Important ISC2 CISSP Exam Questions

Answer: C

Explanation:

Access to a network is the ability or permission of a user or device to connect to or communicate with the network and its resources, such as servers, applications, or data. Access to a network should be controlled and restricted based on the principle of least privilege, which states that a user or device should only have the minimum level of access that is necessary to perform their legitimate tasks or functions. Therefore, the best way to determine the individual access to a network is based on the business need. The business need is the justification or rationale for the user or device to access the network and its resources, based on their role, responsibility, or function within the organization. The business need can help to define the access criteria, rules, or policies for the user or device, as well as to monitor, review, or revoke the access when needed. The business need can also help to balance the security and usability of the network and its resources, and to align the access control with the organization's objectives and needs. Risk matrix, value of the data, or data classification are not the best ways to determine the individual access to a network, as they are more related to risk assessment, data security, or data management.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 14: Access Control, page 831;CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 5: Identity and Access Management, Question 5.8, page 220.

Answer: B

Explanation:

Minimization of the need for decision making during a crisis is the main benefit that a Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide. A BCP/DRP is a set of policies, procedures, and resources that enable an organization to continue or resume its critical functions and operations in the event of a disruption or disaster. A BCP/DRP can provide several benefits, such as:

Improving the resilience and preparedness of the organization and its staff in handling a disruption or disaster

Enhancing the performance and efficiency of the organization and its systems in recovering from a disruption or disaster

Increasing the compliance and alignment of the organization and its plans with the internal or external requirements and standards

Facilitating the monitoring and improvement of the organization and its plans by identifying and addressing any gaps, issues, or risks

Minimization of the need for decision making during a crisis is the main benefit that a BCP/DRP will provide, because it can ensure that the organization and its staff have a clear and consistent guidance and direction on how to respond and act during a disruption or disaster, and avoid any confusion, uncertainty, or inconsistency that might worsen the situation or impact. A BCP/DRP can also help to reduce the stress and pressure on the organization and its staff during a crisis, and increase their confidence and competence in executing the plans.

The other options are not the benefits that a BCP/DRP will provide, but rather unrealistic or incorrect expectations or outcomes of a BCP/DRP. Guaranteed recovery of all business functions is not a benefit that a BCP/DRP will provide, because it is not possible or feasible to recover all business functions after a disruption or disaster, especially if the disruption or disaster is severe or prolonged. A BCP/DRP can only prioritize and recover the most critical or essential business functions, and may have to suspend or terminate the less critical or non-essential business functions. Insurance against litigation following a disaster is not a benefit that a BCP/DRP will provide, because it is not a guarantee or protection that the organization will not face any legal or regulatory consequences or liabilities after a disruption or disaster, especially if the disruption or disaster is caused by the organization's negligence or misconduct. A BCP/DRP can only help to mitigate or reduce the legal or regulatory risks, and may have to comply with or report to the relevant authorities or parties. Protection from loss of organization resources is not a benefit that a BCP/DRP will provide, because it is not a prevention or avoidance of any damage or destruction of the organization's assets or resources during a disruption or disaster, especially if the disruption or disaster is physical or natural. A BCP/DRP can only help to restore or replace the lost or damaged assets or resources, and may have to incur some costs or losses.

Answer: A

Explanation:

The most probable attack vector used in the security breach is buffer overflow. Buffer overflow is a condition that occurs when a program attempts to write more data to a fixed-length memory space, or buffer, than it can hold. Buffer overflow can corrupt the adjacent memory locations, which may contain important data or instructions for the program. Buffer overflow can be exploited by attackers to inject malicious code into the buffer or another location, and redirect the program flow to execute the malicious code. Buffer overflow can compromise the security, functionality, or performance of the system, or even render it unusable or inaccessible. Buffer overflow can be caused by weaknesses in the software code, design, or configuration, which can be prevented by applying proper software change control and security patch management practices. Reference: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Software Development Security, page 427; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 8: Software Development Security, page 567]

Answer: A

Explanation:

The adoption of an enterprise-wide business continuity program requires good communication throughout the organization. A business continuity program is a set of policies, procedures, and plans that aim to ensure the continuity of critical business functions and processes in the event of a disruption or disaster. Good communication throughout the organization is essential for the adoption of a business continuity program, because it helps to raise awareness, gain support, coordinate activities, and share information among the stakeholders involved in the business continuity process. Formation of a disaster recovery project team, a completed business impact analysis, and well-documented information asset classification are not the requirements for the adoption of an enterprise-wide business continuity program, although they are important components of the business continuity process. A disaster recovery project team is a group of people who are responsible for planning, implementing, and testing the disaster recovery strategies and procedures for a specific business unit or function. A business impact analysis is a process of identifying and evaluating the potential impacts of a disruption or disaster on the business objectives, functions, and processes. An information asset classification is a process of assigning labels or categories to the information assets based on their value, sensitivity, and criticality to the organization. Reference: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, page 747. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 7: Security Operations, page 507.

Answer: A

Explanation:

Encrypted e-mail messages are e-mail messages that are protected by encryption, which is a method of transforming the plaintext into ciphertext, using a secret key and an algorithm. Encryption ensures the confidentiality, integrity, and authenticity of the e-mail messages, as only the authorized parties can decrypt and read the messages, and any modification or forgery of the messages can be detected. The primary security issue associated with encrypted e-mail messages is key distribution, which is the process of securely exchanging the secret keys between the sender and the receiver of the e-mail messages. Key distribution is challenging, as it requires a secure and reliable channel, a trusted third party, or a public key infrastructure (PKI) to ensure that the keys are not compromised, intercepted, or tampered with. If the keys are not distributed properly, the encrypted e-mail messages may not be decrypted or verified by the intended parties, or may be decrypted or forged by the unauthorized parties. Storing attachments in centralized repositories is not a security issue associated with encrypted e-mail messages, as it is a method of reducing the size and the bandwidth of the e-mail messages, by storing the attachments in a cloud service or a file server, and sending only the links to the attachments in the e-mail messages. Scanning for viruses and other malware is not a security issue associated with encrypted e-mail messages, as it is a method of detecting and removing the malicious code that may be embedded in the e-mail messages or the attachments. Greater costs associated for backups and restores is not a security issue associated with encrypted e-mail messages, as it is a method of preserving and recovering the e-mail messages or the attachments in case of a data loss or a disaster.Reference:Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 3: Security Engineering, page 105.CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4: Cryptography and Symmetric Key Algorithms, page 204.