CISSP Practice Questions

A Protection Profile (PP), as defined by the Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408), is an implementation-independent document. It specifies a standard set of security requirements for a particular class of products, such as firewalls or operating systems. The PP is created to address a defined set of consumer security needs and threats, serving as a reusable template. Vendors can then develop a specific product, documented in a Security Target (ST), that claims conformance to a particular PP, demonstrating that it meets this standardized set of security requirements.

1. Common Criteria for Information Technology Security Evaluation. (2017). Part 1: Introduction and general model

Version 3.1

Revision 5 (ISO/IEC 15408-1:2017). Section 5.3.1

Paragraph 128

states

"A Protection Profile (PP) is an implementation-independent set of security requirements for a category of TOEs [Targets of Evaluation]... A PP is intended to be reusable and to define requirements for a category of TOEs that meet a specific set of consumer needs."

2. National Institute of Standards and Technology (NIST). (2006). An Introduction to the Common Criteria and the NIAP Evaluation and Validation Scheme (NIST Special Publication 800-23). Section 2.2

"Protection Profiles

" states

"A Protection Profile (PP) is a document

typically created by a user or user community

which identifies security requirements for a class of security devices... relevant to that user for a particular purpose."

3. Bishop

M. (2005). Introduction to Computer Security. Pearson Education. Chapter 26

"Assurance

" Section 26.3.2

"The Common Criteria

" describes a Protection Profile as a document that "defines the security requirements and protections of a type of product." It emphasizes its role in defining a class of devices.

Diffusion is a fundamental cryptographic principle introduced by Claude Shannon. Its purpose is to obscure the statistical relationship between the plaintext and the ciphertext. This is achieved by ensuring that a single change in a plaintext character or bit results in changes to many parts of the resulting ciphertext. This property, often called the avalanche effect, makes it significantly harder for a cryptanalyst to deduce the key or plaintext by observing patterns, as the influence of each plaintext symbol is spread widely across the ciphertext. Modern block ciphers like AES use operations such as permutation and mixing to achieve strong diffusion.

1. Shannon

C. E. (1949). Communication Theory of Secrecy Systems. Bell System Technical Journal

28(4)

656-715. In Section 5

"Theoretical Secrecy

" Shannon introduces diffusion as a method where "the statistical structure of [the message]... is 'dissipated' into long range statistics." (p. 662). https://doi.org/10.1002/j.1538-7305.1949.tb00928.x

2. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. In Chapter 3

Section 3.2

"Feistel Cipher Design Principles

" diffusion is defined as the property where "the statistical structure of the plaintext is dissipated into long-range statistics of the ciphertext... by having each plaintext digit affect the value of many ciphertext digits." (p. 71).

3. National Institute of Standards and Technology (NIST). (2001). FIPS PUB 197: Advanced Encryption Standard (AES). Section 5.1.3

"The MixColumns() Transformation

" describes a key step in AES that provides diffusion within the cipher

ensuring that the bits from one column are spread to all four columns in the next state.

The methods are ranked based on their effectiveness in rendering data irrecoverable.

1. Destruction is the most effective method as it physically destroys the media (e.g., through shredding, pulverizing, or incineration), making data recovery impossible.
2. Degaussing is the next best, using a powerful magnetic field to neutralize the magnetic alignment on the media, effectively erasing the data and making it infeasible to recover even with advanced laboratory techniques.
3. Overwriting involves writing new patterns of data over the original data. While effective against simple recovery tools, sophisticated forensic methods might still be able to recover data remnants.
4. Deleting is the least effective method. It typically only removes the file's pointer from the file system's index, leaving the actual data on the disk until it is overwritten by new files. This data is easily recovered with common software.

NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization. This standard defines the hierarchy of sanitization methods.

Section 2.4, "Destruction": Describes methods like disintegration, pulverization, melting, and incineration as the ultimate form of sanitization. "Destruction of media is the most secure method of sanitization." (Page 8).

Section 2.3, "Purge": Defines Purge techniques, including Degaussing, as rendering data recovery "infeasible using state of the art laboratory techniques." (Page 8).

Section 2.2, "Clear": Defines Clear techniques, including Overwriting, as applying "logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques." (Page 7). Standard file deletion is explicitly noted as not being a sufficient method of clearing.

Garfinkel, S., & Rosen, R. (2015). A Guide to Understanding Data Remanence in Automated Information Systems. National Institute of Standards and Technology.

Section 3.1, "Data Deletion versus Media Sanitization": "Deleting a file on a typical file system is a simple, fast operation. In most cases, the operation simply removes the directory entry for the file and returns the file’s allocated blocks to the pool of free space... the file’s data blocks are not actually modified in any way and could be recovered." (Page 9). This confirms 'Deleting' as the least secure option.

Zhi, L. (2010). A new approach to information security of computer hard disk. 2010 2nd IEEE International Conference on Information Management and Engineering. https://doi.org/10.1109/ICIME.2010.5477465

Section III, "Common Methods of Hard Disk Information Security": This paper reviews common methods and implicitly ranks their security. It describes physical destruction as providing "the highest security degree," degaussing as a "reliable secure erasure method," and overwriting as a method that can be defeated by specialized equipment, placing them in the same hierarchy as the NIST standard.

This sequence represents a logical and standard methodology for establishing an effective vulnerability management program.

1. Identify assets: The foundational step is to create a comprehensive inventory of all hardware and software assets. An organization cannot protect what it does not know it has. This step defines the scope of the entire program.
2. Identify risks: Once assets are known, an initial risk assessment is performed to identify existing vulnerabilities and understand their potential impact. This establishes a baseline and helps prioritize subsequent actions.
3. Implement recurring scanning schedule: To ensure continuous discovery, an automated scanning process is implemented. This operationalizes the vulnerability identification phase, allowing the organization to detect new vulnerabilities in a timely manner.
4. Implement change management: Before remediation actions (like patching) are performed, a formal governance process for change management must be established. This ensures that all changes are reviewed, tested, and approved, minimizing operational disruption.
5. Implement patch deployment: With a governance framework in place, the technical tools and procedures for patch deployment can be implemented. This is the primary remediation step to fix the vulnerabilities discovered during scanning.

The MITRE Corporation. (2010). A Reference Architecture for Enterprise Vulnerability Management. Section 2.1, "Foundational Components," emphasizes that Asset Management is a prerequisite for the vulnerability management lifecycle, which consists of scanning, analysis, and remediation.

National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control RA-5 (Vulnerability Monitoring and Scanning) mandates scanning systems, which presupposes an inventory defined in CM-8 (System Component Inventory). Furthermore, remediation is governed by CM-3 (Configuration Change Control), reinforcing the need for change management before implementing fixes.

Enck, W., & Moyer, T. (2007). Towards a More Secure, Available, and Manageable Enterprise Infrastructure. MIT Lincoln Laboratory. The paper discusses the importance of a structured approach starting with asset discovery, followed by vulnerability assessment, and then controlled remediation, highlighting that "patch management is the primary mechanism for mitigating software vulnerabilities" (p. 2) and must be done in a controlled manner.

Al-Shaer, E., & El-Atawy, A. (2008). Network configuration in a box: A toolbox for building secure and available network configuration management systems. Proceedings of the 4th International Workshop on Security and Trust Management (STM '08). The work implicitly supports the sequence by discussing the necessity of knowing the network state (assets and configuration) before managing changes and vulnerabilities. DOI: 10.1007/978-3-540-85247-0_1

The question requires ordering the standard phases of the Business Continuity/Disaster Recovery (BC/DR) lifecycle. The scenario involving the CISO and PHI data is context, establishing the need for a formal BC/DR process. The correct approach is to follow this established lifecycle. The process begins with Risk Assessment to identify potential threats and vulnerabilities, followed by a Business Impact Analysis (BIA) to determine the operational and financial impacts of a disruption to critical functions. Based on these analyses, a Mitigation Strategy is developed. This strategy is then formalized into the BC/DR Plan. The plan must be validated through Training, Testing & Auditing. Finally, Plan Maintenance ensures the plan remains current through regular reviews and updates, creating a continuous improvement cycle.

National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems.

Section 3, "Information System Contingency Planning Process," outlines the seven-step process that closely mirrors the required sequence: (1) Develop Policy, (2) Conduct BIA, (3) Identify Preventive Controls, (4) Create Contingency Strategies, (5) Develop Plan, (6) Plan Testing, Training, and Exercises, and (7) Plan Maintenance. This standard validates the progression from analysis (BIA) to strategy, plan development, testing, and maintenance.

International Organization for Standardization (ISO) 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 8, "Operation," specifies the operational activities of a BCMS. Section 8.2.2 requires performing a business impact analysis and 8.2.3 a risk assessment. Section 8.3 requires the determination of business continuity strategy, followed by the establishment of 8.4 "business continuity plans and procedures." Clause 9.1.3 then requires that the plans are validated through exercises and testing.

Tipton, H. F., & Krause, M. (Eds.). (2007). Information Security Management Handbook, Sixth Edition. CRC Press.

Chapter 27, "Business Continuity Planning," details the BCP process. It describes the sequence as initiating the project, performing a business impact analysis, developing recovery strategies, developing the BCP, and finally, implementing, testing, and maintaining the plan. This aligns with the provided answer's sequence.

The network segment labeled LAN 4 represents a Demilitarized Zone (DMZ), which is a perimeter network located between two firewalls. A DMZ is the most secure location to deploy services for less-trusted users, such as contractors, because it isolates their traffic from the highly secured internal network (LAN 2). Placing the Wireless Access Point (WAP) in the DMZ allows contractors to access the Internet through the external firewall while the internal firewall can enforce strict rules, granting access only to specific, authorized enterprise services. This architecture upholds the principle of least privilege and protects critical assets on the internal network, such as the Database Server in LAN 2.

Stallings, W. (2017). Network Security Essentials: Applications and Standards (6th ed.). Pearson.

Reference: Chapter 9, Section 9.2, "Firewall Configurations," particularly the discussion on the "Screened Subnet Firewall System" (p. 297, Figure 9.5c). This section details the dual-firewall architecture where the DMZ is the isolated network between an external and internal firewall, which is the standard design for securely hosting systems that require external access without exposing the internal network.

Zwicky, E. D., Cooper, S., & Chapman, D. B. (2000). Building Internet Firewalls (2nd ed.). O'Reilly & Associates.

Reference: Chapter 6, "Firewall Architectures," specifically the section on "Screened Subnet" (pp. 138-142). This source describes the screened subnet (DMZ) as the canonical solution for allowing access from the Internet to selected hosts while protecting the internal network. Placing a WAP for semi-trusted users in this zone is a direct application of this principle.

Cheswick, W. R., Bellovin, S. M., & Rubin, A. D. (2003). Firewalls and Internet Security: Repelling the Wily Hacker (2nd ed.). Addison-Wesley Professional.

Reference: Chapter 4, "Firewall-Friendly Protocols and the DMZ." The chapter explains that the purpose of a DMZ is to create a "neutral zone" for machines that need to be accessible from the outside but should not be trusted on the internal network. This concept directly applies to creating a network segment for contractors.

The fundamental purpose of a penetration test is to identify vulnerabilities and demonstrate their potential impact by actively exploiting them. During the planning phase, the tester's primary interest is to understand the target environment's potential weaknesses and map them to known or custom exploits. This information is crucial for defining the scope, methodology, and rules of engagement for the test. The entire attack strategy is built around the exploits that can be leveraged against the identified or suspected vulnerabilities.

1. NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment: Section 6.4

"Vulnerability Validation

" states

"The primary objective of vulnerability validation is to obtain evidence to confirm that the vulnerability exists... This is often accomplished by trying to exercise or exploit the vulnerability." The planning phase (Section 5) is conducted with this end goal in mind.

2. (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

9th Edition: Chapter 20

"Security Assessment and Testing

" describes the phases of a penetration test. It states

"The goal of a penetration test is to simulate an attack to identify and exploit vulnerabilities." This confirms that the focus on exploits is central to the entire process

beginning with planning.

3. Penetration Testing: A Hands-On Introduction to Hacking (University of Georgia

CSCI 4260/6260 course material): The methodology taught

mirroring industry standards like the Penetration Testing Execution Standard (PTES)

emphasizes that after information gathering

the next logical step is vulnerability analysis and planning the exploitation phase. The plan revolves around "what can we exploit and how?" (See PTES Standard

"Vulnerability Analysis" and "Exploitation" phases).

A Cyclic Redundancy Check (CRC) is a type of error-detecting code used to detect accidental changes to data. While CRCs are most prominently used at the Data Link Layer (Layer 2) in the Frame Check Sequence (FCS), the fundamental principle of using a calculated value for integrity checking is also a core function of the Network and Transport layers. The IPv4 header (Network Layer 3) and the TCP/UDP headers (Transport Layer 4) both contain checksum fields for error detection. Among the choices provided, CRC is the only option that represents this type of low-level data integrity mechanism embedded within network protocol data units at the specified layers.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Page 231

Section 3.4.2

"The Internet's Transport-Layer Protocols": The text describes the UDP segment structure

stating

"The checksum is used by the receiving host to check whether errors have been introduced into the segment... The checksum is also calculated over a few of the fields in the IP header." This confirms checksum functionality at the Transport Layer (Layer 4).

Page 347

Section 4.4.1

"The IP Datagram Format": The text details the IPv4 datagram format

including the "Header checksum" field

which is used "to aid a router in detecting bit errors in a received IP datagram." This confirms checksum functionality at the Network Layer (Layer 3).

2. Postel

J. (1981

September). RFC 791: Internet Protocol. Internet Engineering Task Force (IETF).

Section 3.1

"Format": This RFC defines the IPv4 header. It specifies the "Header Checksum" field and its purpose: "A checksum on the header only. Since some header fields change (e.g.

time to live)

this is recomputed and verified at each point that the internet header is processed." This directly places an integrity-checking mechanism at the Network Layer (Layer 3).

3. Postel

J. (1981

September). RFC 793: Transmission Control Protocol. Internet Engineering Task Force (IETF).

Section 3.1

"Format": This RFC defines the TCP header

which includes a "Checksum" field. The description states

"The checksum field is the 16 bit one's complement of the one's complement sum of all 16 bit words in the header and text... This is a required field." This places an integrity-checking mechanism at the Transport Layer (Layer 4).

4. Stallings

W. (2017). Data and Computer Communications (10th ed.). Pearson Education.

Chapter 6

Section 6.2

"Error Detection": This section provides a detailed explanation of CRC

noting its power and common implementation. It states

"The CRC is one of the most common and most powerful of the error-detecting codes... The CRC is commonly used in data link control protocols

such as HDLC." While highlighting its primary use at Layer 2

the chapter's context on error detection is applicable to the checksums used in Layers 3 and 4

which serve the same purpose.

Security logs provide a chronological record of events and are the most beneficial source of evidence for an IT auditor. They offer direct, factual data on what has actually occurred on systems and networks, including user activities, system changes, and security events. By analyzing these logs, an auditor can verify whether security controls are operating effectively, whether policies are being complied with, and can identify anomalies or potential security incidents. While policies and configuration settings establish the criteria and state of a system, logs provide the evidence of operational reality, making them the most crucial element for review.

1. (ISC)² CISSP Official Study Guide

9th Edition. Chapter 13

"Security Assessment and Testing

" discusses security audits. It emphasizes that auditors review evidence to determine compliance. The text states

"Auditors often review log files

security settings

and other records to verify that policies are being followed." Logs are presented as a primary form of evidence for what has occurred.

2. NIST Special Publication 800-53A

Revision 5

Assessing Security and Privacy Controls in Information Systems and Organizations. The assessment procedures for the Audit and Accountability (AU) control family

such as AU-2 (Audit Events) and AU-6 (Audit Record Review

Analysis

and Reporting)

explicitly list "Examine" as a primary assessment method. This involves reviewing "system audit records" and "audit review

analysis

and reporting documentation" to determine if controls are implemented correctly and are effective. This positions logs (audit records) as the direct evidence to be examined.

3. NIST Special Publication 800-92

Guide to Computer Security Log Management. Section 2.2

"Log Management Operational Processes

" states that log analysis is a key component of security auditing and forensics. It highlights that logs are used to "demonstrate compliance with regulations and facilitate security auditing and problem resolution." This underscores the central role of logs as the primary data source for an audit.

The most critical activity for embedding security into an organization's culture is ensuring it is aligned with and supports the business's strategic goals. This requires active collaboration with senior management. When security is perceived as a business enabler rather than a cost center, it receives top-down support, funding, and prioritization. This leadership commitment is the foundation upon which a security-conscious culture is built, as it signals the importance of security to the entire organization. Without this strategic alignment and executive sponsorship, other security activities like policy issuance or audits remain tactical compliance exercises rather than integral cultural values.

1. Stewart

J. M.

Tittel

E.

& Chapple

M. (2021). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide (9th ed.). Wiley. In Chapter 1

"Security and Risk Management

" the text states

"Senior management creates the security program and ensures that it is properly staffed

funded

and has organizational priority. It is responsible for making the decisions that set the tone for the entire organization." (p. 6). This highlights the foundational role of senior management.

2. (ISC)². (2021). Official (ISC)² CISSP CBK Reference (6th ed.). In Domain 1

"Security and Risk Management

" the concept of security governance is detailed

emphasizing that governance must align with business strategy. The text notes

"The governance process must be driven from the top of the organization (e.g.

board of directors and senior executives) down..." (p. 4).

3. Da Veiga

A.

& Eloff

J. H. P. (2010). A framework and assessment instrument for information security culture. Computers & Security

29(2)

196-207. https://doi.org/10.1016/j.cose.2009.09.002. The research identifies "Management support and leadership" as a critical dimension for establishing and measuring an information security culture

reinforcing that leadership's role is paramount.