Switch content of the page by the Role togglethe content would be changed according to the role
CISSP Exam Cram, 5th edition
Published by Pearson IT Certification (July 5, 2021) © 2022
- Michael Gregg
$47.99
Buy nowOpens in a new tab
Sold by InformIT and ebook resellers
Available for purchase from all major ebook resellers, including InformIT.com
$39.99
Price Reduced From: $49.99
Details
- A print text
- Free shipping
- Also available for purchase as an ebook from all major ebook resellers, including InformIT.com
Thoroughly updated to prepare candidates for the new exam, this book includes:Â
- Chapters that map directly to the exam objectives
- Comprehensive foundational learning on all topics covered on the examÂ
- An extensive collection of practice questions (including two full exams)Â
- A state-of-the-art practice test engine that provides real-time practice and feedbackÂ
- Notes, tips, sidebars, cautions, test-taking strategies, and time-saving tips that make studying as effective and time-efficient as possibleÂ
- The Cram Sheet tear-out card including tips, acronyms, and memory joggers not available anywhere else--perfect for last-minute studyÂ
Topics covered in this book include physical, network, applications, systems, and operations security; access control; cryptography; securing architecture and modeling; business continuity and disaster recovery; security forensics; security management practices; and much more.
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . . . . . 19
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
  Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
  Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
  Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
  Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . 24
  Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . . . . . . . . 26
  Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . . . . . . . . 26
  Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
  Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
  Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . . . . . 29
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
  Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
  Data Management: Determining and Maintaining Ownership.. . . . . . . 32
  Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
  Data Security, Protection, Sharing, and Dissemination.. . . . . . . . . . . . . 42
  Classifying Information and Supporting Asset Classification.. . . . . . . . . 47
  Asset Management and Governance.. . . . . . . . . . . . . . . . . . . . . . . . . 51
  Determining Data Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 55
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 66
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . . . . 69
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
  Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
  U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
  International Legal Systems and Laws.. . . . . . . . . . . . . . . . . . . . . . . . 72
  Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . . . . . . . . . . 74
  Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
  Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
  Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . . . . . . 107
  Managing Risk with the Supply Chain and Third Parties.. . . . . . . . . . . 110
  Identifying and Prioritizing Business Continuity
  Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
  Developing and Implementing Security Policy.. . . . . . . . . . . . . . . . . . 123
  Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
  Implementing Personnel Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130
  Security Education, Training, and Awareness.. . . . . . . . . . . . . . . . . . . 134
  Professional Ethics Training and Awareness.. . . . . . . . . . . . . . . . . . . . 137
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 148
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . . . . 151
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
  Secure Design Guidelines and Governance Principles.. . . . . . . . . . . . . 152
  Fundamental Concepts of Security Models. . . . . . . . . . . . . . . . . . . . . 158
  Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
  Common Formal Security Models. . . . . . . . . . . . . . . . . . . . . . . . . . . 179
  Product Security Evaluation Models.. . . . . . . . . . . . . . . . . . . . . . . . . 189
  System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
  Vulnerabilities of Security Architectures. . . . . . . . . . . . . . . . . . . . . . . 195
  Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
  Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
  Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
  Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
  Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
  Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
  Public Key Infrastructure and Key Management.. . . . . . . . . . . . . . . . . 225
  Integrity and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
  Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
  Site and Facility Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 240
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 246
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
CHAPTER 5: Communications and Network Security . . . . . . . . . . . . . 249
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
  Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
  Network Models and Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
  TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
  LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
  Communication Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
  Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
  Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
  WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
  Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
  Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . . . . . . . 296
  Securing Email Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . 296
  Securing Voice and Wireless Communications.. . . . . . . . . . . . . . . . . . 298
  Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . . . . . . 316
  Network Access Control Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321
  Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
  Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . . . . . . 331
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 337
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . . . . 341
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
  Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . . . . . . . . . 344
  Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
  Identification, Authentication, and Authorization. . . . . . . . . . . . . . . . . 358
  Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
  Authorization and Access Control Techniques. . . . . . . . . . . . . . . . . . . 382
  Centralized and Decentralized Access Control Models. . . . . . . . . . . . . 390
  Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 408
  Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . . . . . . . . . 410
CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . . . . . 411
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412
  Security Assessments and Penetration Test Strategies. . . . . . . . . . . . . . 412
  Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424
  Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . 427
  Network Security Threats and Attack Techniques.. . . . . . . . . . . . . . . . 431
  Access Control Threats and Attack Techniques.. . . . . . . . . . . . . . . . . . 438
  Social-Based Threats and Attack Techniques. . . . . . . . . . . . . . . . . . . . 443
  Malicious Software Threats and Attack Techniques.. . . . . . . . . . . . . . . 444
  Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
  Disaster Recovery and Business Continuity.. . . . . . . . . . . . . . . . . . . . 458
  Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 464
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . . . . . . . . 467
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468
  Foundational Security Operations Concepts.. . . . . . . . . . . . . . . . . . . . 468
  Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
  Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
  System Resilience, Fault Tolerance, and Recovery Controls.. . . . . . . . . 486
  Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 487
  Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . . . . . . . . . 493
  Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . 495
  Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502
  Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503
  Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
  Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . . . . . . . . 505
  Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509
  Intrusion Detection and Prevention Systems. . . . . . . . . . . . . . . . . . . . 512
  Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
  Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . . . . . . . . . 514
  The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 555
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . . . . . 559
  Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
  Integrating Security into the Development Lifecycle.. . . . . . . . . . . . . . 560
  Development Methodologies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573
  Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
  Database Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582
  Programming Languages, Secure Coding Guidelines, and Standards.. . . 588
  Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
  Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 603
  Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607
Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621
Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651
Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
9780137419555, TOC, 6/7/2021
Need help? Get in touch