Authentic CISSP Dumps – Free PDF Questions to Pass [Q677-Q701]

The correct answer is DITSCAP, the Defense Information Technology Security
Certification and Accreditation Process.
* Answer NIACAP refers to the US government’s non-defense Certification and
Accreditation (C&A) process the National Information Assurance Certification and
Accreditation Process.
* CIAP refers to the Commercial Information Security Analysis Process that is currently under development for application to commercial systems.
* Answer DIACAP is a distracter.

The correct answer is “Aweakness in a system that could be exploited”. Answer
“Acompany resource that could be lost due to an incident” describes an asset, answer “The minimization of loss associated with an incide” describes risk management, and answer “Apotential incident that could cause harm”describes a threat.

Role-based access control assigns identical privileges to groups of
users. This approach simplifies the management of access rights,
particularly when members of the group change. Thus, access rights are
assigned to a role, not to an individual. Individuals are entered as
members of specific groups and are assigned the access privileges of that group.
In answer Discretionary, the access rights to an object are assigned by the owner at the owner’s discretion. For large numbers of people whose duties and participation may change frequently, this type of access control can become unwieldy. Mandatory access control, answer c, uses
security labels or classifications assigned to data items and clearances assigned to users. A user has access rights to data items with a classification equal to or less than the user’s clearance. Another restriction is that the user has to have a need-to-know the information; this requirement is identical to the principle of least privilege.
Answer ‘rule-based access control’ assigns access rights based on stated rules. An example of a rule is Access to trade-secret data is restricted to corporate officers, the data owner and the legal department.

The Secure Socket Layer (SSL) Protocol is primarily used to provide confidentiality to the information sent across clients and servers.
For your exam you should know the information below:
The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the security of a message transmitted over a public network such as the Internet.
SSL has recently been succeeded by Transport Layer Security (TLS), which is based on
SSL. SSL uses a program layer located between the Internet’s Hypertext Transfer Protocol
(HTTP) and Transport Control Protocol (TCP) layers.
SSL is included as part of both the Microsoft and Netscape browsers and most Web server products.
Developed by Netscape, SSL also gained the support of Microsoft and other Internet client/server developers as well and became the de facto standard until evolving into
Transport Layer Security. The “sockets” part of the term refers to the sockets method of passing data back and forth between a client and a server program in a network or between program layers in the same computer. SSL uses the public-and-private key encryption system from RSA, which also includes the use of a digital certificate. Later on
SSL uses a Session Key along a Symmetric Cipher for the bulk of the data.
TLS and SSL are an integral part of most Web browsers (clients) and Web servers. If a
Web site is on a server that supports SSL, SSL can be enabled and specific Web pages can be identified as requiring SSL access. Any Web server can be enabled by using
Netscape’s SSLRef program library which can be downloaded for noncommercial use or licensed for commercial use.
TLS and SSL are not interoperable. However, a message sent with TLS can be handled by a client that handles SSL but not TLS.
The SSL handshake
A HTTP-based SSL connection is always initiated by the client using a URL starting with
https:// instead of with http://. At the beginning of an SSL session, an SSL handshake is performed. This handshake produces the cryptographic parameters of the session. A simplified overview of how the SSL handshake is processed is shown in the diagram below.
SSL Handshake
Image Reference – http://publib.boulder.ibm.com/tividd/td/ITAME/SC32-1363-
00/en_US/HTML/handshak.gif
The client sends a client “hello” message that lists the cryptographic capabilities of the client (sorted in client preference order), such as the version of SSL, the cipher suites supported by the client, and the data compression methods supported by the client. The message also contains a 28-byte random number.
The server responds with a server “hello” message that contains the cryptographic method
(cipher suite) and the data compression method selected by the server, the session ID, and another random number.
Note:
The client and the server must support at least one common cipher suite, or else the handshake fails. The server generally chooses the strongest common cipher suite.
The server sends its digital certificate. (In this example, the server uses X.509 V3 digital certificates with SSL.)
If the server uses SSL V3, and if the server application (for example, the Web server) requires a digital certificate for client authentication, the server sends a “digital certificate request” message. In the “digital certificate request” message, the server sends a list of the types of digital certificates supported and the distinguished names of acceptable certificate authorities.
The server sends a server “hello done” message and waits for a client response. Upon receipt of the server “hello done” message, the client (the Web browser) verifies the validity of the server’s digital certificate and checks that the server’s “hello” parameters are acceptable.
If the server requested a client digital certificate, the client sends a digital certificate, or if no suitable digital certificate is available, the client sends a “no digital certificate” alert. This alert is only a warning, but the server application can fail the session if client authentication is mandatory.
The client sends a “client key exchange” message. This message contains the pre-master secret, a 46-byte random number used in the generation of the symmetric encryption keys and the message authentication code (MAC) keys, encrypted with the public key of the server.
If the client sent a digital certificate to the server, the client sends a “digital certificate verify” message signed with the client’s private key. By verifying the signature of this message, the server can explicitly verify the ownership of the client digital certificate.
Note:
An additional process to verify the server digital certificate is not necessary. If the server does not have the private key that belongs to the digital certificate, it cannot decrypt the pre-master secret and create the correct keys for the symmetric encryption algorithm, and the handshake fails.
The client uses a series of cryptographic operations to convert the pre-master secret into a master secret, from which all key material required for encryption and message authentication is derived. Then the client sends a “change cipher spec” message to make the server switch to the newly negotiated cipher suite. The next message sent by the client
(the “finished” message) is the first message encrypted with this cipher method and keys.
The server responds with a “change cipher spec” and a “finished” message of its own.
The SSL handshake ends, and encrypted application data can be sent.
The following answers are incorrect:
FTP – File Transfer Protocol (FTP) is a standard Internet protocol for transmitting files between computers on the Internet. Like the Hypertext Transfer Protocol (HTTP), which transfers displayable Web pages and related files, and the Simple Mail Transfer Protocol
(SMTP), which transfers e-mail, FTP is an application protocol that uses the Internet’s
TCP/IP protocols. FTP is commonly used to transfer Web page files from their creator to the computer that acts as their server for everyone on the Internet. It’s also commonly used to download programs and other files to your computer from other servers.
SSH – Secure Shell (SSH) is a cryptographic network protocol for secure data communication, remote command-line login, remote command execution, and other secure network services between two networked computers. It connects, via a secure channel over an insecure network, a server and a client running SSH server and SSH client programs, respectively.
S/MIME – S/MIME (Secure Multi-Purpose Internet Mail Extensions) is a secure method of sending e-mail that uses the Rivest-Shamir-Adleman encryption system. S/MIME is included in the latest versions of the Web browsers from Microsoft and Netscape and has also been endorsed by other vendors that make messaging products. RSA has proposed
S/MIME as a standard to the Internet Engineering Task Force (IETF).
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 352
Official ISC2 guide to CISSP CBK 3rd Edition Page number 256
http://publib.boulder.ibm.com/tividd/td/ITAME/SC32-1363-
00/en_US/HTML/ss7aumst18.htm

The data link layer, or Layer 2, of the OSI model is responsible for adding a header
and a trailer to a packet to prepare the packet for the local area network or wide area network
technology binary format for proper line transmission.
Layer 2 is divided into two functional sublayers.
The upper sublayer is the Logical Link Control (LLC) and is defined in the IEEE 802.2
specification. It communicates with the network layer, which is immediately above the data link
layer.
Below the LLC is the Media Access Control (MAC) sublayer, which specifies the interface with the
protocol requirements of the physical layer.
Thus, the specification for this layer depends on the technology of the physical layer.
The IEEE MAC specification for Ethernet is 802.3, Token Ring is 802.5, wireless LAN is 802.11,
and so on. When you see a reference to an IEEE standard, such as 802.11 or 802.16, it refers to
the protocol working at the MAC sublayer of the data link layer of the protocol stack.
The following answers are incorrect:
LCL and MAC; IEEE 802.2 and 802.3 is incorrect because LCL is a distracter. The correct
acronym for the upper sublayer of the data link layer is LLC. It stands for the Logical Link Control.
By providing multiplexing and flow control mechanisms, the LLC enables the coexistence of
network protocols within a multipoint network and their transportation over the same network
media.
LCL and MAC; IEEE 802.1 and 802.3 is incorrect because LCL is a distracter. The sublayers of
the data link layer are the Logical Link Control (LLC) and the Media Access Control (MAC).
Furthermore, the LLC is defined in the IEEE 802.2 specification, not 802.1. The IEEE 802.1
specifications are concerned with protocol layers above the MAC and LLC layers. It addresses
LAN/MAN architecture, network management, internetworking between LANs and WANs, and link
security, etc.
Network and MAC; IEEE 802.1 and 802.3 is incorrect because network is not a sublayer of the
data link layer. The sublayers of the data link layer are the Logical Link Control (LLC) and the
Media Access Control (MAC). The LLC sits between the network layer (the layer immediately
above the data link layer) and the MAC sublayer. Also, the LLC is defined in the IEEE 802.2
specification,not IEEE 802.1. As just explained, 802.1 standards address areas of LAN/MAN
architecture, network management, internetworking between LANs and WANs, and link
security.The IEEE 802.1 group’s four active task groups are Internetworking, Security,
Audio/Video Bridging, and Data Center Bridging.
The following reference(s) were/was used to create this question:
http://en.wikipedia.org/wiki/OSI_model

Explanation/Reference:
Explanation:
PPTP is an encapsulation protocol based on PPP that works at OSI layer 2 (Data Link) and that enables a single point-to-point connection, usually between a client and a server. While PPTP depends on IP to establish its connection. As currently implemented, PPTP encapsulates PPP packets using a modified version of the generic routing encapsulation (GRE) protocol, which gives PPTP to the flexibility of handling protocols other than IP, such as IPX and NETBEUI over IP networks. PPTP does have some limitations: It does not provide strong encryption for protecting data, nor does it support any token-based methods for authenticating users. L2TP is derived from L2F and PPTP, not the opposite.
Incorrect Answers:
A: PPTP relies on the Point-to-Point Protocol (PPP) being tunneled to implement security functionality.
B: PPTP uses PPP for encryption. The PPP protocol has only the capability to encrypt data with 128-bit so it ensures low security.
C: The PPTP specification does not include authentication. In the Microsoft implementation, the tunneled PPP traffic can be authenticated with PAP, CHAP, MS-CHAP v1/v2 , but not with any token-based authentication scheme.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 708

Administrative/regulatory law deals with regulatory standards that regulate performance and conduct. Government agencies create these standards, which are usually applied to companies and individuals within those companies.
The rest of the answers are incorrect because they are distractors.

A Static password is one that remains the same until its changed. Its like the password that we use in the operating systems, you set it, and then you always use the same password to logon to the system for the time of the session.
This password will give us access to the system and will be the vehicle to create our access token in a successful way to get our privileges. A one-time password is only valid for one use, dynamic ones change every certain condition is met, and two-time passwords can only be used two times. We can provide certain times of access with this kind of passwords.

Higher or equal to access class. The reason is the term dominates refers to a subject being authorized to perform an operation if the access class of the subject is higher or dominates the access class of the object requested. This is the best answer for the term “dominates” in access control. If a subject wishes to access an object, his security clearance must be equal or higher than the object he’s accessing.
The following answers are incorrect:
Rights are superceded is incorrect as it is not actually a valid condition.
Valid need-to-know with read privileges is too specific to be dominates, and is usually what a
user’s label indicates.
A higher clearance level than others. Although having a higher clearance level might be important
to obtain access to the higher levels of data, it is not what the definition of “dominates” refers to in
access control.
The following reference(s) were/was used to create this question:
Shon Harris latest “All in One CISSP Exam Prep” page 280.

Explanation/Reference:
Explanation:
Application control limits what users can see or do within the application. For example, if a user does not have the necessary access privilege to perform some functions, the functions can be hidden from the screen or the screen itself can be hidden so the user cannot select it within the application. In a similar way, only the records a user has access to can be displayed.
Application control is transparent to the user; the user does not know that a particular screen, function or data records have been hidden.
Application control can be implemented to record the activities a user performs within the application for auditing purposes.
Incorrect Answers:
A: It is true that application control limits end users use of applications in such a way that only particular screens are visible.
B: It is true that only specific records can be requested through the application controls.
C: It is true that particular usage of the application can be recorded for audit purposes by Application Control.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1084-1085

The Data/Information Owner is ultimately responsible for the protection of the data. It is the
Data/Information Owner that decides upon the classifications of that data they are responsible for.
The data owner decides upon the classification of the data he is responsible for and alters that
classification if the business need arises.
The following answers are incorrect:
Security Administrator. Is incorrect because this individual is responsible for ensuring that the
access right granted are correct and support the polices and directives that the Data/Information
Owner defines.
User. Is Incorrect because the user uses/access the data according to how the Data/Information
Owner defined their access.
Auditor. Is incorrect because the Auditor is responsible for ensuring that the access levels are
appropriate. The Auditor would verify that the Owner classified the data properly.
References:
CISSP All In One Third Edition, Shon Harris, Page 121

Under the principle of separation of duties, an operator should not be performing data entry. This should be left to data entry personnel.
System operators represent a class of users typically found in data center environments where mainframe systems are used. They provide day-to-day operations of the mainframe environment, ensuring that scheduled jobs are running effectively and troubleshooting problems that may arise. They also act as the arms and legs of the mainframe environment, load and unloading tape and results of job print runs. Operators have elevated privileges, but less than those of system administrators. If misused, these privileges may be used to circumvent the system’s security policy. As such, use of these privileges should be monitored through audit logs.
Some of the privileges and responsibilities assigned to operators include:
Implementing the initial program load: This is used to start the operating system. The boot process or initial program load of a system is a critical time for ensuring system security. Interruptions to this process may reduce the integrity of the system or cause the system to crash, precluding its availability.
Monitoring execution of the system: Operators respond to various events, to include errors, interruptions, and job completion messages.
Volume mounting: This allows the desired application access to the system and its data.
Controlling job flow: Operators can initiate, pause, or terminate programs. This may allow an operator to affect the scheduling of jobs. Controlling job flow involves the manipulation of configuration information needed by the system. Operators with the ability to control a job or application can cause output to be altered or diverted, which can threaten the confidentiality.
Bypass label processing: This allows the operator to bypass security label information to run foreign tapes (foreign tapes are those from a different data center that would not be using the same label format that the system could run). This privilege should be strictly controlled to prevent unauthorized access.
Renaming and relabeling resources: This is sometimes necessary in the mainframe environment to allow programs to properly execute. Use of this privilege should be monitored, as it can allow the unauthorized viewing of sensitive information.
Reassignment of ports and lines: Operators are allowed to reassign ports or lines. If misused, reassignment can cause program errors, such as sending sensitive output to an unsecured location. Furthermore, an incidental port may be opened, subjecting the system to an attack through the creation of a new entry point into the system.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 19367-19395). Auerbach Publications. Kindle Edition.

Honey pots are decoy systems that are designed to lure a potential attacker away from
critical systems. Honey pots are designed to:
Divert an attacker from accessing critical systems,
Collect information about the attacker’s activity, and encourage the attacker to stay
on the system long enough for administrators to respond.

Section: Software Development Security

Session services located in the Transport Layer both segment and reassemble the data from upper-layer applications and unite it onto the same data stream, which provides end-toend data transport services and establishes a logical connection between the sending host and destination host on a network. Pg. 82 Krutz: The CISSP Prep Guide.