How to Easily Pass the ISC CISSP Exam: Expert Advice

Agile development is a software development approach that emphasizes iterative, incremental, and collaborative delivery of working software that meets the customer’s needs and expectations. Agile development is based on the Agile Manifesto, which defines four value comparisons that reflect the agile development approach. One of these value comparisons is working software over comprehensive documentation. This means that agile development prioritizes delivering functional and valuable software products over producing extensive and detailed documentation of the software products. This does not mean that agile development ignores or eliminates documentation, but rather that agile development focuses on creating the minimum and essential documentation that supports the software products and the development process. Processes and tools over individuals and interactions, contract negotiation over customer collaboration, or following a plan over responding to change are not value comparisons that reflect the agile development approach, as they are more related to the traditional or waterfall development approach. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 21: Software Development Security, page 1154; CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 8: Software Development Security, Question 8.4, page 303.

 A risk of using commercial off-the-shelf (COTS) products is that they may not map directly to an organization’s security requirements. COTS products are software or hardware products that are ready-made and available for purchase from vendors or suppliers, without any customization or modification. COTS products can offer some advantages, such as lower cost, faster deployment, or better compatibility, but they can also pose some risks, such as:

• COTS products may not map directly to an organization’s security requirements, as they are designed for general or common purposes, and they may not meet the specific or unique needs or expectations of the organization. For example, a COTS product may not support the organization’s preferred encryption algorithm, authentication method, or access control model, or it may have some security vulnerabilities or weaknesses that could compromise the organization’s security posture or compliance.
• COTS products are typically more difficult to secure or update, as the organization does not have full control or visibility over the product’s source code, configuration, or functionality. The organization has to rely on the vendor or the supplier to provide security patches, fixes, or enhancements, which may not be timely, reliable, or compatible. The organization may also face some compatibility or interoperability issues with other systems or products, or some legal or contractual constraints or obligations, when using COTS products.
• COTS products may introduce some hidden or unexpected costs or risks, as the organization may have to pay for additional licenses, fees, or services, or deal with some performance, quality, or usability issues, when using COTS products. The organization may also have to share or disclose some sensitive or confidential information with the vendor or the supplier, or accept some terms or conditions that may limit the organization’s rights or options, when using COTS products.

The other options are not risks of using COTS products. COTS products are typically cheaper than developing software in-house, as the organization does not have to invest in the development, testing, or maintenance of the software. Cost to implement COTS products is not difficult to predict, as the organization can estimate the cost based on the product’s price, features, or specifications. Vendors are not often hesitant to share their source code, as they may offer some level of customization or integration for their COTS products, or they may use open source or standard code for their COTS products. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4: Security Architecture and Engineering, page 439. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4: Security Architecture and Engineering, page 440.

Circuit-level firewalls are a type of firewall that only examines the “handshaking” between packets before forwarding traffic. Circuit-level firewalls operate at the transport layer of the OSI model, and they establish a virtual circuit or session between the source and the destination hosts. Circuit-level firewalls do not inspect the content or the header of the packets, but they only verify that the packets belong to a valid and established session. Circuit-level firewalls are faster and less resource-intensive than other types of firewalls, but they provide less security and visibility. The other options are not correct. Proxy firewalls are a type of firewall that act as an intermediary between the source and the destination hosts, and they inspect and filter the packets at the application layer of the OSI model. Host-based firewalls are a type of firewall that are installed and configured on individual hosts, and they protect the hosts from incoming and outgoing network traffic. Network Address Translation (NAT) firewalls are a type of firewall that modify the source or the destination IP addresses of the packets, and they provide a layer of obfuscation and security for the internal network hosts. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Communication and Network Security, page 589. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 5: Communication and Network Security, page 590.

 Virtualization is a technology that enables the creation of multiple virtual servers that run on a single physical server, sharing its resources, such as CPU, memory, disk, or network. The best approach to implement multiple servers on a virtual system is to implement one primary function per virtual server and apply individual security configuration for each virtual server. This approach can enhance the security, performance, and availability of the virtual servers, as it can isolate the functions and resources of each virtual server, prevent interference or conflicts between different functions, and allow for customized and granular security settings and controls for each virtual server. This approach can also facilitate the management, monitoring, and backup of the virtual servers, as it can simplify the identification, configuration, and recovery of each virtual server. References: Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 3: Security Architecture and Engineering, pp. 507-508; CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Architecture and Engineering, pp. 721-722.

The industry-recognized document that could be used as a baseline reference that is related to data security and business operations for conducting a security assessment is Service Organization Control (SOC) 2 Type 2. A security assessment is a process that involves evaluating and testing the security posture and performance of a system or a network, using various methods, such as audits, reviews, scans, or tests. A security assessment can provide various benefits, such as identifying and resolving the security risks or issues, and ensuring the compliance or alignment with the security standards or regulations. A baseline reference is a document or a source that provides the criteria, requirements, or guidelines for conducting a security assessment, and that can be used as a benchmark or a comparison for measuring or evaluating the security assessment results or outcomes. A baseline reference can be derived from various sources, such as industry standards, best practices, or frameworks. Service Organization Control (SOC) 2 Type 2 is an industry-recognized document that could be used as a baseline reference that is related to data security and business operations for conducting a security assessment. SOC 2 Type 2 is a type of report or attestation that is issued by an independent auditor or a third party, and that evaluates and verifies the security, availability, processing integrity, confidentiality, or privacy controls and practices of a service organization, such as a cloud service provider or a data center, over a period of time, usually six to twelve months. SOC 2 Type 2 is based on the Trust Services Criteria and Principles, which are a set of standards or guidelines that are developed and published by the American Institute of Certified Public Accountants (AICPA), and that define the minimum requirements or expectations for the service organization’s controls and practices. SOC 2 Type 2 can be used as a baseline reference that is related to data security and business operations for conducting a security assessment, as it can provide the assurance and evidence that the service organization has implemented and maintained the effective and consistent security controls and practices, and that the service organization has met or exceeded the Trust Services Criteria and Principles12. References: CISSP CBK, Fifth Edition, Chapter 6, page 573; CISSP Practice Exam – FREE 20 Questions and Answers, Question 18.

Role Based Access Control (RBAC) is a model of access control that assigns permissions to roles, rather than individual users. Roles are defined based on the functions or responsibilities of the users in an organization. Users are then assigned to one or more roles, and inherit the permissions of those roles. RBAC simplifies the administration and management of access control, as it reduces the complexity and redundancy of assigning permissions to each user. RBAC also supports the principle of least privilege, as users only have the permissions they need to perform their tasks. An example of RBAC is allowing users access to files based on their group membership, such as managers, engineers, or accountants. Each group has a predefined set of permissions to access the files relevant to their role, and users who belong to that group can access those files accordingly. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 5: Identity and Access Management (IAM), page 221. [CISSP All-in-One Exam Guide, Eighth Edition], Chapter 10: Identity and Access Management, page 602.

The system tier of the reference architecture where mobile devices would be tracked is tier 2. The reference architecture is a conceptual model that defines the structure, components, and relationships of a system or a service, and that provides a common vocabulary and a consistent view of the system or the service. The reference architecture consists of four system tiers, which are:

• Tier 0: The physical layer, which includes the hardware, devices, and infrastructure that support the system or the service.
• Tier 1: The virtualization layer, which includes the software, platforms, and applications that enable the system or the service to run on virtual machines or containers.
• Tier 2: The control layer, which includes the tools, processes, and functions that manage, monitor, and secure the system or the service.
• Tier 3: The workload layer, which includes the data, information, and business logic that constitute the core of the system or the service. Mobile devices would be tracked in tier 2, as they are part of the control layer that manages, monitors, and secures the system or the service. Mobile devices can be used to access, control, or administer the system or the service, and they can also pose a security risk, as they can be lost, stolen, or compromised. Therefore, mobile devices need to be tracked in tier 2, using asset management tools, processes, and functions, such as inventory, identification, classification, or configuration12. References: CISSP CBK, Fifth Edition, Chapter 4, page 348; CISSP Practice Exam – FREE 20 Questions and Answers, Question 16.

Node capture and false data injection are core categories of malicious attack against Internet of Things (IoT) devices. Node capture is an attack that compromises a physical IoT device and gains access to its data, configuration, or functionality. False data injection is an attack that alters or fabricates the data transmitted or received by an IoT device, which can affect the integrity, availability, or reliability of the IoT system. These attacks can have serious consequences for IoT applications that involve critical infrastructure, health care, or smart cities. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4: Communication and Network Security, page 195; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4: Communication and Network Security, page 269]

The tool that will help identify the source IP address of malware being executed on a computer is the list of open network connections. The list of open network connections is a tool that displays the active network connections on a computer, such as the TCP or UDP sockets, the local and remote IP addresses and ports, the process ID and name, and the connection state. The list of open network connections can be obtained by using commands such as netstat, lsof, or ss, depending on the operating system. The list of open network connections can help identify the source IP address of malware being executed on a computer, by showing the suspicious or malicious network activity that the malware may generate, such as connecting to a command and control server, downloading or uploading data, or scanning for vulnerabilities. The list of open network connections can also help identify the process name and ID of the malware, which can be further investigated by using other tools, such as the list of running processes or the display of the Address Resolution Protocol (ARP) table. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, page 365; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 7: Security Operations, page 490]

User Acceptance Testing (UAT) before implementation is one of the steps included in change management. Change management is a process that ensures that any changes to the system or the environment are planned, approved, tested, implemented, and documented in a controlled and consistent manner. UAT is a type of testing that involves the end users or the stakeholders of the system, and it verifies that the system meets the functional and non-functional requirements and expectations. UAT is usually performed before the implementation of the system or the change, as a final validation step. The other options are not correct. Business continuity testing is a type of testing that evaluates the effectiveness and readiness of the business continuity plan, and it is not directly related to change management. Technical review by business owner is not a standard step in change management, although the business owner may be involved in the approval or the testing of the change. Cost-benefit analysis (CBA) after implementation is not a typical step in change management, although the CBA may be performed before the change to justify the need and the value of the change. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6: Security Assessment and Testing, page 704. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 6: Security Assessment and Testing, page 702.

The description that best describes centralized identity management is that service providers perform as both the credential and identity provider (IdP). Identity management is a type of process that involves defining, verifying, and managing the identity or the information of the users or the entities that access or use a system or a network, or a service or an application, using various methods, such as credentials, identifiers, or attributes. Identity management can provide various benefits, such as enhancing the security, functionality, or usability of the system or the network, or of the service or the application, and ensuring the compliance or alignment with the standards or regulations. Identity management can be classified into various types, such as centralized, decentralized, or federated. Centralized identity management is a type of identity management that involves using or applying a single or a central authority or entity, such as a server or a database, to control and manage the identity or the information of the users or the entities, and to provide or grant the access or the authorization to the users or the entities, for accessing or using the system or the network, or the service or the application. Centralized identity management can provide various benefits, such as simplicity, consistency, or scalability. Centralized identity management can also include various roles or functions, such as:

• Credential provider: The role or the function that involves creating and issuing the credentials, such as passwords, tokens, or certificates, to the users or the entities, for authenticating or verifying the identity or the information of the users or the entities, and for accessing or using the system or the network, or the service or the application.
• Identity provider (IdP): The role or the function that involves storing and managing the identifiers, such as usernames, email addresses, or phone numbers, and the attributes, such as names, roles, or preferences, of the users or the entities, and providing or sharing the identifiers and the attributes of the users or the entities, with the system or the network, or with the service or the application, for identifying or recognizing the users or the entities, and for accessing or using the system or the network, or the service or the application.
• Service provider: The role or the function that involves offering or delivering the system or the network, or the service or the application, to the users or the entities, and requesting or receiving the credentials, the identifiers, or the attributes of the users or the entities, from the credential provider or the identity provider, for authenticating, authorizing, or personalizing the users or the entities, and for accessing or using the system or the network, or the service or the application.

Vulnerability management is the process that has the primary purpose of identifying outdated software versions, missing patches, and lapsed system updates. Vulnerability management is a systematic and proactive approach to identifying, assessing, and mitigating the vulnerabilities that may affect the organization’s information systems and assets. A vulnerability is a weakness or a flaw in a system or an application that can be exploited by an attacker to compromise the security or the functionality of the system or the application. Vulnerability management can help prevent or reduce the impact of the attacks that may exploit the vulnerabilities, and improve the security and the quality of the information systems and assets. Vulnerability management has the primary purpose of identifying outdated software versions, missing patches, and lapsed system updates, as these are some of the common sources and causes of vulnerabilities. Outdated software versions, missing patches, and lapsed system updates can expose the system or the application to known or unknown vulnerabilities, such as bugs, errors, or security flaws, that can be exploited by the attackers. Vulnerability management can help identify these issues and resolve them by applying the latest software versions, patches, and updates, and by ensuring that the system or the application is up to date and secure. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, page 366. CISSP Testking ISC Exam Questions, Question 14.

The document that describes the measures that have been implemented or planned to correct any deficiencies noted during the assessment of the security controls is the Plan of Action and Milestones (POA&M). A POA&M is a tool that helps to track and manage the remediation actions for the identified weaknesses or gaps in the security controls. A POA&M typically includes the following elements: the description of the weakness, the source of the weakness, the risk level of the weakness, the proposed corrective action, the responsible party, the estimated completion date, and the status of the action. A POA&M can help to prioritize the remediation efforts, monitor the progress, and report the results. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6: Security Assessment and Testing, page 295; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 6: Security Assessment and Testing, page 421]

The primary benefit of analyzing the partition layout of a hard disk volume when performing forensic analysis is to find data that was purposely hidden in unused or unallocated space. A partition is a logical division of a hard disk volume that can contain a file system, an operating system, or other data. A partition table is a data structure that stores information about the partitions, such as their size, location, type, and status. By analyzing the partition table, a forensic examiner can identify the partitions that are active, inactive, hidden, or deleted, and recover data from them. Sometimes, malicious users or attackers may hide data in partitions that are not completely utilized, such as slack space, free space, or unpartitioned space, to avoid detection or deletion. By analyzing the partition layout, a forensic examiner can discover and extract such data and use it as evidence. References:

• Hard Disk Partitioning
• Partition Table Forensics
• Data Hiding Techniques in Windows OS

The volatility of data refers to the degree to which data can be lost or altered due to various factors, such as power loss, hardware failure, software error, or human intervention. In a digital forensics investigation, the volatility of data poses a challenge because it requires the investigator to follow a specific order of volatility when collecting and preserving evidence. The order of volatility is based on the principle that the most volatile data should be collected first, before it is overwritten or destroyed by less volatile data. The order of volatility typically includes the following types of data, from most volatile to least volatile: registers, cache, random access memory (RAM), routing tables, kernel statistics, process tables, network connections, executable files, swap files, hard disk, remote logging and monitoring data, physical configuration, network topology, archival media3 . References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8, page 693; [CISSP CBK, Fifth Edition, Chapter 8, page 1049].