CISSP Section 2

Question 1

1 When switching to hardware encryption from Software encryption, What is most important? What is not?

Answer 1

security level offered by hardware encryption compared to software encryption. Not if it compatibale to exisitng systems.

Question 2

7. What is better at protecting data? A: using strong encryption or password or B: access control

Answer 2

access control.because they ensure that only authorized users can access the data dictionary, preventing unauthorized access and potential breaches. Access controls can include measures such as authentication procedures, permissions and rights management, and monitoring and auditing of access activity. Using strong encryption or pasword does not address issues such as managing who has access to the decryption keys. Unauthorized individuals with the password could still access the data

Question 3

11 How long should you retain data?

Answer 3

LEAST amount of time necessary to comply with legal and regulatory requirements.

Question 4

13 Which is the most effective approach to increase security for the company’s sensitive data? Encryption or MFA

Answer 4

Not Enhance data encryption. While enhancing encryption is crucial, encryption alone won’t protect against all potential threats, especially if the keys or passwords are compromised. (MFA) requires users to provide multiple forms of identification before gaining access to a system. This means that even if a malicious actor obtains a user’s password, they would still need another form of verification (like a token or a fingerprint) to access the system.

Question 5

23 Why is symmetric encryption not enough for data in motion? And what is the solution?

Answer 5

symmetric (or asymmetric) encyrtion by itself is not enough. VPN is the best because it also includes encryption ensuring the integrity and confidentiality of the data while it is in transit.

Question 6

31 What security does CASB provide?

Answer 6

CASBs provide both encryption and access control to protect data that is in transit to the cloud, or within the cloud, and to enforce policies for accessing this data. The CASB encrypts data before it is sent to the cloud and decrypts it when it is returned. It also provides fine-grained access control, which allows organizations to enforce policies on who can access what data, under what circumstances. This dual functionality is what makes CASBs uniquely suited to the requirements

Question 7

34 Common sense mistake. Data retention policy. Which is most effective?

Answer 7

A policy that allows for data to be retained on a case-by-case basis. I picked “shortest amount of time”

Question 8

37 What is the first thing you do to tailor a security plan?

Answer 8

Key word here is “Tailoring”. Customized security controls are built based on the organization’s unique needs and risk profile, indicating that the plan has been customized for that specific organization. Customized security controls may include, for instance, specialized access controls, bespoke encryption protocols, or specific incident response procedures. Risk assessments do not indicate tailoring. They are a pre-requisite to tailoring a security plan, as the information gleaned from risk assessments can then be used to create customized security controls, but they, in themselves, are also not an indicator of a tailored security plan.

Question 9

40 Trick question: Conducting regular audits of network traffic

Answer 9

Don’t forget to read “network”. You forgot to read that.

Question 10

41 What is the best way to protect a food formula or software alogrithm?

Answer 10

Encrypt the formula and store it on a secure server, Not file with USPTO because you can’t patent a formula and algorithm.

Question 11

42 What is MAC memory access control?

Answer 11

security mechanism that regulates how different parts of a computer system, such as processes or users, can interact with specific memory locations. It ensures that only authorized entities can read, write, or execute data within designated memory regions, preventing unauthorized access and potential security breaches.

Question 12

44 Trick question. risk assessment vs vulnerability assessment

Answer 12

Risk and vulnerability accessment is not the same . If the question ask for risk, the answer should be related to risk, not vulnerability.

Question 13

47 what is cspm
Cloud security posture management

Answer 13

CSPM, or Cloud Security Posture Management, is a category of security products that help organizations avoid misconfigurations and reduce risk by checking for deviation from security best practices. CSPM tools continuously monitor and report on an organization’s security status, provide security risk assessment, and suggest remediation steps for the identified misconfigurations and compliance violations in the cloud.

Question 14

49 data sensitivity and data confidendiality mean the same?

Answer 14

No. Confidentiality focuses on preventing unauthorized access or disclosure, but it doesn’t take into account other aspects that might be involved in determining sensitivity, such as the potential impact of unauthorized alteration or destruction.

Question 15

53 what is cloud security gateway

Answer 15

CSGs provide visibility and control over cloud infrastructure

Question 16

63 Which part of CIA does Privilege escalation attack?

Answer 16

Privilege escalation refers to a situation where an attacker gains higher access rights on a system or network, often due to system vulnerabilities, and uses them to cause harm or exploit the system further. While this is a serious security concern, it primarily threatens the integrity and availability aspects of the CIA triad rather than confidentiality directly.

Question 17

63 What does Data exfiltration mean?

Answer 17

Data exfiltration refers to unauthorized copying, transfer, or retrieval of data from a computer or server. This is a direct attack on the confidentiality aspect of the CIA triad.

Question 18

66 Why is In a file cabinet with a lock not very safe vs a Safe

Answer 18

file cabinet with a lock doesn’t protect from environmental elements while a Safe does.

Question 19

70 Which should you do first? A gap analysis or design a plan?

Answer 19

First do a gap analysis to identify areas of non-compliance: The first step is to understand the current state of the organization’s software asset management (SAM) practices and identify areas where they may not meet ISO 19770 requirements. By conducting a gap analysis, the organization can pinpoint specific areas that need improvement, which will then inform the development of a comprehensive compliance plan. Developing a comprehensive compliance plan: While this is a critical step in the process, it comes after the gap analysis. A compliance plan is developed based on the results of the gap analysis to address the identified areas of non-compliance and ensure that the organization aligns with ISO 19770 standards

Question 20

what is ISO 15489-1?

Answer 20

ISO 15489 establishes the fundamental concepts and principles for creating, capturing, and managing records. This standard applies to records in any format, structure, or technological environment, regardless of time. So its about accessing records based on roles and permissions.

Question 21

70 What is ISO 19770?

Answer 21

IT asset management address both the processes and technology for managing software assets and related IT assets

Question 22

76 what is ISO 27000

Answer 22

provides a framework for organizations to establish, implement, maintain, and continually improve an Information Security Management System (ISMS). The series offers best practices and guidelines for managing information security risks and protecting sensitive information. Asset management is another important element of the ISO 27000 standard, as it involves identifying and classifying information assets and implementing controls to ensure their security and integrity.

Question 23

91 Is overwriting data on harddrive effective on no data remittance?

Answer 23

Generally yes.

Question 24

98 Which step comes first? Develop a data governance framework OR Identify and classify data assets

Answer 24

The first step in implementing a data ownership policy is to identify and classify data assets to determine which data is important and needs to be protected. Data classification refers to the process of categorizing data into types, forms, or any other distinct class.

Before such a framework can be established, the organization needs to identify and classify its data assets to determine what needs to be governed.

Question 25

100 What is more effective against data breaches? Firewall or security audits?

Answer 25

Firewall is not be sufficient to address all potential vulnerabilities that could lead to a data breach

Question 26

101 What is the role of a security analyst and what is not their role?

Answer 26

Investigating security breaches and incidents. not implementation of security policies and procedures. that is system admins.

Question 27

102 How do you "ensure" something works?

Answer 27

You do an analysis, not do something technical like server hardening. You do a risk analysis.

Question 28

111 Which is a more important step? A) Data Disposal B) Data Backup

Answer 28

A) Data disposal is more important because you don't want data to be leaked to the wrong person.. With data backup, its not as important.

Question 29

115 What is a data custodian?

Answer 29

A data custodian is an individual or team responsible for the technical management and stewardship of data within an organization. They are the IT professionals who ensure data is stored securely, readily accessible, and managed according to the data owner's specifications. Essentially, they are the "caretakers" of the data from a technical perspective.

Question 30

117 What is the primarly role of a security analyst? And not their primarily role?

Answer 30

Find vulernabilities. Not monitoring.

Question 31

117 What is the primary role of the security engineer? And not their primarily role

Answer 31

primary role is the implementation of security controls based on the vulnerabilities identified by security analysts. It is not designing.

Question 32

123 Does overwriting with 0 and 1 work on SSDs?

Answer 32

No it doesn't. This is because of the wear-leveling algorithms that SSDs use to prolong their lifespan, which ensure data isn't repeatedly written to the same cells.

Question 32

119 What are the 3 factors in the data retention policy?

Answer 32

The crux of a data retention policy lies within legal, security, and financial implications.. It is not technological.