Certified Information Systems Security Professional
(CISSP) Notes.
What is the ISC2 Code of Ethics Preamble? - Correct Answer - The safety and welfare of
society and the common good, duty to our principals, and to each other requires that we
adhere, and be seen to adhere, to the highest ethical standards of behavior.
- Therefore, strict adherence to this code is a condition of certification.
What is the first canon of the Code of Ethics? - Correct Answer Protect society, the
common good, necessary public trust and confidence, and the infrastructure.
What is the second canon of the Code of Ethics? - Correct Answer Act honorably,
honestly, justly, responsibly, and legally.
What is the third canon of the Code of Ethics? - Correct Answer Provide diligent and
competent service to principals.
What is the fourth and final canon of the Code of Ethics? - Correct Answer Advance and
protect the profession.
What are some mechanisms of Confidentiality? - Correct Answer - Confidentiality
measures the attacker's ability to get unauthorized data or access to information from an
application or system.
- Involves using techniques, often cryptography, to allow only approved users the ability to
view sensitive information.
- Confidential information can include passwords, cryptographic keys, personally
identifiable information (PII), personal health information (PHI), intellectual property (IP),
or other secret or top-secret information.
What are some High-level Confidentiality controls? - Correct Answer - Uses hybrid
encryption involving combinations of symmetric and asymmetric cryptosystems.
- Employs advanced post-quantum and homomorphic cryptosystems.
,- Combines secure compartmentalization with the most recent modes of encryption
available.
What are some mechanisms of Integrity? - Correct Answer - Integrity measures an
attacker's ability to manipulate, change, or remove data at rest and data in transit.
- Involves implementation controls that make certain only authorized subjects can change
sensitive information.
- Might also include affirming the identity of a communication peer (origin authentication).
- Examples of integrity violations would be injection or hijacking attacks on data in transit,
modifying files, changing access control lists, and DNS or ARP cache poisoning.
What are some High-level Integrity goals and controls? - Correct Answer The advanced
goals of the Clark-Wilson model are:
- Prevent unauthorized users from making modifications.
- Ensure separation of duties prevents authorized users from making improper
modifications.
- Ensure well-formed transactions; maintain internal and external consistency.
What are some mechanisms of Availability? - Correct Answer - Availability measures an
attacker's ability to disrupt or prevent access to services or data.
- Controls will protect systems and services from spoofing, flooding, denial-of-service
(DDoS), poisoning, and other attacks that negatively affect the ability to deliver data,
content, or services.
- Vulnerabilities that impact availability can affect hardware, software, and network
resources, such as flooding network bandwidth, consuming large amounts of memory,
CPU cycles, or unnecessary power consumption.
What is an aspect of High-level Availability? - Correct Answer Availability zones of cloud
service providers:
, - Multiple datacenters in one.
- Zones are tens of miles apart.
- Connected with high-speed fiber (Metropolitan Area Networks [MANs]).
- Placed in regions all over the world.
- Can distribute through CDN services into metro areas.
What is the opposite of the C.I.A. security triad? - Correct Answer D.A.D.
- Disclosure is the unauthorized revealing of data and information.
- Alteration is the unauthorized change or modification of data or systems.
- Destruction involves rendering an entity inaccessible - can also add the element of lack
of durability in some scenarios.
What are the 3 additions to the CIA triad (according to the Parkerian Hexad)? - Correct
Answer Authenticity - Refers to the accuracy and identity of the origin of the entity or the
information.
Utility - While an asset, such as data, would be confidential, controlled, integral, authentic,
and available - it is not always useful or valuable in form.
Possession - An attacker takes possession or control of a physical or logical asset - may
still retain confidentiality.
What are some elements of High-level Authenticity? - Correct Answer - Origin
authentication is a basic form of authentication, as it only provides a degree of confidence
that the correct password, passphrase, or private/secret key was used.
- Additional levels of authentication rely on trusted third parties and certificates, digital
signatures, and multi-factors, like biometrics.
(CISSP) Notes.
What is the ISC2 Code of Ethics Preamble? - Correct Answer - The safety and welfare of
society and the common good, duty to our principals, and to each other requires that we
adhere, and be seen to adhere, to the highest ethical standards of behavior.
- Therefore, strict adherence to this code is a condition of certification.
What is the first canon of the Code of Ethics? - Correct Answer Protect society, the
common good, necessary public trust and confidence, and the infrastructure.
What is the second canon of the Code of Ethics? - Correct Answer Act honorably,
honestly, justly, responsibly, and legally.
What is the third canon of the Code of Ethics? - Correct Answer Provide diligent and
competent service to principals.
What is the fourth and final canon of the Code of Ethics? - Correct Answer Advance and
protect the profession.
What are some mechanisms of Confidentiality? - Correct Answer - Confidentiality
measures the attacker's ability to get unauthorized data or access to information from an
application or system.
- Involves using techniques, often cryptography, to allow only approved users the ability to
view sensitive information.
- Confidential information can include passwords, cryptographic keys, personally
identifiable information (PII), personal health information (PHI), intellectual property (IP),
or other secret or top-secret information.
What are some High-level Confidentiality controls? - Correct Answer - Uses hybrid
encryption involving combinations of symmetric and asymmetric cryptosystems.
- Employs advanced post-quantum and homomorphic cryptosystems.
,- Combines secure compartmentalization with the most recent modes of encryption
available.
What are some mechanisms of Integrity? - Correct Answer - Integrity measures an
attacker's ability to manipulate, change, or remove data at rest and data in transit.
- Involves implementation controls that make certain only authorized subjects can change
sensitive information.
- Might also include affirming the identity of a communication peer (origin authentication).
- Examples of integrity violations would be injection or hijacking attacks on data in transit,
modifying files, changing access control lists, and DNS or ARP cache poisoning.
What are some High-level Integrity goals and controls? - Correct Answer The advanced
goals of the Clark-Wilson model are:
- Prevent unauthorized users from making modifications.
- Ensure separation of duties prevents authorized users from making improper
modifications.
- Ensure well-formed transactions; maintain internal and external consistency.
What are some mechanisms of Availability? - Correct Answer - Availability measures an
attacker's ability to disrupt or prevent access to services or data.
- Controls will protect systems and services from spoofing, flooding, denial-of-service
(DDoS), poisoning, and other attacks that negatively affect the ability to deliver data,
content, or services.
- Vulnerabilities that impact availability can affect hardware, software, and network
resources, such as flooding network bandwidth, consuming large amounts of memory,
CPU cycles, or unnecessary power consumption.
What is an aspect of High-level Availability? - Correct Answer Availability zones of cloud
service providers:
, - Multiple datacenters in one.
- Zones are tens of miles apart.
- Connected with high-speed fiber (Metropolitan Area Networks [MANs]).
- Placed in regions all over the world.
- Can distribute through CDN services into metro areas.
What is the opposite of the C.I.A. security triad? - Correct Answer D.A.D.
- Disclosure is the unauthorized revealing of data and information.
- Alteration is the unauthorized change or modification of data or systems.
- Destruction involves rendering an entity inaccessible - can also add the element of lack
of durability in some scenarios.
What are the 3 additions to the CIA triad (according to the Parkerian Hexad)? - Correct
Answer Authenticity - Refers to the accuracy and identity of the origin of the entity or the
information.
Utility - While an asset, such as data, would be confidential, controlled, integral, authentic,
and available - it is not always useful or valuable in form.
Possession - An attacker takes possession or control of a physical or logical asset - may
still retain confidentiality.
What are some elements of High-level Authenticity? - Correct Answer - Origin
authentication is a basic form of authentication, as it only provides a degree of confidence
that the correct password, passphrase, or private/secret key was used.
- Additional levels of authentication rely on trusted third parties and certificates, digital
signatures, and multi-factors, like biometrics.
