CISSP All-In-One Practice Exam Domain 1 Part 1

Which of the following best describes the relationship between COBIT and ITIL?

• COBIT is a model for IT governance, whereas ITIL is a model for corporate governance.

• COBIT provides a corporate governance roadmap, whereas ITIL is a customizable framework for IT service management.

• COBIT defines IT goals, whereas ITIL provides the process-level steps on how to achieve them.

• COBIT provides a framework for achieving business goals, whereas ITIL defines a framework for achieving IT service-level goals.

Answer explanation

The Control Objectives for Information and related Technology (COBIT) is a framework developed by ISACA (formerly the Information Systems Audit and Control Association) and the IT Governance Institute (ITGI). It defines goals for the controls that should be used to properly manage IT and to ensure IT maps to business needs, not specifically just security needs. The Information Technology Infrastructure Library (ITIL) is the de facto standard of best practices for IT service management. A customizable framework, ITIL provides the goals, the general activities necessary to achieve these goals, and the input and output values for each process required to meet these determined goals. In essence, COBIT addresses "what is to be achieved," and ITIL addresses "how to achieve it.

Global organizations that transfer data across international boundaries must abide by guidelines and transborder information flow rules developed by an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy. What organization is this?

• Committee of Sponsoring Organizations of the Treadway Commission

• The Organisation for Economic Co-operation and Development

• COBIT

• International Organization for Standardization

Answer explanation

Almost every country has its own rules pertaining to what constitutes private data and how it should be protected. As the digital and information age came upon us, these different laws started to negatively affect business and international trade. Thus, the Organisation for Economic Co-operation and Development (OECD) developed guidelines for various countries so that data is properly protected and everyone follows the same rules.

Steve, a department manager, has been asked to join a committee that is responsible for defining an acceptable level of risk for the organization, reviewing risk assessment and audit reports, and approving significant changes to security policies and programs. What committee is he joining?

• Security policy committee

• Audit committee

• Risk management committee

• Security steering committee

Answer explanation

Steve is joining a security steering committee, which is responsible for making decisions on tactical and strategic security issues within the enterprise. The committee should consist of individuals from throughout the organization and meet at least quarterly. In addition to the responsibilities listed in the question, the security steering committee is responsible for establishing a clearly defined vision statement that works with and supports the organizational intent of the business. It should provide support for the goals of availability, integrity, and confidentiality as they pertain to the organization's business objectives. This vision statement should, in turn, be supported by a mission statement that provides support and definition to the processes that will apply to the organization and allow it to reach its business goals.

Which of the following is not included in a risk assessment?

• Discontinuing activities that introduce risk

• Identifying assets

• Identifying threats

• Analyzing risk in order of cost or criticality

Answer explanation

Discontinuing activities that introduce risk is a way of responding to risk through avoidance. For example, there are many risks surrounding the use of instant messaging (IM) in the enterprise. If a company decides not to allow IM activity because there is not enough business need for its use, then prohibiting this service is an example of risk avoidance. Risk assessment does not include the implementation of countermeasures such as this.

The integrity of data is not related to which of the following?

• Unauthorized manipulation or changes to data

• The modification of data without authorization

• The intentional or accidental substitution of data

• The extraction of data to share with unauthorized entities

Answer explanation

The extraction of data to share with unauthorized entities is a confidentiality issue, not an integrity issue. Confidentiality ensures that the necessary level of secrecy is enforced at each junction of data processing and prevents unauthorized disclosure. This level of secrecy should prevail while data resides on systems and devices within the network, as it is transmitted, and once it reaches its destination. Integrity, on the other hand, is the principle that signifies the data has not been changed or manipulated in an unauthorized manner.

As his company's CISO, George needs to demonstrate to the board of directors the necessity of a strong risk management program. Which of the following should George use to calculate the company's residual risk?

• threats × vulnerability × asset value = residual risk

• SLE × frequency = ALE, which is equal to residual risk

• (threats × vulnerability × asset value) × controls gap = residual risk

• (total risk – asset value) × countermeasures = residual risk

Answer explanation

Countermeasures are implemented to reduce overall risk to an acceptable level. However, no system or environment is 100 percent secure, and with every countermeasure some risk remains. The leftover risk after countermeasures are implemented is called residual risk. Residual risk differs from total risk, which is the risk companies face when they choose not to implement any countermeasures. While the total risk can be determined by calculating threats × vulnerability × asset value = total risk, residual risk can be determined by calculating (threats × vulnerability × asset value) × controls gap = residual risk. The controls gap is the amount of protection the control cannot provide.

Capability Maturity Model Integration (CMMI) came from the software engineering world and is used within organizations to help lay out a pathway of how incremental improvement can take place. This model is used by organizations in self-assessment and to develop structured steps that can be followed so an organization can evolve from one level to the next and constantly improve its processes. In the CMMI model graphic shown, what is the proper sequence of the levels?

• Initial, Defined, Managed, Quantitatively Managed, Optimizing

• Initial, Defined, Quantitatively Managed, Optimizing, Managed

• Defined, Managed, Quantitatively Managed, Optimizing

• Initial, Repeatable, Defined, Quantitatively Managed, Optimizing

Answer explanation

Capability Maturity Model Integration (CMMI) is an organizational development model for process improvement developed by Carnegie Mellon. While organizations know that they need to constantly make their security programs better, it is not always easy to accomplish because "better" is a vague and nonquantifiable concept. The only way we can really improve is to know where we are starting from, where we need to go, and the steps we need to take in between. This is how the security industry uses the CMMI model. A security program starts at Level 1 and is chaotic in nature. Processes are not predictable, and the security team is reactive to issues that arise—not proactive. The model uses the following maturity levels: Initial, Repeatable, Defined, Managed, Optimizing.

Risk assessment has several different methodologies. Which of the following official risk methodologies was not created for the purpose of analyzing security risks?

• FAP

• OCTAVE

• AS/NZS 4360

• NIST SP 800-30

Answer explanation

Although AS/NZS 4360 can be used to analyze security risks, it was not created for that purpose. It takes a much broader approach to risk management than other risk assessment methodologies, such as NIST and OCTAVE, which focus on IT threats and information security risks. AS/NZS 4360 can be used to understand a company's financial, capital, human safety, and business decisions risks.

Which of the following is not a characteristic of a company with a security governance program in place?

• Board members are updated quarterly on the company's state of security.

• All security activity takes place within the security department.

• Security products, services, and consultants are deployed in an informed manner.

• The organization has established metrics and goals for improving security.

Answer explanation

If all security activity takes place within the security department, then security is working within a silo and is not integrated throughout the organization. In a company with a security governance program, security responsibilities permeate the entire organization, from executive management down the chain of command. A common scenario would be executive management holding business unit managers responsible for carrying out risk management activities for their specific business units. In addition, employees are held accountable for any security breaches they participate in, either maliciously or accidentally.

There are four ways of dealing with risk. In the graphic that follows, which method is missing and what is the purpose of this method?

• Risk transference. Share the risk with other entities

• Risk reduction. Reduce the risk to an acceptable level.

• Risk rejection. Accept the current risk

• Risk assignment. Assign risk to a specific owner

Answer explanation

Once a company knows the amount of total and residual risk it is faced with, it must decide how to handle it. Risk can be dealt with in four basic ways: transfer it, avoid it, reduce it, or accept it. Many types of insurance are available to companies to protect their assets. If a company decides the total or residual risk is too high to gamble with, it can purchase insurance, which would transfer the risk to the insurance company.