CISSP exam questions for practice in 2022 Updated 990 Questions [Q95-Q116]

Client/Server services allocate computing power resources among workstations with some shared resources centralized in servers.
For example, if you are using a product that is working in a client/ server model, in reality you have a small piece of the product on your computer (client portion) and the larger piece of the software product is running on a different computer (server portion). The communication between these two pieces of the same software product needs to be controlled, which is why session layer protocols even exist. Session layer protocols take on the functionality of middleware, which allows software on two different computers to communicate.
Distributed systems are the opposite of centralized systems like mainframes and thin client implementations. Traditional client/server architectures are the most common example of a distributed system. In a traditional client/server architecture, responsibilities for processing have been balanced between centralized servers providing services to multiple clients and client machines that focus on user interaction and standalone processing where appropriate. For the most part, servers are responsible for serving, meaning that they provide services that will be leveraged by the clients in the environment. Clients are the primary consumers of server services, while also hosting services of their own primarily for their own individual use.
Reference used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 524). McGraw-
Hill. Kindle Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 18741-18745). Auerbach Publications. Kindle
Edition.
and
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 100

Retina based biometric involves analyzing the layer of blood vessels situated at the back of the eye.
An established technology, this technique involves using a low-intensity light source through an optical coupler to scan the unique patterns of the retina. Retinal scanning can be quite accurate but does require the user to look into a receptacle and focus on a given point. This is not particularly convenient if you wear glasses or are concerned about having close contact with the reading device. For these reasons, retinal scanning is not warmly accepted by all users, even though the technology itself can work well.
For your exam you should know the information below: Biometrics Biometrics verifies an individual’s identity by analyzing a unique personal attribute or behavior, which is one of the most effective and accurate methods of verifying identification and not well received by society. Biometrics is a very sophisticated technology; thus, it is much more expensive and complex than the other types of identity verification processes. A biometric system can make authentication decisions based on an individual’s behavior, as in signature dynamics, but these can change over time and possibly be forged. Biometric systems that base authentication decisions on physical attributes (such as iris, retina, or fingerprint) provide more accuracy because physical attributes typically don’t change, absent some disfiguring injury, and are harder to impersonate
Biometrics is typically broken up into two different categories. The first is the physiological. These are traits that are physical attributes unique to a specific individual. Fingerprints are a common example of a physiological trait used in biometric systems. The second category of biometrics is known as behavioral. The behavioral authentication is also known as continuous authentication.
The behavioral/continuous authentication prevents session hijacking attack. This is based on a characteristic of an individual to confirm his identity. An example is signature Dynamics. Physiological is “what you are” and behavioral is “what you do.”
When a biometric system rejects an authorized individual, it is called a Type I error (false rejection rate). When the system accepts impostors who should be rejected, it is called a Type II error (false acceptance rate). The goal is to obtain low numbers for each type of error, but Type II errors are the most dangerous and thus the most important to avoid. When comparing different biometric systems, many different variables are used, but one of the most important metrics is the crossover error rate (CER). This rating is stated as a percentage and represents the point at which the false rejection rate equals the false acceptance rate. This rating is the most important measurement when determining the system’s accuracy. A biometric system that delivers a CER of 3 will be more accurate than a system that delivers a CER of 4. Crossover error rate (CER) is also called equal error rate (EER).
Throughput describes the process of authenticating to a biometric system. This is also referred to as the biometric system response time. The primary consideration that should be put into the purchasing and implementation of biometric access control are user acceptance, accuracy and processing speed.
Biometric Considerations In addition to the access control elements of a biometric system, there are several other considerations that are important to the integrity of the control environment. These are: Resistance to counterfeiting Data storage requirements User acceptance Reliability and Target User and approach
Fingerprint Fingerprints are made up of ridge endings and bifurcations exhibited by friction ridges and other detailed characteristics called minutiae. It is the distinctiveness of these minutiae that gives each individual a unique fingerprint. An individual places his finger on a device that reads the details of the fingerprint and compares this to a reference file. If the two match, the individual’s identity has been verified.
Palm Scan The palm holds a wealth of information and has many aspects that are used to identify an individual. The palm has creases, ridges, and grooves throughout that are unique to a specific person. The palm scan also includes the fingerprints of each finger. An individual places his hand on the biometric device, which scans and captures this information. This information is compared to a reference file, and the identity is either verified or rejected.
Hand Geometry The shape of a person’s hand (the shape, length, and width of the hand and fingers) defines hand geometry. This trait differs significantly between people and is used in some biometric systems to verify identity. A person places her hand on a device that has grooves for each finger. The system compares the geometry of each finger, and the hand as a whole, to the information in a reference file to verify that person’s identity.
Retina Scan A system that reads a person’s retina scans the blood-vessel pattern of the retina on the backside of the eyeball. This pattern has shown to be extremely unique between different people. A camera is used to project a beam inside the eye and capture the pattern and compare it to a reference file recorded previously.
Iris Scan An iris scan is a passive biometric control The iris is the colored portion of the eye that surrounds the pupil. The iris has unique patterns, rifts, colors, rings, coronas, and furrows. The uniqueness of each of these characteristics within the iris is captured by a camera and compared with the information gathered during the enrollment phase. When using an iris pattern biometric system, the optical unit must be positioned so the sun does not shine into the aperture; thus, when implemented, it must have proper placement within the facility.
Signature Dynamics When a person signs a signature, usually they do so in the same manner and speed each time. Signing a signature produces electrical signals that can be captured by a biometric system. The physical motions performed when someone is signing a document create these electrical signals. The signals provide unique characteristics that can be used to distinguish one individual from another. Signature dynamics provides more information than a static signature, so there are more variables to verify when confirming an individual’s identity and more assurance that this person is who he claims to be.
Keystroke Dynamics Whereas signature dynamics is a method that captures the electrical signals when a person signs a name, keystroke dynamics captures electrical signals when a person types a certain phrase. As a person types a specified phrase, the biometric system captures the speed and motions of this action. Each individual has a certain style and speed, which translate into unique signals. This type of authentication is more effective than typing in a password, because a password is easily obtainable. It is much harder to repeat a person’s typing style than it is to acquire a password.
Voice Print
People’s speech sounds and patterns have many subtle distinguishing differences. A biometric
system that is programmed to capture a voice print and compare it to the information held in a
reference file can differentiate one individual from another. During the enrollment process, an
individual is asked to say several different words.
Facial Scan
A system that scans a person’s face takes many attributes and characteristics into account.
People have different bone structures, nose ridges, eye widths, forehead sizes, and chin shapes.
These are all captured during a facial scan and compared to an earlier captured scan held within a
reference record. If the information is a match, the person is positively identified.
Hand Topography
Whereas hand geometry looks at the size and width of an individual’s hand and fingers, hand
topology looks at the different peaks and valleys of the hand, along with its overall shape and
curvature. When an individual wants to be authenticated, she places her hand on the system. Off
to one side of the system, a camera snaps a side-view picture of the hand from a different view
and angle than that of systems that target hand geometry, and thus captures different data. This
attribute is not unique enough to authenticate individuals by itself and is commonly used in
conjunction with hand geometry.
Vascular Scan
Valcular Scan uses the blood vessel under the first layer of skin.
The following answers are incorrect:
Fingerprint – Fingerprints are made up of ridge endings and bifurcations exhibited by friction ridges
and other detailed characteristics called minutiae. It is the distinctiveness of these minutiae that
gives each individual a unique fingerprint. An individual places his finger on a device that reads the
details of the fingerprint and compares this to a reference file. If the two match, the individual’s
identity has been verified.
Hand Geometry – The shape of a person’s hand (the shape, length, and width of the hand and
fingers) defines hand geometry. This trait differs significantly between people and is used in some
biometric systems to verify identity. A person places her hand on a device that has grooves for
each finger. The system compares the geometry of each finger, and the hand as a whole, to the
information in a reference file to verify that person’s identity.
Palm Scan – The palm holds a wealth of information and has many aspects that are used to
identify an individual. The palm has creases, ridges, and grooves throughout that are unique to a
specific person. The palm scan also includes the fingerprints of each finger. An individual places
his hand on the biometric device, which scans and captures this information. This information is
compared to a reference file, and the identity is either verified or rejected.
Following reference(s) were/was used to create this question: CISA review manual 2014 Page number 330 and 331 Official ISC2 guide to CISSP CBK 3rd Edition Page number 924

Confidentiality supports the principle of “least privilege” by providing that only authorized individuals, processes, or systems should have access to information on a need-toknow basis. The level of access that an authorized individual should have is at the level necessary for them to do their job. In recent years, much press has been dedicated to the privacy of information and the need to protect it from individuals, who may be able to commit crimes by viewing the information.
Identity theft is the act of assuming one’s identity through knowledge of confidential information obtained from various sources.
An important measure to ensure confidentiality of information is data classification. This helps to determine who should have access to the information (public, internal use only, or confidential). Identification, authentication, and authorization through access controls are practices that support maintaining the confidentiality of information.
A sample control for protecting confidentiality is to encrypt information. Encryption of information limits the usability of the information in the event it is accessible to an unauthorized person.
For your exam you should know the information below:
Integrity Integrity is the principle that information should be protected from intentional, unauthorized, or accidental changes.
Information stored in files, databases, systems, and networks must be relied upon to accurately process transactions and provide accurate information for business decision making. Controls are put in place to ensure that information is modified through accepted practices.
Sample controls include management controls such as segregation of duties, approval checkpoints in the systems development life cycle, and implementation of testing practices that assist in providing information integrity. Well-formed transactions and security of the update programs provide consistent methods of applying changes to systems. Limiting update access to those individuals with a need to access limits the exposure to intentional and unintentional modification.
Availability Availability is the principle that ensures that information is available and accessible to users when needed.
The two primary areas affecting the availability of systems are:
1.Denial-of-Service attacks and
2.Loss of service due to a disaster, which could be man-made (e.g., poor capacity planning resulting in system crash, outdated hardware, and poor testing resulting in system crash after upgrade) or natural (e.g., earthquake, tornado, blackout, hurricane, fire, and flood).
In either case, the end user does not have access to information needed to conduct business. The
criticality of the system to the user and its importance to the survival of the organization will
determine how significant the impact of the extended downtime becomes. The lack of appropriate
security controls can increase the risk of viruses, destruction of data, external penetrations, or
denial-of-service (DOS) attacks. Such events can prevent the system from being used by normal
users.
CIA
The following answers are incorrect:
Integrity – Integrity is the principle that information should be protected from intentional,
unauthorized, or accidental changes.
Availability – Availability is the principle that ensures that information is available and accessible to
users when needed.
Accuracy – Accuracy is not a valid CIA attribute.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 314
Official ISC2 guide to CISSP CBK 3rd Edition Page number 350
Topic 4, Software Development Security

100BaseTX is a 100-Mbps baseband Fast Ethernet specification using two pairs of either UTP or STP wiring. The first pair of wires is used to receive data; the second is used to transmit. To guarantee proper signal timing, a 100BaseTX segment cannot exceed 100 meters in length. This specification of Ethernet is based on the IEEE 802.3 standard.

Line supervision is the monitoring of the
alarm signaling transmission medium to detect tampering. Audio
detectors monitor a room for any abnormal sound wave generation.
Photoelectric sensors receive a beam of light from a light-emitting
device. Wave pattern motion detectors generate a wave pattern and
send an alarm if the pattern is disturbed.

Explanation
Section: Security Assessment and Testing

The Trusted Computing Base (TCB) The totality of protection mechanisms within a computer system, including hardware, firmware, and software, the combination of which is responsible for enforcing a security policy. A TCB consists of one or more components that together enforce a unified security policy over a product or system. The ability of a trusted computing base to correctly enforce a security policy depends solely on the mechanisms within the TCB and on the correct input by system administrative personnel of parameters (e.g., a users clearance) related to the security policy. *Answer “A computer that controls all access to objects by subjects” describes the reference monitor concept. The reference monitor is an access control concept that refers to an abstract machine that mediates all accesses to objects by subjects. The Security Kernel consists of the hardware, firmware, and software elements of a Trusted Computing Base (or Network Trusted Computing Base partition) that implement the reference monitor concept. It must mediate all accesses, be protected from modification, and be verifiable as correct. *Answer “A piece of information that represents the security level of an object” refers to a sensitivity label. Asensitivity label is a piece of information that represents the extra security level of an object and describes the sensitivity (e.g., classification) of the data in the object. Sensitivity labels are used by the TCB as the basis for mandatory access control decisions. *Answer “Formal proofs used to demonstrate the consistency between a systems specification and a security model” describes formal verification. This is the process of using formal proofs to demonstrate the consistency (design verification) between a formal specification of a system and a formal security policy model or (implementation verification) between the formal specification and its program implementation. Source: DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria

Physcial: This is a type of security control, but does not have an alternate name.
Administrative: This is a type of security control, but doe not have an alternate name.
Risk:This is not a type of security control.
The following reference(s) were/was used to create this question:
Shon Harris AIO 4th Edition, Chapter 3, Page 57

Ethernet bus topology was the first commercially viable network
topology, and consists of all workstations connected to a single coaxial cable. Since the cable must be properly terminated on both ends, a break in the cable stops all communications on the bus.
* the physical star topology acts like a logical bus, but provides better fault tolerance, as a cable break only disconnects the workstation or hub directly affected.
* logical ring topology, is used by Token Ring and FDDI and is highly resilient. Token Ring employs a beacon frame, which, in case of a cable break, initiates auto reconfiguration and attempts to reroute the network around the failed mode. Also, the Token Ring active monitor station performs ring maintenance
functions, like removing continuously circulating frames from the
ring. FDDI employs a second ring to provide redundancy. Sources:
Virtual LANs by Mariana Smith (McGraw-Hill, 1998) and Internetworking
Technologies Handbook, Second Edition (Cisco Press, 1998).

Explanation/Reference:
Explanation:
Encrypted network packets present the biggest threat to an effective IDS/IPS plan because the network traffic cannot easily be decoded and examined.
Encrypted packets cannot be examined by the IDS to determine if there is a threat there so in most cases the traffic is just forwarded along with the potential threat.
There is an industry where a company provides examination services for your network traffic, acting like a proxy server for all your network traffic.
You simply send them copies of your certificates so they can decode the traffic. This is common in the financial industry where violating federal law or being sued by federal investigators for insider trading can lead to business collapse.
The external company examines all the network traffic coming and going from your network for potential liabilities.
Incorrect Answers:
B: Complex IDS/IPS Signature syntax: IDS/IPS signatures can be complex but this is not the MOST significant threat to the functionality of an IDS/IPS system.
C: Digitally Signed Network Packets: This is not threat to IDS/IPS systems looking for dangerous network traffic.
D: Segregated VLANs are only a threat if the IDS/IPS system is not monitoring traffic on the segregated VLAN. VLANs can present barriers to IDS/IPS systems spotting dangerous traffic. There is an easy solution to VLANs and IDS/IPS systems and that would be simply placing an IDS/IPS sensor on that VLAN and set it up to send its traffic to the IDS/IPS management system.

Explanation/Reference:
Explanation:
RAID Level 1 is commonly called mirroring. It mirrors the data from one disk or set of disks by duplicating the data onto another disk or set of disks. This is often implemented by a one-for-one disk to disk ratio:
Each drive is mirrored to an equal drive partner that is continually being updated with current data. If one drive fails, the system automatically gets the data from the other drive. The main issue with this level of RAID is that the one-for-one ratio is very expensive – resulting in the highest cost per megabyte of data capacity. This level effectively doubles the amount of hard drives you need, therefore it is usually best for smaller capacity systems.
Incorrect Answers:
B: RAID level 0 is not implemented by a one-for-one disk to disk ratio.
C: RAID level 2 is not implemented by a one-for-one disk to disk ratio.
D: RAID level 5 is not implemented by a one-for-one disk to disk ratio.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, 2nd Edition, Wiley Publishing, Indianapolis, 2004, p. 144

The principle of accountability has been described in many references; it is a principle by which specific action can be traced back to an individual. As mentioned by Idrach, any significant action should be traceable to a specific user. The definition of “Significant” is entirely dependant on your business circumstances and risk management model. It was also mentioned by Rino that tracing the actions of a specific user is fine but we must also be able to ascertain that this specific user was responsible for the uninitiated action.

RBAC – This type of model provides access to resources based on the role the users holds within the company or the tasks that user has been assigned. – Shon Harris All-in-one CISSP Certification Guide pg 937 Rule-based access control is a type of mandatory access control because rules determine this access (such as the correspondence of clearances labels to classification labels), rather than the identity of the subjects and objects alone. . -Ronald Krutz The CISSP PREP Guide (gold edition) pg 45-46

If any server in the cluster crashes, processing continues transparently, however, the cluster suffers some performance degradation. This implementation is sometimes called a “server farm.”
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 67.

Explanation/Reference:
Explanation:
Preventative Controls. In the Operations Security domain, preventative controls are designed to achieve two things – to lower the amount and impact of unintentional errors that are entering the system, and to prevent unauthorized intruders from internally or externally accessing the system. An example of these controls might be pre-numbered forms, or a data validation and review procedure to prevent duplications.
Incorrect Answers:
A: Detective controls are used to detect an error once it has occurred; they do not prevent unauthorized intruders from internally or externally accessing the system.
C: Corrective controls are implemented to help mitigate the impact of a loss event through data recovery procedures. They do not prevent unauthorized intruders from internally or externally accessing the system.
D: Directive controls are administrative instruments such as policies, procedures, guidelines, and agreements. They do not prevent unauthorized intruders from internally or externally accessing the system.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, 2nd Edition, Wiley Publishing, Indianapolis, 2004, p. 217.

The site might not have the capacity to handle the operations required during a major disruptive event. While mutual aid might be a good system for sharing resources during a small or isolated outage, a major natural or other type of disaster can
create serious resource contention between the two organizations.

All hosts on a network have a logical ID that is called an IP address. An IP address is a numeric identifier that is assigned to each machine on an IP network. It designates the location of a device on a network. A MAC address is typically called a hardware address because it is “burned” into the NIC card. TCP address and Datagram address are imposter answers.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 87.

The order of acceptance has slightly changed in the past years. It was Iris that was the most accepted method three years ago but today we have Voice Pattern that is by far the most accepted. Here is the list from most accepted first to least accepted at the bottom of the list: Voice Pattern Keystroke pattern Signature Hand geometry Handprint Fingerprint Iris Retina pattern

Section: Security Operations
Explanation/Reference: http://www.manchester.gov.uk/info/200039/emergencies/6174/business_continuity_planning/5