CertBus 2020 Real ISC CISSP ISC Certification Exam VCE and PDF Dumps for Free Download!

☆ CISSP ISC Certification Exam PDF and VCE Dumps : 970QAs Instant Download: https://www.certgod.com/CISSP.html [100% CISSP Exam Pass Guaranteed or Money Refund!!]
☆ Free view online pdf on CertBus free test CISSP PDF: https://www.certgod.com/online-pdf/CISSP.pdf
☆ CertBus 2020 Real CISSP ISC Certification exam Question PDF Free Download from Google Drive Share: https://drive.google.com/file/d/0B_3QX8HGRR1mVXBDYy0tYmNFSHM/view?usp=sharing

Following CISSP 970QAs are all new published by ISC Official Exam Center

100% candidates have passed the ISC Certification Hotest CISSP exam questions exam by the help of CertBus pass guaranteed ISC Certification Newest CISSP free download preparation materials. The CertBus ISC PDF and VCEs are the latest and cover every knowledge points of ISC Certification Aug 12,2020 Hotest CISSP QAs Certified Information Systems Security Professional certifications. You can try the Q and As for an undeniable success in Hotest CISSP practice exam.

CertBus – your reliable partner and professional CISSP certification exam material provider. CertBus- reliable CISSP certifications expert on CISSP exam study guide providing. CertBus CISSP exam certification prep online course training. latest CertBus CISSP exam dumps pdf and vce free download. CertBus 100% real CISSP certification exam questions and answers. easily pass with a high score.

We CertBus has our own expert team. They selected and published the latest CISSP preparation materials from ISC Official Exam-Center: https://www.certgod.com/CISSP.html

Question 1:

What can be defined as a table of subjects and objects indicating what actions individual subjects can take upon individual objects?

A. A capacity table

B. An access control list

C. An access control matrix

D. A capability table

Correct Answer: C

Explanation: The matrix lists the users, groups and roles down the left side and the resources and functions across the top. The cells of the matrix can either indicate that access is allowed or indicate the type of access. CBK pp 317 – 318

AIO3, p. 169 describes it as a table if subjects and objects specifying the access rights a certain subject possesses pertaining to specific objects.

In either case, the matrix is a way of analyzing the access control needed by a population of subjects to a population of objects. This access control can be applied using rules, ACL\’s, capability tables, etc.

“A capacity table” is incorrect.

This answer is a trap for the unwary — it sounds a little like “capability table” but is just there to distract you.

“An access control list” is incorrect.

“It [ACL] specifies a list of users [subjects] who are allowed access to each object” CBK, p. 188 Access control lists (ACL) could be used to implement the rules identified by an access control matrix but is different from the matrix itself.

“A capability table” is incorrect.

“Capability tables are used to track, manage and apply controls based on the object and rights, or capabilities of a subject. For example, a table identifies the object, specifies access rights allowed for a subject, and permits access based on

the user\’s posession of a capability (or ticket) for the object.” CBK, pp. 191-192 To put it another way, as noted in AIO3 on p. 169, “A capabiltiy table is different from an ACL because the subject is bound to the capability table, whereas the

object is bound to the ACL.” Again, a capability table could be used to implement the rules identified by an access control matrix but is different from the matrix itself.

CBK pp. 191-192, 317-318

AIO3, p. 169

Question 2:

Which of the following describes the major disadvantage of many Single Sign-On (SSO) implementations?

A. Once an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.

B. The initial logon process is cumbersome to discourage potential intruders.

C. Once a user obtains access to the system through the initial log-on, they only need to logon to some applications.

D. Once a user obtains access to the system through the initial log-on, he has to logout from all other systems

Correct Answer: A

Explanation: Single Sign-On is a distrubuted Access Control methodology where an individual only has to authenticate once and would have access to all primary and secondary network domains. The individual would not be required to re-

authenticate when they needed additional resources. The security issue that this creates is if a fraudster is able to compromise those credential they too would have access to all the resources that account has access to.

All the other answers are incorrect as they are distractors.

Question 3:

What are cognitive passwords?

A. Passwords that can be used only once.

B. Fact or opinion-based information used to verify an individual\’s identity.

C. Password generators that use a challenge response scheme.

D. Passphrases.

Correct Answer: B

Explanation: Cognitive passwords are fact or opinion-based information used to verify an individual\’s identity. Passwords that can be used only once are one-time or dynamic passwords. Password generators that use a challenge response

scheme refer to token devices.

A passphrase is a sequence of characters that is longer than a password and is transformed into a virtual password.

Source: WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#1 Access Control System and Methodology (page 2), /Documents/CISSP_Summary_2002/index.html.

Question 4:

The three classic ways of authenticating yourself to the computer security software are: something you know, something you have, and something:

A. you need.

B. you read.

C. you are.

D. you do.

Correct Answer: C

Explanation: Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

Question 5:

Which best describes a tool (i.e. keyfob, calculator, memory card or smart card) used to supply dynamic passwords?

A. Tickets

B. Tokens

C. Token passing networks

D. Coupons

Correct Answer: B

Explanation: Tokens; Tokens in the form of credit card-size memory cards or smart cards, or those resembling small calculators, are used to supply static and dynamic passwords.

Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 37

Latest CISSP DumpsCISSP Study GuideCISSP Exam Questions

Question 6:

What is the name of the first mathematical model of a multi-level security policy used to define the concept of a secure state, the modes of access, and rules for granting access?

A. Clark and Wilson Model

B. Harrison-Ruzzo-Ullman Model

C. Rivest and Shamir Model

D. Bell-LaPadula Model

Correct Answer: D

Explanation: Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

Question 7:

Which of the following is NOT a factor related to Access Control?

A. integrity

B. authenticity

C. confidentiality

D. availability

Correct Answer: B

Explanation: These factors cover the integrity, confidentiality, and availability components of information system security. Integrity is important in access control as it relates to ensuring only authorized subjects can make changes to objects.

Authenticity is different from authentication. Authenticity pertains to something being authentic, not necessarily having a direct correlation to access control.

Confidentiality is pertinent to access control in that the access to sensitive information is controlled to protect confidentiality.

vailability is protected by access controls in that if an attacket attempts to disrupt availability they would first need access.

Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 49

Question 8:

Which security model uses division of operations into different parts and requires different users to perform each part?

A. Bell-LaPadula model

B. Biba model

C. Clark-Wilson model

D. Non-interference model

Correct Answer: C

Explanation: The Clark-Wilson model uses separation of duties, which divides an operation into different parts and requires different users to perform each part. This prevents authorized users from making unauthorized modifications to data,

thereby protecting its integrity.

The Clark-Wilson integrity model provides a foundation for specifying and analyzing an integrity policy for a computing system.

The model is primarily concerned with formalizing the notion of information integrity. Information integrity is maintained by preventing corruption of data items in a system due to either error or malicious intent. An integrity policy describes how

the data items in the system should be kept valid from one state of the system to the next and specifies the capabilities of various principals in the system. The model defines enforcement rules and certification rules.

The model\’s enforcement and certification rules define data items and processes that provide the basis for an integrity policy. The core of the model is based on the notion of a transaction.

A well-formed transaction is a series of operations that transition a system from one consistent state to another consistent state.

In this model the integrity policy addresses the integrity of the transactions. The principle of separation of duty requires that the certifier of a transaction and the implementer be different entities.

The model contains a number of basic constructs that represent both data items and processes that operate on those data items. The key data type in the Clark-Wilson model is a Constrained Data Item (CDI). An Integrity Verification

Procedure (IVP) ensures that all CDIs in the system are valid at a certain state. Transactions that enforce the integrity policy are represented by Transformation Procedures (TPs). A TP takes as input a CDI or Unconstrained Data Item (UDI)

and produces a CDI. A TP must transition the system from one valid state to another valid state. UDIs represent system input (such as that provided by a user or adversary). A TP must guarantee (via certification) that it transforms all possible

values of a UDI to a “safe” CDI.

In general, preservation of data integrity has three goals:

Prevent data modification by unauthorized parties

Prevent unauthorized data modification by authorized parties Maintain internal and external consistency (i.e. data reflects the real world)

Clark-Wilson addresses all three rules but BIBA addresses only the first rule of intergrity. HARRIS, Shon, All-In-One CISSP Certification Fifth Edition, McGraw-Hill/Osborne, Chapter

5: Security Architecture and Design (Page 341-344). and http://en.wikipedia.org/wiki/Clark-Wilson_model

Question 9:

Which of the following is an example of discretionary access control?

A. Identity-based access control

B. Task-based access control

C. Role-based access control

D. Rule-based access control

Correct Answer: A

Explanation: An identity-based access control is an example of discretionary access control that is based on an individual\’s identity. Identity-based access control (IBAC) is access control based on the identity of the user (typically relayed as a characteristic of the process acting on behalf of that user) where access authorizations to specific objects are assigned based on user identity.

Rule Based Access Control (RuBAC) and Role Based Access Control (RBAC) are examples of non-discretionary access controls. Rule-based access control is a type of non-discretionary access control because this access is determined by rules and the subject does not decide what those rules will be, the rules are uniformly applied to ALL of the users or subjects. In general, all access control policies other than DAC are grouped in the category of non- discretionary access control (NDAC). As the name implies, policies in this category have rules that are not established at the discretion of the user. Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action. Both Role Based Access Control (RBAC) and Rule Based Access Control (RuBAC) fall within Non Discretionary Access Control (NDAC). If it is not DAC or MAC then it is most likely NDAC.

BELOW YOU HAVE A DESCRIPTION OF THE DIFFERENT CATEGORIES: MAC = Mandatory Access Control Under a mandatory access control environment, the system or security administrator will define what permissions subjects have on objects. The administrator does not dictate user\’s access but simply configure the proper level of access as

dictated by the Data Owner.

The MAC system will look at the Security Clearance of the subject and compare it with the object sensitivity level or classification level. This is what is called the dominance relationship.

The subject must DOMINATE the object sensitivity level. Which means that the subject must have a security clearance equal or higher than the object he is attempting to access. MAC also introduce the concept of labels. Every objects will

have a label attached to them indicating the classification of the object as well as categories that are used to impose the need to know (NTK) principle. Even thou a user has a security clearance of Secret it does not mean he would be able to

access any Secret documents within the system. He would be allowed to access only Secret document for which he has a Need To Know, formal approval, and object where the user belong to one of the categories attached to the object.

If there is no clearance and no labels then IT IS NOT Mandatory Access Control.

Many of the other models can mimic MAC but none of them have labels and a dominance relationship so they are NOT in the MAC category.

DAC = Discretionary Access Control

DAC is also known as: Identity Based access control system.

The owner of an object is define as the person who created the object. As such the owner has the discretion to grant access to other users on the network. Access will be granted based solely on the identity of those users.

Such system is good for low level of security. One of the major problem is the fact that a user who has access to someone\’s else file can further share the file with other users without the knowledge or permission of the owner of the file. Very

quickly this could become the wild wild west as there is no control on the dissimination of the information.

RBAC = Role Based Access Control

RBAC is a form of Non-Discretionary access control.

Role Based access control usually maps directly with the different types of jobs performed by employees within a company.

For example there might be 5 security administrator within your company. Instead of creating each of their profile one by one, you would simply create a role and assign the administrators to the role. Once an administrator has been assigned

to a role, he will IMPLICITLY inherit the permissions of that role.

RBAC is great tool for environment where there is a a large rotation of employees on a daily basis such as a very large help desk for example.

RBAC or RuBAC = Rule Based Access Control RuBAC is a form of Non-Discretionary access control. A good example of a Rule Based access control device would be a Firewall. A single set of rules is imposed to all users attempting to connect through the firewall. Source: KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 33 and

NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316pdf and http://itlaw.wikia.com/wiki/Identity-based_access_control

Question 10:

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

A. Authentication

B. Identification

C. Authorization

D. Confidentiality

Correct Answer: B

Explanation: Identification is the act of a user professing an identity to a system, usually in the form of a log-on ID to the system.

Identification is nothing more than claiming you are somebody. You identify yourself when you speak to someone on the phone that you don\’t know, and they ask you who they\’re speaking to. When you say, “I\’m Jason.”, you\’ve just identified

yourself.

In the information security world, this is analogous to entering a username. It\’s not analogous to entering a password. Entering a password is a method for verifying that you are who you identified yourself as.

NOTE: The word “professing” used above means: “to say that you are, do, or feel something when other people doubt what you say”. This is exactly what happen when you provide your identifier (identification), you claim to be someone but

the system cannot take your word for it, you must further Authenticate to the system to prove who you claim to be.

The following are incorrect answers:

Authentication: is how one proves that they are who they say they are. When you claim to be Jane Smith by logging into a computer system as “jsmith”, it\’s most likely going to ask you for a password. You\’ve claimed to be that person by

entering the name into the username field (that\’s the identification part), but now you have to prove that you are really that person.

Many systems use a password for this, which is based on “something you know”, i.e. a secret between you and the system.

Another form of authentication is presenting something you have, such as a driver\’s license, an RSA token, or a smart card.

You can also authenticate via something you are. This is the foundation for biometrics. When you do this, you first identify yourself and then submit a thumb print, a retina scan, or another form of bio-based authentication.

Once you\’ve successfully authenticated, you have now done two things: you\’ve claimed to be someone, and you\’ve proven that you are that person. The only thing that\’s left is for the system to determine what you\’re allowed to do.

Authorization: is what takes place after a person has been both identified and authenticated; it\’s the step determines what a person can then do on the system.

An example in people terms would be someone knocking on your door at night. You say, “Who is it?”, and wait for a response. They say, “It\’s John.” in order to identify themselves. You ask them to back up into the light so you can see them

through the peephole. They do so, and you authenticate them based on what they look like (biometric). At that point you decide they can come inside the house.

If they had said they were someone you didn\’t want in your house (identification), and you then verified that it was that person (authentication), the authorization phase would not include access to the inside of the house.

Confidentiality: Is one part of the CIA triad. It prevents sensitive information from reaching the wrong people, while making sure that the right people can in fact get it. A good example is a credit card number while shopping online, the

merchant needs it to clear the transaction but you do not want your informaiton exposed over the network, you would use a secure link such as SSL, TLS, or some tunneling tool to protect the information from prying eyes between point A and point B. Data encryption is a common method of ensuring confidentiality.

The other parts of the CIA triad are listed below:

Integrity involves maintaining the consistency, accuracy, and trustworthiness of data over its entire life cycle. Data must not be changed in transit, and steps must be taken to ensure that data cannot be altered by unauthorized people (for

example, in a breach of confidentiality). In addition, some means must be in place to detect any changes in data that might occur as a result of non-human-caused events such as an electromagnetic pulse (EMP) or server crash. If an

unexpected change occurs, a backup copy must be available to restore the affected data to its correct state.

Availability is best ensured by rigorously maintaining all hardware, performing hardware repairs immediately when needed, providing a certain measure of redundancy and failover, providing adequate communications bandwidth and

preventing the occurrence of bottlenecks, implementing emergency backup power systems, keeping current with all necessary system upgrades, and guarding against malicious actions such as denial-of- service (DoS) attacks.

Reference used for this question:

http://whatis.techtarget.com/definition/Confidentiality-integrity-and-availability-CIA

http://www.danielmiessler.com/blog/security-identification-authentication-and-authorization

http://www.merriam-webster.com/dictionary/profess

KRUTZ, Ronald L. and VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley and Sons, Page 36

CertBus exam braindumps are pass guaranteed. We guarantee your pass for the CISSP exam successfully with our ISC materials. CertBus Certified Information Systems Security Professional exam PDF and VCE are the latest and most accurate. We have the best ISC in our team to make sure CertBus Certified Information Systems Security Professional exam questions and answers are the most valid. CertBus exam Certified Information Systems Security Professional exam dumps will help you to be the ISC specialist, clear your CISSP exam and get the final success.

CISSP Latest questions and answers on Google Drive(100% Free Download): https://drive.google.com/file/d/0B_3QX8HGRR1mVXBDYy0tYmNFSHM/view?usp=sharing

CISSP ISC exam dumps (100% Pass Guaranteed) from CertBus: https://www.certgod.com/CISSP.html [100% Exam Pass Guaranteed]

Why select/choose CertBus?

Millions of interested professionals can touch the destination of success in exams by certgod.com. products which would be available, affordable, updated and of really best quality to overcome the difficulties of any course outlines. Questions and Answers material is updated in highly outclass manner on regular basis and material is released periodically and is available in testing centers with whom we are maintaining our relationship to get latest material.

Brand	Certbus	Testking	Pass4sure	Actualtests	Others
Price	$45.99	$124.99	$125.99	$189	$69.99-99.99
Up-to-Date Dumps
Free 365 Days Update
Real Questions
Printable PDF
Test Engine
One Time Purchase
Instant Download
Unlimited Install
100% Pass Guarantee
100% Money Back
Secure Payment
Privacy Protection