CISSP DOMAIN 1 EXAM QUESTIONS
AND CORRECT ANSWERS
When used in unison, what does layered defense improve? - Answer- It improves CIA
What is Defense in depth / Layered Defense? - Answer- Series of multiple controls or
overlapping security to protect an asset
What do Defense in depth / Layered Defense apply to? - Answer- Applies to both
physical and logical controls
Note: No single security secures an asset
How many laws are on the exam? - Answer- 4
Criminal Law - Answer- Criminal Law
Society is the victim and proof must be "beyond a reasonable doubt"
Incarceration, death and financial fines to "punish and deter"
Civil Law (Tort Law) - Answer- Individuals, groups or organization are victims and proof
must be "the majority of proof"
Financial fines to "Compensate the victim(s)"
Administrative Law (Regulatory Law) - Answer- Laws enacted by government agencies
(HIPAA, FAA), proof is "More likely than not"
Punishment is administrative or financial
3 Elements in CIA Triad - Answer- Confidentiality, Integrity, Availability
Threat Definition - Answer- a potential harmful incident
What principles does Availability depend on? - Answer- Integrity and Confidentiality
What principle is typically viewed as the primary goals and objectives of a security
infrastructure? - Answer- CIA
What is confidentiality? - Answer- A concept of measures used to ensure protection of
data, objects, and resources.
What is the goal of confidentiality? - Answer- Prevent or minimize unauthorized access
to data.
, What is Integrity? - Answer- Concept of protecting the reliability and correctness of data
What does Integrity prevent? - Answer- Prevents unauthorized alterations of data.
What does Integrity ensure? - Answer- Ensures that data remains correct, unaltered,
and preserved.
Integrity is dependent on what? - Answer- Confidentiality
What are other concepts, aspects, and conditions of integrity? - Answer- 1. Accuracy=
Being correct
2. Truthfulness = Being a true reflection of reality
3. Authenticity = Being authentic and genuine.
4. Validity= being factually and logically sound
5. Non-repudiation = Not being able to deny having performed an action or activity or
being able to verify the origin of a communication or event
6. Accountability= Being responsible or obligated for actions and results
7. Responsibility = Being in charge or having control over someone or something
8. Completeness = Having all needed components or parts
9. Comprehensiveness = Being complete in scope; full inclusion of all needed elements
What is Availability (Aside from the 3rd principle of CIA Triad)? - Answer- Means that
Authorized subjects are granted timely and uninterrupted time to objects.
What are some ways non-repudiation can be established? - Answer- 1.Digital
Certificates
2. Session Identifiers
3.Transaction Logs
4. Access Controls
What are other concepts, conditions, and aspects of availability? - Answer- 1. Usability=
Easy to use, learn, understand, and controlled by the subject
2. Accessibility= The assurance that the widest range of subjects can interact with a
resource regardless of their capabilities or limitations
3. Timeliness= Being prompt on time, within a reasonable timeframe, or providing a low
latency response
Confidentially Associations - Answer- -Data at rest (AES256)
-Data in motion (SSL, TLS)
-Data in use (Clean desk, no shoulder surfing etc)
-Strong passwords, multifactor, need to know
Threats:
-Social Engineering
-Keyloggers
-Crypto attack
Defense:
AND CORRECT ANSWERS
When used in unison, what does layered defense improve? - Answer- It improves CIA
What is Defense in depth / Layered Defense? - Answer- Series of multiple controls or
overlapping security to protect an asset
What do Defense in depth / Layered Defense apply to? - Answer- Applies to both
physical and logical controls
Note: No single security secures an asset
How many laws are on the exam? - Answer- 4
Criminal Law - Answer- Criminal Law
Society is the victim and proof must be "beyond a reasonable doubt"
Incarceration, death and financial fines to "punish and deter"
Civil Law (Tort Law) - Answer- Individuals, groups or organization are victims and proof
must be "the majority of proof"
Financial fines to "Compensate the victim(s)"
Administrative Law (Regulatory Law) - Answer- Laws enacted by government agencies
(HIPAA, FAA), proof is "More likely than not"
Punishment is administrative or financial
3 Elements in CIA Triad - Answer- Confidentiality, Integrity, Availability
Threat Definition - Answer- a potential harmful incident
What principles does Availability depend on? - Answer- Integrity and Confidentiality
What principle is typically viewed as the primary goals and objectives of a security
infrastructure? - Answer- CIA
What is confidentiality? - Answer- A concept of measures used to ensure protection of
data, objects, and resources.
What is the goal of confidentiality? - Answer- Prevent or minimize unauthorized access
to data.
, What is Integrity? - Answer- Concept of protecting the reliability and correctness of data
What does Integrity prevent? - Answer- Prevents unauthorized alterations of data.
What does Integrity ensure? - Answer- Ensures that data remains correct, unaltered,
and preserved.
Integrity is dependent on what? - Answer- Confidentiality
What are other concepts, aspects, and conditions of integrity? - Answer- 1. Accuracy=
Being correct
2. Truthfulness = Being a true reflection of reality
3. Authenticity = Being authentic and genuine.
4. Validity= being factually and logically sound
5. Non-repudiation = Not being able to deny having performed an action or activity or
being able to verify the origin of a communication or event
6. Accountability= Being responsible or obligated for actions and results
7. Responsibility = Being in charge or having control over someone or something
8. Completeness = Having all needed components or parts
9. Comprehensiveness = Being complete in scope; full inclusion of all needed elements
What is Availability (Aside from the 3rd principle of CIA Triad)? - Answer- Means that
Authorized subjects are granted timely and uninterrupted time to objects.
What are some ways non-repudiation can be established? - Answer- 1.Digital
Certificates
2. Session Identifiers
3.Transaction Logs
4. Access Controls
What are other concepts, conditions, and aspects of availability? - Answer- 1. Usability=
Easy to use, learn, understand, and controlled by the subject
2. Accessibility= The assurance that the widest range of subjects can interact with a
resource regardless of their capabilities or limitations
3. Timeliness= Being prompt on time, within a reasonable timeframe, or providing a low
latency response
Confidentially Associations - Answer- -Data at rest (AES256)
-Data in motion (SSL, TLS)
-Data in use (Clean desk, no shoulder surfing etc)
-Strong passwords, multifactor, need to know
Threats:
-Social Engineering
-Keyloggers
-Crypto attack
Defense:
