CISSP EXAM WITH COMPLETE SOLUTIONS 2024-2025
Authentication- Answer proof and verification of information
Identification- Answer identity verification
Confidentiality- Answer Protection from unauthorized viewing
Availability- Answer Maintaining system usability
Permissive- Answer allow by default
Restrictive- Answer deny by default
Defense in depth- Answer layered defense
Asset valuation -Answer what are you trying to protect
Determining users -Answer need and level of access
Policy - Answer documented, discrete standards and guidelines for determining access
to organizational information
Separation of Duties - Answer users are not given oversight of an entire process
(cost-benefit)
,Least privilege - Answer only have permissions they need
Need to know - Answer only have access to data they needs
Compartmentalization - Answer Isolating groups and information (The more people that
know, the greater security risk)
Security Domain Common processes and controls different from other areas
Network access control Common makes sure a system is configured in conformity with
policies that are current
Remote access Common virtual private network
System access Smartcards, tokens, userID and password
Application access Monitor the user sessions, inactivity time-outs, validating data entry
Malware Control Antivirus, integrity check of files, intrusion Prevention System
Malware encryption - Response supports confidentiality and authentication, hashing,
aids in session validation
Physical Access Control - Response complete range of physical controls, (locks,
windows, etc) Human life is most important
Strategic alignment - Response alignment to ensure the security program supports and
aligns with organizations objectives
Information security objective - Response to maintain CIA
Organizational policy - Response organization-wide
Functional policy - Response guidelines on internet use
, Standard - Response how you will comply with policy
technical in nature
Baselines - Answer checklist procedures
operation Baseline - Answer describe how to implement security config to make
consistent
Guide lines - Answer optional recommendations
Long range strategy goals - Answer governance, risk management
Short range strategy goals - Answer possible theft, look for holes
Budgeting for cost - Answer implement procedures to measure the ongoing
cost-effectiveness of security controls
Resource constraints- Answer efforts must be prioritized because optimal number of
resources are almost never available.
Criminal law- Answer when criminal violates government law
Tort law - Answer civil wrongs against individual or entity
Administrative law - Answer deals with governance of public bodies environments &
drug laws
Patent - Answer grants owner a legally-enforceable right to exclude others from
practicing the invention covered for a specific time
Trademark - Answer protects goodwill and rep of company
Copyright - Answer covers the expression of ideas, not ideas themselves
Authentication- Answer proof and verification of information
Identification- Answer identity verification
Confidentiality- Answer Protection from unauthorized viewing
Availability- Answer Maintaining system usability
Permissive- Answer allow by default
Restrictive- Answer deny by default
Defense in depth- Answer layered defense
Asset valuation -Answer what are you trying to protect
Determining users -Answer need and level of access
Policy - Answer documented, discrete standards and guidelines for determining access
to organizational information
Separation of Duties - Answer users are not given oversight of an entire process
(cost-benefit)
,Least privilege - Answer only have permissions they need
Need to know - Answer only have access to data they needs
Compartmentalization - Answer Isolating groups and information (The more people that
know, the greater security risk)
Security Domain Common processes and controls different from other areas
Network access control Common makes sure a system is configured in conformity with
policies that are current
Remote access Common virtual private network
System access Smartcards, tokens, userID and password
Application access Monitor the user sessions, inactivity time-outs, validating data entry
Malware Control Antivirus, integrity check of files, intrusion Prevention System
Malware encryption - Response supports confidentiality and authentication, hashing,
aids in session validation
Physical Access Control - Response complete range of physical controls, (locks,
windows, etc) Human life is most important
Strategic alignment - Response alignment to ensure the security program supports and
aligns with organizations objectives
Information security objective - Response to maintain CIA
Organizational policy - Response organization-wide
Functional policy - Response guidelines on internet use
, Standard - Response how you will comply with policy
technical in nature
Baselines - Answer checklist procedures
operation Baseline - Answer describe how to implement security config to make
consistent
Guide lines - Answer optional recommendations
Long range strategy goals - Answer governance, risk management
Short range strategy goals - Answer possible theft, look for holes
Budgeting for cost - Answer implement procedures to measure the ongoing
cost-effectiveness of security controls
Resource constraints- Answer efforts must be prioritized because optimal number of
resources are almost never available.
Criminal law- Answer when criminal violates government law
Tort law - Answer civil wrongs against individual or entity
Administrative law - Answer deals with governance of public bodies environments &
drug laws
Patent - Answer grants owner a legally-enforceable right to exclude others from
practicing the invention covered for a specific time
Trademark - Answer protects goodwill and rep of company
Copyright - Answer covers the expression of ideas, not ideas themselves
