About the Book
WOC – RETAIL EBOOK EDITION EXAM CRAM
Trust the best-selling Exam Cram series from Pearson IT Certification to help you learn, prepare, and practice for exam success. They are built with the objective of providing assessment, review, and practice to help ensure you are fully prepared for your certification exam.
- Master updated (ISC)² CISSP exam topics
- Assess your knowledge with chapter-opening quizzes
- Review key concepts with exam preparation tasks
This is the eBook edition of the CISSP Exam Cram, 5th Edition. This eBook does not include access to the companion website with practice exam that comes with the print edition.
CISSP Exam Cram, 5th Edition presents you with an organized test preparation routine through the use of proven series elements and techniques. Extensive preparation tools include topic overviews, exam alerts, CramQuizzes, chapter-ending review questions, author notes and tips, an extensive glossary, flash cards, and the handy Cram Sheet tear-out: key facts in an easy-to-review format.
CISSP Exam Cram, 5th Edition, focuses specifically on the objectives for the CISSP exam introduced by (ISC)² in May 2021. It contains new or updated coverage of topics including asset retention, secure provisioning, crypto attacks, machine learning tools, threat hunting, risk-based access control, zero trust, SAML, SOAR, securing microservices, containers, and managed services, and more.
Internationally renowned cybersecurity expert Michael Gregg shares preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.
Well regarded for its level of detail, assessment features, comprehensive design scenarios, and challenging review questions and exercises, this study guide helps you master the concepts and techniques that will enable you to succeed on the exam the first time.
The study guide helps you master all the topics on all eight domains of the (ISC)² CISSP exam, including:
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management (IAM)
- Security Assessment and Testing
- Security Operations
- Software Development Security
Table of Contents:
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . . . . . 19
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . 24
Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . . . . . . . . 26
Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . . . . . . . . 26
Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . . . . . 29
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Data Management: Determining and Maintaining Ownership.. . . . . . . 32
Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Data Security, Protection, Sharing, and Dissemination.. . . . . . . . . . . . . 42
Classifying Information and Supporting Asset Classification.. . . . . . . . . 47
Asset Management and Governance.. . . . . . . . . . . . . . . . . . . . . . . . . 51
Determining Data Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 55
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . . . . 69
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
International Legal Systems and Laws.. . . . . . . . . . . . . . . . . . . . . . . . 72
Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . . . . . . . . . . 74
Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . . . . . . 107
Managing Risk with the Supply Chain and Third Parties.. . . . . . . . . . . 110
Identifying and Prioritizing Business Continuity
Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Developing and Implementing Security Policy.. . . . . . . . . . . . . . . . . . 123
Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Implementing Personnel Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Security Education, Training, and Awareness.. . . . . . . . . . . . . . . . . . . 134
Professional Ethics Training and Awareness.. . . . . . . . . . . . . . . . . . . . 137
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . . . . 151
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Secure Design Guidelines and Governance Principles.. . . . . . . . . . . . . 152
Fundamental Concepts of Security Models. . . . . . . . . . . . . . . . . . . . . 158
Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Common Formal Security Models. . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Product Security Evaluation Models.. . . . . . . . . . . . . . . . . . . . . . . . . 189
System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Vulnerabilities of Security Architectures. . . . . . . . . . . . . . . . . . . . . . . 195
Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Public Key Infrastructure and Key Management.. . . . . . . . . . . . . . . . . 225
Integrity and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Site and Facility Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 240
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
CHAPTER 5: Communications and Network Security . . . . . . . . . . . . . 249
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Network Models and Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Communication Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . . . . . . . 296
Securing Email Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . 296
Securing Voice and Wireless Communications.. . . . . . . . . . . . . . . . . . 298
Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . . . . . . 316
Network Access Control Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . . . . . . 331
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . . . . 341
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . . . . . . . . . 344
Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Identification, Authentication, and Authorization. . . . . . . . . . . . . . . . . 358
Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
Authorization and Access Control Techniques. . . . . . . . . . . . . . . . . . . 382
Centralized and Decentralized Access Control Models. . . . . . . . . . . . . 390
Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 408
Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . . . . . . . . . 410
CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . . . . . 411
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412
Security Assessments and Penetration Test Strategies. . . . . . . . . . . . . . 412
Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424
Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . 427
Network Security Threats and Attack Techniques.. . . . . . . . . . . . . . . . 431
Access Control Threats and Attack Techniques.. . . . . . . . . . . . . . . . . . 438
Social-Based Threats and Attack Techniques. . . . . . . . . . . . . . . . . . . . 443
Malicious Software Threats and Attack Techniques.. . . . . . . . . . . . . . . 444
Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
Disaster Recovery and Business Continuity.. . . . . . . . . . . . . . . . . . . . 458
Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 464
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . . . . . . . . 467
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468
Foundational Security Operations Concepts.. . . . . . . . . . . . . . . . . . . . 468
Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
System Resilience, Fault Tolerance, and Recovery Controls.. . . . . . . . . 486
Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 487
Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . . . . . . . . . 493
Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . 495
Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502
Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503
Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . . . . . . . . 505
Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509
Intrusion Detection and Prevention Systems. . . . . . . . . . . . . . . . . . . . 512
Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . . . . . . . . . 514
The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 555
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . . . . . 559
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
Integrating Security into the Development Lifecycle.. . . . . . . . . . . . . . 560
Development Methodologies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573
Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
Database Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582
Programming Languages, Secure Coding Guidelines, and Standards.. . . 588
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 603
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607
Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621
Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651
Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
9780137419555, TOC, 6/7/2021
About the Author :
Michael Gregg has more than 20 years of experience in information security and risk management. He holds two associate's degrees, a bachelor's degree, and a master's degree. Some of the certifications he holds include CISSP, SSCP, MCSE, CTT+, A+, N+, Security+, CASP, CCNA, GSEC, CEH, CHFI, CEI, CISA, CISM, and CGEIT.
In addition to his experience performing security management, audits, and assessments, Gregg has authored or coauthored more than 25 books, including Certified Ethical Hacker Exam Prep (Que), CISSP Exam Cram 2 (Que), and Security Administrator Street Smarts (Sybex). He has testified before the U.S. Congress, his articles have been published on IT websites, and he has been sourced as an industry expert for CBS, ABC, CNN, Fox News, and the New York Times. He has created more than 15 security-related courses and training classes for various companies and universities. Although leading, building, and managing security programs is where he spends the bulk of his time, contributing to the written body of IT security knowledge is how Michael believes he can give something back to the community that has given him so much.
