CISSP Exam Cram

Product Information

Description
Table of Contents

WOC – RETAIL EBOOK EDITION EXAM CRAM

Trust the best-selling Exam Cram series from Pearson IT Certification to help you learn, prepare, and practice for exam success. They are built with the objective of providing assessment, review, and practice to help ensure you are fully prepared for your certification exam.

Master updated (ISC)² CISSP exam topics
Assess your knowledge with chapter-opening quizzes
Review key concepts with exam preparation tasks

This is the eBook edition of the CISSP Exam Cram, 5th Edition. This eBook does not include access to the companion website with practice exam that comes with the print edition.

CISSP Exam Cram, 5th Edition presents you with an organized test preparation routine through the use of proven series elements and techniques. Extensive preparation tools include topic overviews, exam alerts, CramQuizzes, chapter-ending review questions, author notes and tips, an extensive glossary, flash cards, and the handy Cram Sheet tear-out: key facts in an easy-to-review format.

CISSP Exam Cram, 5th Edition, focuses specifically on the objectives for the CISSP exam introduced by (ISC)² in May 2021. It contains new or updated coverage of topics including asset retention, secure provisioning, crypto attacks, machine learning tools, threat hunting, risk-based access control, zero trust, SAML, SOAR, securing microservices, containers, and managed services, and more.

Internationally renowned cybersecurity expert Michael Gregg shares preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.

Well regarded for its level of detail, assessment features, comprehensive design scenarios, and challenging review questions and exercises, this study guide helps you master the concepts and techniques that will enable you to succeed on the exam the first time.

The study guide helps you master all the topics on all eight domains of the (ISC)² CISSP exam, including:

Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)
Security Assessment and Testing
Security Operations
Software Development Security

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . . . . . 19

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . 24

Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . . . . . . . . 26

Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . . . . . . . . 26

Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . . . . . 29

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Data Management: Determining and Maintaining Ownership.. . . . . . . 32

Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Data Security, Protection, Sharing, and Dissemination.. . . . . . . . . . . . . 42

Classifying Information and Supporting Asset Classification.. . . . . . . . . 47

Asset Management and Governance.. . . . . . . . . . . . . . . . . . . . . . . . . 51

Determining Data Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 55

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . . . . 69

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

International Legal Systems and Laws.. . . . . . . . . . . . . . . . . . . . . . . . 72

Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . . . . . . . . . . 74

Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . . . . . . 107

Managing Risk with the Supply Chain and Third Parties.. . . . . . . . . . . 110

Identifying and Prioritizing Business Continuity

Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Developing and Implementing Security Policy.. . . . . . . . . . . . . . . . . . 123

Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Implementing Personnel Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Security Education, Training, and Awareness.. . . . . . . . . . . . . . . . . . . 134

Professional Ethics Training and Awareness.. . . . . . . . . . . . . . . . . . . . 137

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . . . . 151

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

Secure Design Guidelines and Governance Principles.. . . . . . . . . . . . . 152

Fundamental Concepts of Security Models. . . . . . . . . . . . . . . . . . . . . 158

Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

Common Formal Security Models. . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Product Security Evaluation Models.. . . . . . . . . . . . . . . . . . . . . . . . . 189

System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Vulnerabilities of Security Architectures. . . . . . . . . . . . . . . . . . . . . . . 195

Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

Public Key Infrastructure and Key Management.. . . . . . . . . . . . . . . . . 225

Integrity and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Site and Facility Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 240

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

CHAPTER 5: Communications and Network Security . . . . . . . . . . . . . 249

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Network Models and Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

Communication Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . . . . . . . 296

Securing Email Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . 296

Securing Voice and Wireless Communications.. . . . . . . . . . . . . . . . . . 298

Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . . . . . . 316

Network Access Control Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326

Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . . . . . . 331

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 337

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338

CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . . . . 341

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . . . . . . . . . 344

Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

Identification, Authentication, and Authorization. . . . . . . . . . . . . . . . . 358

Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378

Authorization and Access Control Techniques. . . . . . . . . . . . . . . . . . . 382

Centralized and Decentralized Access Control Models. . . . . . . . . . . . . 390

Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 408

Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . . . . . . . . . 410

CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . . . . . 411

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412

Security Assessments and Penetration Test Strategies. . . . . . . . . . . . . . 412

Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424

Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . 427

Network Security Threats and Attack Techniques.. . . . . . . . . . . . . . . . 431

Access Control Threats and Attack Techniques.. . . . . . . . . . . . . . . . . . 438

Social-Based Threats and Attack Techniques. . . . . . . . . . . . . . . . . . . . 443

Malicious Software Threats and Attack Techniques.. . . . . . . . . . . . . . . 444

Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452

Disaster Recovery and Business Continuity.. . . . . . . . . . . . . . . . . . . . 458

Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 464

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465

CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . . . . . . . . 467

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468

Foundational Security Operations Concepts.. . . . . . . . . . . . . . . . . . . . 468

Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477

System Resilience, Fault Tolerance, and Recovery Controls.. . . . . . . . . 486

Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 487

Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . . . . . . . . . 493

Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . 495

Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502

Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503

Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505

Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . . . . . . . . 505

Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509

Intrusion Detection and Prevention Systems. . . . . . . . . . . . . . . . . . . . 512

Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513

Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . . . . . . . . . 514

The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . 521

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 555

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558

CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . . . . . 559

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560

Integrating Security into the Development Lifecycle.. . . . . . . . . . . . . . 560

Development Methodologies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573

Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580

Database Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582

Programming Languages, Secure Coding Guidelines, and Standards.. . . 588

Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599

Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 603

Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605

Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607

Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621

Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635

Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651

Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667

9780137419555, TOC, 6/7/2021

Access details

Features

Product Information