ISC2 CISSP Practice Exam Questions & Answers

A baseline is a standard or reference point against which something can be measured or compared. A system configuration baseline is a documented set of specifications for the hardware and software components of an information system, such as operating system, applications, patches, settings, etc. A system configuration baseline can be used to ensure that the system meets the security and performance requirements of the organization, and to detect any unauthorized or unwanted changes to the system. To verify that an information system's current hardware and software match the standard system configuration, the organization can compare the actual configuration of the system against the baseline, using tools such as configuration management software, checksums, or hashes. Reviewing the configuration after the system goes into production is not sufficient, as it does not account for any changes that may occur after the initial deployment. Running vulnerability scanning tools on all devices in the environment is not specific, as it does not compare the system configuration against the baseline, but rather against a database of known vulnerabilities. Verifying all the approved security patches are implemented is not comprehensive, as it does not cover other aspects of the system configuration, such as applications, settings, etc.Reference:System Configuration Baseline, [CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3: Security Architecture and Engineering]2

The most important security goal when performing application interface testing is to examine error conditions related to external interfaces to prevent application details leakage. Application interface testing is a type of testing that focuses on the interactions between different systems or components through their interfaces, such as APIs, web services, or protocols. Error conditions related to external interfaces can occur when the input, output, or communication is invalid, incomplete, or unexpected. These error conditions can cause the application to reveal sensitive or confidential information, such as error messages, stack traces, configuration files, or database queries, which can be exploited by attackers to gain access or compromise the system. Therefore, it is important to examine these error conditions and ensure that the application handles them properly and securely. Confirming that all platforms are supported and function properly, evaluating whether systems or components pass data and control correctly to one another, and verifying compatibility of software, hardware, and network connections are not security goals, but functional or performance goals of application interface testing.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Software Development Security, page 1000;Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 7: Software Development Security, page 922.

A primary security weakness in the design of Domain Name System (DNS) is that a DNS server does not authenticate the source of information it receives or sends. This makes DNS vulnerable to various attacks, such as spoofing, cache poisoning, or hijacking, where an attacker can impersonate a legitimate DNS server or client and send or receive false or malicious information. This can result in redirecting users to malicious websites, stealing sensitive data, or disrupting network services. A DNS server can be disabled in a denial-of-service (DoS) attack, but this is not a weakness in the design of DNS, but rather a weakness in the implementation or configuration of DNS. A DNS server must hold the address of the root servers, but this is not a weakness in the design of DNS, but rather a requirement for resolving domain names. A DNS server database can be injected with falsified checksums, but this is not a weakness in the design of DNS, but rather a weakness in the security of the DNS server database.Reference:CISSP CBK Reference, 5th Edition, Chapter 4, page 217;CISSP All-in-One Exam Guide, 8th Edition, Chapter 4, page 179

The framework that provides vulnerability metrics and characteristics to support the National Vulnerability Database (NVD) is the Common Vulnerability Scoring System (CVSS). CVSS is a framework that provides a standardized and consistent way to measure and communicate the severity and the impact of the vulnerabilities or weaknesses that may affect the security or the functionality of the systems or the components. CVSS provides vulnerability metrics and characteristics, such as the base score, the temporal score, and the environmental score, that are based on the various factors or attributes of the vulnerabilities, such as the exploitability, the scope, the impact, the remediation, or the confidence. CVSS supports the NVD, which is a repository or a database that collects and maintains the information or the data about the publicly known or reported vulnerabilities or weaknesses that are identified by the Common Vulnerabilities and Exposures (CVE) identifiers. CVSS supports the NVD, because it can:

Provide a common and uniform language or terminology for describing and defining the vulnerabilities or weaknesses that are included in the NVD, and facilitate the understanding and the comparison of the vulnerabilities or weaknesses among the users or the stakeholders.

Provide a quantitative and qualitative assessment or evaluation of the vulnerabilities or weaknesses that are included in the NVD, and indicate the level of risk or threat that the vulnerabilities or weaknesses pose to the systems or the components.

Provide a dynamic and flexible measurement or calculation of the vulnerabilities or weaknesses that are included in the NVD, and reflect the changes or the updates of the vulnerabilities or weaknesses over time or across different environments or scenarios.

The other options are not the frameworks that provide vulnerability metrics and characteristics to support the NVD. Center for Internet Security (CIS) is an organization that provides the best practices and the guidelines for securing the systems or the components, such as the CIS Controls and the CIS Benchmarks, that are based on the consensus and the collaboration of the experts or the professionals in the field of cybersecurity. CIS does not provide vulnerability metrics and characteristics to support the NVD, but rather provides security recommendations and configurations to prevent or mitigate the vulnerabilities or weaknesses that are included in the NVD. Common Vulnerabilities and Exposures (CVE) is a system that provides the identifiers or the names for the publicly known or reported vulnerabilities or weaknesses that affect the security or the functionality of the systems or the components, and that are used for referencing and tracking the vulnerabilities or weaknesses. CVE does not provide vulnerability metrics and characteristics to support the NVD, but rather provides vulnerability identification and classification to populate and maintain the NVD. Open Web Application Security Project (OWASP) is an organization that provides the resources and the tools for improving the security of the web applications or the websites, such as the OWASP Top 10 and the OWASP Testing Guide, that are based on the research and the analysis of the experts or the professionals in the field of web application security. OWASP does not provide vulnerability metrics and characteristics to support the NVD, but rather provides vulnerability awareness and education to prevent or mitigate the vulnerabilities or weaknesses that are included in the NVD.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4: Security Architecture and Engineering, page 450.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4: Security Architecture and Engineering, page 451.

The best way to establish identity over the internet is to use a Remote Authentication Dial-In User Service (RADIUS) server with hardware tokens. A RADIUS server is a server that provides centralized authentication, authorization, and accounting (AAA) services for remote or network access clients, such as users or devices that connect to a network or a system over the internet. A RADIUS server can authenticate the identity of the clients by using various methods or protocols, such as passwords, certificates, or tokens. A hardware token is a physical device, such as a smart card, a USB device, or a key fob, that generates and displays a one-time password (OTP) or a personal identification number (PIN) that is used to authenticate the identity of the client. A hardware token can provide a strong and secure way of establishing identity over the internet, as it adds an extra factor of authentication, and it makes the identity verification unpredictable and resistant to attacks or theft. Using a RADIUS server with hardware tokens is the best way to establish identity over the internet, as it combines the advantages of centralized and standardized AAA services, and the benefits of strong and secure authentication methods. Challenge Handshake Authentication Protocol (CHAP) and strong passwords, Internet Mail Access Protocol (IMAP) with Triple Data Encryption Standard (3DES), and remote user authentication via Simple Object Access Protocol (SOAP) are not the best ways to establish identity over the internet, as they are either not as effective or not as efficient as using a RADIUS server with hardware tokens, or they serve different purposes or functions than establishing identity over the internet.Reference:

[Identity]

[RADIUS Server]

[Hardware Token]

According to the (ISC)2 ethics canon ''act honorably, honestly, justly, responsibly, and legally,' the order that should be used when resolving conflicts is public safety and duties to principals, individuals, and the profession. The (ISC)2 ethics canon is a set of ethical principles and guidelines that govern the professional and personal conduct of the (ISC)2 members and certification holders. The (ISC)2 ethics canon states that the (ISC)2 members and certification holders should act honorably, honestly, justly, responsibly, and legally, and that they should advance and protect the profession. The (ISC)2 ethics canon also provides a hierarchy of obligations that the (ISC)2 members and certification holders should follow when resolving conflicts or dilemmas that may arise from their professional or personal activities. The hierarchy of obligations is as follows: public safety and duties to principals, individuals, and the profession. Public safety is the highest obligation, and it refers to the protection of the health, welfare, and security of the general public from any harm or danger. Duties to principals are the second highest obligation, and they refer to the loyalty, fidelity, and honesty that the (ISC)2 members and certification holders owe to their employers, clients, or customers. Individuals are the third highest obligation, and they refer to the respect, dignity, and privacy that the (ISC)2 members and certification holders should show to other people, such as colleagues, peers, or users. The profession is the lowest obligation, and it refers to the advancement and protection of the information security profession and its reputation, standards, and ethics. The other options are not the correct order of the hierarchy of obligations according to the (ISC)2 ethics canon.Reference:Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 1: Security and Risk Management, page 35.

: Change management is the process of controlling and documenting any modifications to the hardware, software, firmware, or documentation of an information system. Change management ensures that changes are authorized, tested, approved, implemented, and reviewed in a systematic and consistent manner. Change management also reduces the risks of introducing errors, vulnerabilities, or disruptions to the system or the business operations. The quality assurance (QA) department is responsible for testing the changes before they are released to the production environment, and verifying that they meet the functional and security requirements. If the QA department is short-staffed and is unable to test all modules before the anticipated release date of an application, the security control of change management is most likely to be violated, as the changes may not be properly tested, validated, or documented, and may introduce unforeseen issues or risks to the system or the organization.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Security Operations, page 517.Official (ISC) CISSP CBK Reference, Fifth Edition, Domain 7: Security Operations, page 881.