CISSP Exam Cram, Fifth Edition, is the perfect study guide to help you pass the new eight domain version of the CISSP exam. It provides coverage and practice questions for every exam topic, including substantial new coverage of encryption, cloud security, information lifecycles, security management/governance, and more. The book contains an extensive set of preparation tools, such as quizzes, Exam Alerts, and two practice exams, while the companion websites test engine provides real-time practice and feedback.
Covers the critical information youll need to pass the CISSP exam!
- Enforce foundational security operations concepts
- Apply reliable authentication, authorization, and accountability
- Design security architectures that can be verified, certified, and accredited
- Understand the newest attacks and countermeasures
- Use encryption to safeguard data, systems, and networks
- Systematically plan and test business continuity/disaster recovery programs
- Protect todays cloud, web, and database applications
- Address global compliance issues, from privacy to computer forensics
- Develop software that is secure throughout its entire lifecycle
- Implement effective security governance and risk management
- Use best-practice policies, procedures, guidelines, and controls
- Ensure strong operational controls, from background checks to security audits
Thoroughly updated to prepare candidates for the new exam, this book includes:
- Chapters that map directly to the exam objectives
- Comprehensive foundational learning on all topics covered on the exam
- An extensive collection of practice questions (including two full exams)
- A state-of-the-art practice test engine that provides real-time practice and feedback
- Notes, tips, sidebars, cautions, test-taking strategies, and time-saving tips that make studying as effective and time-efficient as possible
- The Cram Sheet tear-out card including tips, acronyms, and memory joggers not available anywhere else - perfect for last-minute study
Topics covered in this book include physical, network, applications, systems, and operations security; access control; cryptography; securing architecture and modeling; business continuity and disaster recovery; security forensics; security management practices; and much more.
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 1
CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . .
. . . 19
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 20
Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 20
Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 21
Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 22
Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . .
. . . . . . . 24
Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . .
. . . . . . 26
Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . .
. . . . . . 26
Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 26
Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 27
Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 27
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 28
CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . .
. . . 29
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 30
Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 30
Data Management: Determining and Maintaining Ownership.. . . . . . .
32
Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 38
Data Security, Protection, Sharing, and Dissemination.. . . . . . . .
. . . . . 42
Classifying Information and Supporting Asset Classification.. . . . .
. . . . 47
Asset Management and Governance.. . . . . . . . . . . . . . . . . . .
. . . . . . 51
Determining Data Security Controls.. . . . . . . . . . . . . . . . . .
. . . . . . . 55
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 63
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 66
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 67
CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . .
. . 69
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 70
Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 70
U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 71
International Legal Systems and Laws.. . . . . . . . . . . . . . . . .
. . . . . . . 72
Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . .
. . . . . . . . 74
Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 86
Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 104
Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . .
. . . . 107
Managing Risk with the Supply Chain and Third Parties.. . . . . . . .
. . . 110
Identifying and Prioritizing Business Continuity
Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 113
Developing and Implementing Security Policy.. . . . . . . . . . . . .
. . . . . 123
Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 127
Implementing Personnel Security.. . . . . . . . . . . . . . . . . . .
. . . . . . . . 130
Security Education, Training, and Awareness.. . . . . . . . . . . . .
. . . . . . 134
Professional Ethics Training and Awareness.. . . . . . . . . . . . . .
. . . . . . 137
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 144
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 148
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 150
CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . .
. . 151
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 152
Secure Design Guidelines and Governance Principles.. . . . . . . . . .
. . . 152
Fundamental Concepts of Security Models. . . . . . . . . . . . . . . .
. . . . . 158
Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 170
Common Formal Security Models. . . . . . . . . . . . . . . . . . . . .
. . . . . . 179
Product Security Evaluation Models.. . . . . . . . . . . . . . . . . .
. . . . . . . 189
System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 194
Vulnerabilities of Security Architectures. . . . . . . . . . . . . . .
. . . . . . . . 195
Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 203
Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 206
Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 207
Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 208
Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 218
Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 224
Public Key Infrastructure and Key Management.. . . . . . . . . . . . .
. . . . 225
Integrity and Authentication. . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 230
Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 237
Site and Facility Security Controls.. . . . . . . . . . . . . . . . .
. . . . . . . . . 240
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 242
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 246
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 248
CHAPTER 5: Communications and Network Security . . . . . . . . . . . . .
249
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 250
Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 250
Network Models and Standards.. . . . . . . . . . . . . . . . . . . . .
. . . . . . . 250
TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 258
LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . 271
Communication Standards.. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 280
Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 281
Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . 287
WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . 289
Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 294
Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . .
. . . . . 296
Securing Email Communications.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 296
Securing Voice and Wireless Communications.. . . . . . . . . . . . . .
. . . . 298
Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . .
. . . . 316
Network Access Control Devices.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 321
Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 326
Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . .
. . . . 331
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 333
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 337
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 338
CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . .
. . 341
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 342
Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . .
. . . . . . . 344
Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 355
Identification, Authentication, and Authorization. . . . . . . . . . .
. . . . . . 358
Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 378
Authorization and Access Control Techniques. . . . . . . . . . . . . .
. . . . . 382
Centralized and Decentralized Access Control Models. . . . . . . . . .
. . . 390
Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 394
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 404
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 408
Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . .
. . . . . . . 410
CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . .
. . . 411
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 412
Security Assessments and Penetration Test Strategies. . . . . . . . .
. . . . . 412
Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 424
Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . .
. . . . . . . . 427
Network Security Threats and Attack Techniques.. . . . . . . . . . . .
. . . . 431
Access Control Threats and Attack Techniques.. . . . . . . . . . . . .
. . . . . 438
Social-Based Threats and Attack Techniques. . . . . . . . . . . . . .
. . . . . . 443
Malicious Software Threats and Attack Techniques.. . . . . . . . . . .
. . . . 444
Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 452
Disaster Recovery and Business Continuity.. . . . . . . . . . . . . .
. . . . . . 458
Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 459
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 461
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 464
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 465
CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . .
. . . . . . 467
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 468
Foundational Security Operations Concepts.. . . . . . . . . . . . . .
. . . . . . 468
Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 472
Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 477
System Resilience, Fault Tolerance, and Recovery Controls.. . . . . .
. . . 486
Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . .
. . . . . . . 487
Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . .
. . . . . . . 493
Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . .
. . . . . . . 495
Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 502
Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 503
Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 505
Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . .
. . . . . . 505
Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 509
Intrusion Detection and Prevention Systems. . . . . . . . . . . . . .
. . . . . . 512
Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 513
Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . .
. . . . . . . 514
The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . .
. . . . . . . . 521
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 549
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 555
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 558
CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . .
. . . 559
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 560
Integrating Security into the Development Lifecycle.. . . . . . . . .
. . . . . 560
Development Methodologies.. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 573
Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 580
Database Management. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 582
Programming Languages, Secure Coding Guidelines, and Standards.. . .
588
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . 599
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . .
. . . . . . . 603
Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . 605
Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . 607
Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . 621
Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 635
Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . 651
Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . 667
9780137419555, TOC, 6/7/2021
Michael Gregg has more than 20 years of experience in information security and risk management. He holds two associate's degrees, a bachelor's degree, and a master's degree. Some of the certifications he holds include CISSP, SSCP, MCSE, CTT+, A+, N+, Security+, CASP, CCNA, GSEC, CEH, CHFI, CEI, CISA, CISM, and CGEIT.
In addition to his experience performing security management, audits, and assessments, Gregg has authored or coauthored more than 25 books, including Certified Ethical Hacker Exam Prep (Que), CISSP Exam Cram 2 (Que), and Security Administrator Street Smarts (Sybex). He has testified before the U.S. Congress, his articles have been published on IT websites, and he has been sourced as an industry expert for CBS, ABC, CNN, Fox News, and the New York Times. He has created more than 15 security-related courses and training classes for various companies and universities. Although leading, building, and managing security programs is where he spends the bulk of his time, contributing to the written body of IT security knowledge is how Michael believes he can give something back to the community that has given him so much.
Biežāk uzdotie jautājumi par e-grāmatām