CISSP Exam Cram

WOC – RETAIL EBOOK EDITION EXAM CRAM Trust the best-selling Exam Cram series from Pearson IT Certification to help you learn, prepare, and practice for exam success. They are built with the objective of providing assessment, review, and practice to help ensure you are fully prepared for your certification exam. Master updated (ISC)² CISSP exam topics Assess your knowledge with chapter-opening quizzes Review key concepts with exam preparation tasks This is the eBook edition of the CISSP Exam Cram, 5th Edition. This eBook does not include access to the companion website with practice exam that comes with the print edition. CISSP Exam Cram, 5th Edition presents you with an organized test preparation routine through the use of proven series elements and techniques. Extensive preparation tools include topic overviews, exam alerts, CramQuizzes, chapter-ending review questions, author notes and tips, an extensive glossary, flash cards, and the handy Cram Sheet tear-out: key facts in an easy-to-review format. CISSP Exam Cram, 5th Edition, focuses specifically on the objectives for the CISSP exam introduced by (ISC)² in May 2021. It contains new or updated coverage of topics including asset retention, secure provisioning, crypto attacks, machine learning tools, threat hunting, risk-based access control, zero trust, SAML, SOAR, securing microservices, containers, and managed services, and more. Internationally renowned cybersecurity expert Michael Gregg shares preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics. Well regarded for its level of detail, assessment features, comprehensive design scenarios, and challenging review questions and exercises, this study guide helps you master the concepts and techniques that will enable you to succeed on the exam the first time. The study guide helps you master all the topics on all eight domains of the (ISC)² CISSP exam, including: Security and Risk Management Asset Security Security Architecture and Engineering Communication and Network Security Identity and Access Management (IAM) Security Assessment and Testing Security Operations Software Development Security

Table of Contents:
   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . . . . . 19    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20    Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20    Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21    Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22    Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . 24    Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . . . . . . . . 26    Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . . . . . . . . 26    Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26    Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27    Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . . . . . 29    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30    Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30    Data Management: Determining and Maintaining Ownership.. . . . . . . 32    Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38    Data Security, Protection, Sharing, and Dissemination.. . . . . . . . . . . . . 42    Classifying Information and Supporting Asset Classification.. . . . . . . . . 47    Asset Management and Governance.. . . . . . . . . . . . . . . . . . . . . . . . . 51    Determining Data Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 55    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 66    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . . . . 69    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70    Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70    U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71    International Legal Systems and Laws.. . . . . . . . . . . . . . . . . . . . . . . . 72    Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . . . . . . . . . . 74    Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86    Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104    Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . . . . . . 107    Managing Risk with the Supply Chain and Third Parties.. . . . . . . . . . . 110    Identifying and Prioritizing Business Continuity    Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113    Developing and Implementing Security Policy.. . . . . . . . . . . . . . . . . . 123    Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127    Implementing Personnel Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130    Security Education, Training, and Awareness.. . . . . . . . . . . . . . . . . . . 134    Professional Ethics Training and Awareness.. . . . . . . . . . . . . . . . . . . . 137    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 148    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . . . . 151    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152    Secure Design Guidelines and Governance Principles.. . . . . . . . . . . . . 152    Fundamental Concepts of Security Models. . . . . . . . . . . . . . . . . . . . . 158    Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170    Common Formal Security Models. . . . . . . . . . . . . . . . . . . . . . . . . . . 179    Product Security Evaluation Models.. . . . . . . . . . . . . . . . . . . . . . . . . 189    System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194    Vulnerabilities of Security Architectures. . . . . . . . . . . . . . . . . . . . . . . 195    Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203    Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206    Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207    Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208    Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218    Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224    Public Key Infrastructure and Key Management.. . . . . . . . . . . . . . . . . 225    Integrity and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230    Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237    Site and Facility Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 240    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 246    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 CHAPTER 5: Communications and Network Security . . . . . . . . . . . . . 249    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250    Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250    Network Models and Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 250    TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258    LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271    Communication Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280    Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281    Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287    WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289    Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294    Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . . . . . . . 296    Securing Email Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . 296    Securing Voice and Wireless Communications.. . . . . . . . . . . . . . . . . . 298    Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . . . . . . 316    Network Access Control Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321    Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326    Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . . . . . . 331    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 337    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . . . . 341    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342    Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . . . . . . . . . 344    Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355    Identification, Authentication, and Authorization. . . . . . . . . . . . . . . . . 358    Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378    Authorization and Access Control Techniques. . . . . . . . . . . . . . . . . . . 382    Centralized and Decentralized Access Control Models. . . . . . . . . . . . . 390    Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 408    Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . . . . . . . . . 410 CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . . . . . 411    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412    Security Assessments and Penetration Test Strategies. . . . . . . . . . . . . . 412    Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424    Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . 427    Network Security Threats and Attack Techniques.. . . . . . . . . . . . . . . . 431    Access Control Threats and Attack Techniques.. . . . . . . . . . . . . . . . . . 438    Social-Based Threats and Attack Techniques. . . . . . . . . . . . . . . . . . . . 443    Malicious Software Threats and Attack Techniques.. . . . . . . . . . . . . . . 444    Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452    Disaster Recovery and Business Continuity.. . . . . . . . . . . . . . . . . . . . 458    Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 464    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . . . . . . . . 467    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468    Foundational Security Operations Concepts.. . . . . . . . . . . . . . . . . . . . 468    Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472    Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477    System Resilience, Fault Tolerance, and Recovery Controls.. . . . . . . . . 486    Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 487    Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . . . . . . . . . 493    Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . 495    Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502    Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503    Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505    Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . . . . . . . . 505    Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509    Intrusion Detection and Prevention Systems. . . . . . . . . . . . . . . . . . . . 512    Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513    Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . . . . . . . . . 514    The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . 521    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 555    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558 CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . . . . . 559    Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560    Integrating Security into the Development Lifecycle.. . . . . . . . . . . . . . 560    Development Methodologies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573    Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580    Database Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582    Programming Languages, Secure Coding Guidelines, and Standards.. . . 588    Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599    Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 603    Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605 Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621 Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651 Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667 9780137419555, TOC, 6/7/2021

About the Author :
Michael Gregg has more than 20 years of experience in information security and risk management. He holds two associate's degrees, a bachelor's degree, and a master's degree. Some of the certifications he holds include CISSP, SSCP, MCSE, CTT+, A+, N+, Security+, CASP, CCNA, GSEC, CEH, CHFI, CEI, CISA, CISM, and CGEIT. In addition to his experience performing security management, audits, and assessments, Gregg has authored or coauthored more than 25 books, including Certified Ethical Hacker Exam Prep (Que), CISSP Exam Cram 2 (Que), and Security Administrator Street Smarts (Sybex). He has testified before the U.S. Congress, his articles have been published on IT websites, and he has been sourced as an industry expert for CBS, ABC, CNN, Fox News, and the New York Times. He has created more than 15 security-related courses and training classes for various companies and universities. Although leading, building, and managing security programs is where he spends the bulk of his time, contributing to the written body of IT security knowledge is how Michael believes he can give something back to the community that has given him so much.