victim’s injury. Proximate cause establishes the necessary legal connection between the breach of duty and the harm suffered.

Static analysis inspects an executable without executing it. Disassembling the binary exposes its machine-code instructions and structure so its functionality can be assessed.

Losing control of network devices can give an attacker control of essential infrastructure and enable configuration changes, traffic interception or redirection, outages, persistence, and additional compromise. This creates broader confidentiality, integrity, and availability consequences than traffic flooding, disrupted management communications, or disclosure of topology information alone.

A hierarchy of encryption keys uses separate data-encryption keys for protected data and higher-level keys to encrypt or manage those keys. This avoids making one encryption key the single point of failure for all sensitive data, limiting the impact of a key compromise and supporting safer key rotation and management.