CISSP Exam questions with answers

CISSP Exam questions with answers \| \| \| \|




CIA Triangle - CORRECT ANSWERS ✔✔Cornerstone of infosec.
\| \| \| \| \| \| \| \|


Confidentiality, Integrity, Availability \| \|




Confidentiality (CIA Triangle) - CORRECT ANSWERS ✔✔prevention \| \| \| \| \| \| \|


of unauthorized disclosure of information; prevention of
\| \| \| \| \| \| \|


unauthorized read access to data \| \| \| \|




Integrity (CIA Triangle) - CORRECT ANSWERS ✔✔prevention of
\| \| \| \| \| \| \| \|


unauthorized modification of data; prevention of unauthorized
\| \| \| \| \| \| \|


write access to data
\| \| \|




Availability (CIA Triangle) - CORRECT ANSWERS ✔✔ensures data
\| \| \| \| \| \| \| \|


is available when needed to authorized users
\| \| \| \| \| \|




Opposing forces to CIA - CORRECT ANSWERS ✔✔DAD: disclosure,
\| \| \| \| \| \| \| \| \|


alteration, destruction \|




identification - CORRECT ANSWERS ✔✔the process by which a \| \| \| \| \| \| \| \| \|


subject professes an identity and accountability is initiated; ex:
\| \| \| \| \| \| \| \| \|


typing a username, swiping a smart card, waving a proximity
\| \| \| \| \| \| \| \| \| \|


device (badging in), speaking a phrase, etc - always a two step
\| \| \| \| \| \| \| \| \| \| \| \|


process with authenticating
\| \|

,authentication - CORRECT ANSWERS ✔✔verification that a \| \| \| \| \| \| \|


person is who they say they are; ex: entering a password or PIN,
\| \| \| \| \| \| \| \| \| \| \| \| \|


biometrics, etc - always a two step process with identifying
\| \| \| \| \| \| \| \| \|




authorization - CORRECT ANSWERS ✔✔verification of a person's \| \| \| \| \| \| \| \|


access or privileges to applicable data
\| \| \| \| \|




auditing (monitoring) - CORRECT ANSWERS ✔✔recording a log of
\| \| \| \| \| \| \| \| \|


the events and activities related to the system and subjects
\| \| \| \| \| \| \| \| \|




accounting (accountability) - CORRECT ANSWERS ✔✔reviewing
\| \| \| \| \| \|


log files to check for compliance and violations in order to hold
\| \| \| \| \| \| \| \| \| \| \| \|


subjects accountable for their actions
\| \| \| \|




non-repudiation - CORRECT ANSWERS ✔✔a user cannot deny \| \| \| \| \| \| \| \|


having performed a specific action
\| \| \| \|




subject - CORRECT ANSWERS ✔✔an entity that performs active
\| \| \| \| \| \| \| \| \|


functions to a system; usually a person, but can also be script or
\| \| \| \| \| \| \| \| \| \| \| \| \|


program designed to perform actions on data
\| \| \| \| \| \|




object - CORRECT ANSWERS ✔✔any passive data within the
\| \| \| \| \| \| \| \| \|


system


ISC2 Code of Ethics Canons (4) - CORRECT ANSWERS ✔✔1.
\| \| \| \| \| \| \| \| \| \|


protect society, commonwealth, infrastructure
\| \| \|




2. act honorably, justly, responsibly, legally
\| \| \| \| \|

,3. provide diligent and competent service
\| \| \| \| \|




4. advance and protect the profession
\| \| \| \| \|




strictly applied in order; exam questions in which multiple
\| \| \| \| \| \| \| \| \|


canons could be the answer, choose the highest priority per this
\| \| \| \| \| \| \| \| \| \| \|


order


policy - CORRECT ANSWERS ✔✔mandatory high level
\| \| \| \| \| \| \|


management directives; components of policy \| \| \| \|




1. purpose: describes the need for policy
\| \| \| \| \| \|




2. scope: what systems, people, facilities, organizations are
\| \| \| \| \| \| \| \|


covered
3. responsibilities: specific duties of involved parties
\| \| \| \| \| \|




4. compliance: effectiveness of policy, violations of policy
\| \| \| \| \| \| \|




procedure - CORRECT ANSWERS ✔✔low level step by step guide
\| \| \| \| \| \| \| \| \| \|


for accomplishing a task
\| \| \|




standard - CORRECT ANSWERS ✔✔describes the specific use of
\| \| \| \| \| \| \| \| \|


technology applied to hardware or software; mandatory
\| \| \| \| \| \|




guideline - CORRECT ANSWERS ✔✔discretionary
\| \| \| \| \|


recommendations (e.g. not mandatory) \| \| \|




baseline - CORRECT ANSWERS ✔✔a uniform way of
\| \| \| \| \| \| \| \|


implementing a standard \| \|

, 3 access/security control categories - CORRECT ANSWERS ✔✔1.
\| \| \| \| \| \| \| \|


administrative: implemented by creating org policy, procedure, \| \| \| \| \| \| \|


regulation. user awareness/training also fall here
\| \| \| \| \|




2. technical: implemented using hardware, software, firmware
\| \| \| \| \| \| \|


that restricts logical access to a system
\| \| \| \| \| \|




3. physical: locks, fences, walls, etc
\| \| \| \| \|




preventive access control \| \|




(can be administrative, technical, physical) - CORRECT ANSWERS
\| \| \| \| \| \| \| \|


✔✔prevents actions from occurring by applying restrictions on
\| \| \| \| \| \| \| \|


what a user can do. example: privilege level
\| \| \| \| \| \| \|




detective access control \| \|




(can be administrative, technical, physical) - CORRECT ANSWERS
\| \| \| \| \| \| \| \|


✔✔controls that alert during or after a successful attack; alarm
\| \| \| \| \| \| \| \| \| \|


systems, or closed circuit tv \| \| \| \|




corrective access control \| \|




(can be administrative, technical, physical) - CORRECT ANSWERS
\| \| \| \| \| \| \| \|


✔✔repairing a damaged system; often works hand in hand with
\| \| \| \| \| \| \| \| \| \|


detective controls (e.g. antivirus software)
\| \| \| \|




recovery access control \| \|




(can be administrative, technical, physical) - CORRECT ANSWERS
\| \| \| \| \| \| \| \|


✔✔controls to restore a system after an incident has occurred;
\| \| \| \| \| \| \| \| \|