#01 CISSP: Full Coverage Mastery Exam 1 - Challenging

As a security professional, you have been tasked with conducting a Business Impact Analysis (BIA) for the physical assets of your organization. You are aware that there are several key considerations that need to be taken into account. Which of the following is a key consideration when conducting a BIA for physical assets?

• 1. The level of encryption used on the assets

• 1. The type of access controls used on the assets

• 1. The criticality of the assets to business operations

• 1. The availability of the assets to users

Answer explanation

"The criticality of the assets to business operations". This is because a Business Impact Analysis primarily focuses on identifying the importance of different business functions and processes, and the necessity of specific assets to the continued operations of the business. While encryption and access controls are important security considerations, the BIA is more concerned with how critical the asset is to the business operations and what impact its loss would have. Availability is also a critical factor, but it is often considered within the context of how it affects the business operation's continuity and recovery objectives.

You are a security professional working for a company that uses a cloud-based service to authenticate users through Security Assertion Markup Language (SAML) assertions. However, an attacker was able to intercept a SAML assertion during transmission and modify its content to gain unauthorized access to the system. Which of the following is the MOST common type of attack used to exploit this vulnerability?

• 1. Man-in-the-middle (MitM) attack

• 1. Cross-site scripting (XSS) attack

• 1. SQL injection (SQLi) attack

• 1. Denial-of-service (DoS) attack

Answer explanation

tions are intercepted and modified, it is indicative of a MitM attack, where the attacker has placed themselves in the communication path to capture and alter the SAML assertions being transmitted. This type of attack would allow an attacker to gain unauthorized access by impersonating a legitimate user or altering the assertion's content.

Considering current cybersecurity standards, which protocol among the following options is outdated and should be avoided due to its known vulnerabilities?

• 1. Secure Sockets Layer (SSL) 3.0

• 1. Internet Protocol Security (IPSec)

• 1. Secure Hash Algorithm 3 (SHA-3)

• 1. Transport Layer Security (TLS) 1.3

Answer explanation

"Secure Sockets Layer (SSL) 3.0". SSL 3.0 is an outdated protocol that has been superseded by the Transport Layer Security (TLS) protocols due to various well-known security issues, including the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack. Modern security practices recommend using the latest versions of TLS for secure communications, as SSL 3.0 is no longer considered secure.

As a security analyst, you are tasked with describing the concept of a "zero trust" security model in a cybersecurity context. Which of the following options BEST describes this concept?

• 1. Trusting all users, devices, and applications within the network by default.

• 1. Implementing strict access controls and continuously verifying trust for all users, devices, and applications, regardless of location.

• 1. Allowing open access to all network resources based on user roles and permissions.

• 1. Relying solely on firewalls and other perimeter defenses to protect against external threats.

Answer explanation

"Implementing strict access controls and continuously verifying trust for all users, devices, and applications, regardless of location". This option aligns with the principle of "never trust, always verify", which is the foundation of the zero trust model. It emphasizes the need for strict access control and continuous verification of credentials, rather than assuming trust based on the network's perimeter or the user's location.

In an asymmetric encryption system, if Bob wants to send a confidential message to Alice, which key should he use to encrypt the message?

• • Alice's private key

• • Bob's private key

• • Bob's public key

• • Alice's public key

Answer explanation

In asymmetric encryption systems, if Bob wants to send a confidential message to Alice, he should use Alice's public key to encrypt the message. This ensures that only Alice, who has the corresponding private key, can decrypt and read the message. The correct answer is:

• Alice's public key

Which of the following best describes a lattice-based access control model?

• • An access control model where permissions are determined by a user's role within an organization.

• • An access control model where permissions are tied to an object and the operations that can be performed on that object.

• • An access control model that utilizes a structure of security labels and clearances to determine access rights.

• • An access control model that allows users to determine permissions for their own files.

Answer explanation

An access control model that utilizes a structure of security labels and clearances to determine access rights.

This option is the definition of a lattice-based access control model, which uses a lattice of labels to represent the levels of information and the clearances users have, and allows the assignment of rights based on these levels.

You are a security professional working for a highly secure organization. Your team has been tasked with implementing an authorization mechanism that tightly controls data access in the environment. Which of the following authorization mechanisms would be BEST suited for this high-security environment?

• • Mandatory Access Control (MAC)

• • Role-Based Access Control (RBAC)

• • Attribute-Based Access Control (ABAC)

• • Discretionary Access Control (DAC)

Answer explanation

Mandatory Access Control (MAC).

MAC is an access control policy determined by a computer security policy that is used in the most secure environments. In MAC, access rights are assigned based on regulations from a central authority and cannot be altered by users. This control is mandatory in the sense that individual object owners cannot alter the access. It's typically used in environments that require a high level of security, such as military institutions or government agencies, where information classification and confidentiality are critical.

In the context of digital signatures and confidentiality, consider the following two scenarios:

1. Alice uses Bob's public key to encrypt a message. Bob uses his private key to decrypt the message.

2. Alice uses her private key to sign a message. Bob uses Alice's public key to verify the signature.

Which of the following statements is true?

• • Both scenarios ensure the confidentiality of the message.

• • Both scenarios ensure the authenticity of the message.

• • Scenario 1 ensures the confidentiality of the message, while Scenario 2 ensures the authenticity of the message.

• • Scenario 1 ensures the authenticity of the message, while Scenario 2 ensures the confidentiality of the message.

Answer explanation

• Scenario 1: Alice uses Bob's public key to encrypt a message. This means that only Bob, who has the corresponding private key, can decrypt and read the message. This ensures the confidentiality of the message because no one else can decrypt the message without Bob's private key.

• Scenario 2: Alice uses her private key to sign a message. This is a digital signature. Bob uses Alice's public key to verify the signature. This process ensures the authenticity of the message, confirming that the message was indeed sent by Alice and has not been altered in transit, as Alice's private key is required to create the signature, and anyone with Alice's public key can verify that the signature is valid.

Which access control model uses attributes such as user role, location, time, and risk score to make access control decisions?

• • Role-Based Access Control (RBAC)

• • Discretionary Access Control (DAC)

• • Mandatory Access Control (MAC)

• • Attribute-Based Access Control (ABAC)

In a network security setting, which of the following types of firewalls makes its decisions based on the state, context, and content of the traffic?

• • Packet-Filtering Firewall

• • Network Address Translation (NAT) Firewall

• • Stateful Inspection Firewall

• • Proxy Firewall