OFFICIAL (ISC)² CISSP
OFFICIAL (ISC)² CISSP -
DOMAIN 3: SECURITY
ENGINEERING QUESTIONS
AND ANSWERS 2024/2025
Address Space Layout Randomization (ASLR) - ANS >>Involves randomly arranging the positions of key
data areas of a program, including the base of the executable and the positions of the stack, heap, and
libraries in a process's memory address space.
Aggregation - ANS >>Combining non-sensitive data from separate sources to create sensitive
information.
Algorithm - ANS >>A mathematical function that is used in the encryption and decryption processes.
Bell-La Padula Model - ANS >>Explores the rules that would have to be in place if a subject is granted a
certain level of clearance and a particular mode of access.
Brewer-Nash (The Chinese Wall) Model - ANS >>This model focuses on preventing conflict of interest
when a given subject has access to objects with sensitive information associated with two competing
parties.
Cable Plant Management - ANS >>The design, documentation, and management of the lowest layer of
the OSI network model - the physical layer.
Abstraction - ANS >>Involves the removal of characteristics from an entity in order to easily represent its
essential properties.
Certificate Authority (CA) - ANS >>An entity trusted by one or more users as an authority in a network
that issues, revokes, and manages digital certificates.
1
, OFFICIAL (ISC)² CISSP
Ciphertext or Cryptogram - ANS >>The altered form of a plaintext message, so as to be unreadable for
anyone except the intended recipients.
Cloud Computing - ANS >>A model for enabling ubiquitous, convenient, on-demand network access to a
shared pool of configurable computing resources (e.g. networks, servers, storage, applications, and
services) that can be rapidly provisioned and released with minimal management.
Common Criteria - ANS >>Provides a structured methodology for documenting security requirements,
documenting and validating security capabilities, and promoting international cooperation in the area of
IT security.
Access Control Matrix - ANS >>A two-dimensional table that allows for individual subjects and objects to
be related to each other.
Community Cloud Infrastructure - ANS >>Provisioned for exclusive use by a specific community of
consumers from organizations that have shared concerns.
Confusion - ANS >>Provided by mixing (changing) the key values used during the repeated rounds of
encryption. When the key is modified for each round, it provides added complexity that the attacker
would encounter.
Control Objects for Information and Related Technology (COBIT) - ANS >>Provides a set of generally
accepted processes to assist in maximizing the benefits derived using information technology (IT) and
developing appropriate IT governance.
Covert Channels - ANS >>Communications mechanisms hidden from the access control and standard
monitoring systems of an information system.
Cryptanalysis - ANS >>The study of techniques for attempting to defeat cryptographic techniques and,
more generally, information security services.
Cryptology - ANS >>The science that deals with hidden, disguised, or encrypted communications. It
embraces communications security and communications intelligence.
2
OFFICIAL (ISC)² CISSP -
DOMAIN 3: SECURITY
ENGINEERING QUESTIONS
AND ANSWERS 2024/2025
Address Space Layout Randomization (ASLR) - ANS >>Involves randomly arranging the positions of key
data areas of a program, including the base of the executable and the positions of the stack, heap, and
libraries in a process's memory address space.
Aggregation - ANS >>Combining non-sensitive data from separate sources to create sensitive
information.
Algorithm - ANS >>A mathematical function that is used in the encryption and decryption processes.
Bell-La Padula Model - ANS >>Explores the rules that would have to be in place if a subject is granted a
certain level of clearance and a particular mode of access.
Brewer-Nash (The Chinese Wall) Model - ANS >>This model focuses on preventing conflict of interest
when a given subject has access to objects with sensitive information associated with two competing
parties.
Cable Plant Management - ANS >>The design, documentation, and management of the lowest layer of
the OSI network model - the physical layer.
Abstraction - ANS >>Involves the removal of characteristics from an entity in order to easily represent its
essential properties.
Certificate Authority (CA) - ANS >>An entity trusted by one or more users as an authority in a network
that issues, revokes, and manages digital certificates.
1
, OFFICIAL (ISC)² CISSP
Ciphertext or Cryptogram - ANS >>The altered form of a plaintext message, so as to be unreadable for
anyone except the intended recipients.
Cloud Computing - ANS >>A model for enabling ubiquitous, convenient, on-demand network access to a
shared pool of configurable computing resources (e.g. networks, servers, storage, applications, and
services) that can be rapidly provisioned and released with minimal management.
Common Criteria - ANS >>Provides a structured methodology for documenting security requirements,
documenting and validating security capabilities, and promoting international cooperation in the area of
IT security.
Access Control Matrix - ANS >>A two-dimensional table that allows for individual subjects and objects to
be related to each other.
Community Cloud Infrastructure - ANS >>Provisioned for exclusive use by a specific community of
consumers from organizations that have shared concerns.
Confusion - ANS >>Provided by mixing (changing) the key values used during the repeated rounds of
encryption. When the key is modified for each round, it provides added complexity that the attacker
would encounter.
Control Objects for Information and Related Technology (COBIT) - ANS >>Provides a set of generally
accepted processes to assist in maximizing the benefits derived using information technology (IT) and
developing appropriate IT governance.
Covert Channels - ANS >>Communications mechanisms hidden from the access control and standard
monitoring systems of an information system.
Cryptanalysis - ANS >>The study of techniques for attempting to defeat cryptographic techniques and,
more generally, information security services.
Cryptology - ANS >>The science that deals with hidden, disguised, or encrypted communications. It
embraces communications security and communications intelligence.
2
