CISSP Exam Cram, 5th edition

Published by Pearson IT Certification (July 5, 2021) © 2022

  • Michael Gregg
Products list
$68.36 AUD

Price Reduced From: $75.96 AUD

Instant access
WOC – RETAIL EBOOK EDITION EXAM CRAM

Trust the best-selling Exam Cram series from Pearson IT Certification to help you learn, prepare, and practice for exam success. They are built with the objective of providing assessment, review, and practice to help ensure you are fully prepared for your certification exam.

  • Master updated (ISC)² CISSP exam topics
  • Assess your knowledge with chapter-opening quizzes
  • Review key concepts with exam preparation tasks

This is the eBook edition of the CISSP Exam Cram, 5th Edition. This eBook does not include access to the companion website with practice exam that comes with the print edition.

CISSP Exam Cram, 5th Edition presents you with an organized test preparation routine through the use of proven series elements and techniques. Extensive preparation tools include topic overviews, exam alerts, CramQuizzes, chapter-ending review questions, author notes and tips, an extensive glossary, flash cards, and the handy Cram Sheet tear-out: key facts in an easy-to-review format.


CISSP Exam Cram, 5th Edition, focuses specifically on the objectives for the CISSP exam introduced by (ISC)² in May 2021. It contains new or updated coverage of topics including asset retention, secure provisioning, crypto attacks, machine learning tools, threat hunting, risk-based access control, zero trust, SAML, SOAR, securing microservices, containers, and managed services, and more.

Internationally renowned cybersecurity expert Michael Gregg shares preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.


Well regarded for its level of detail, assessment features, comprehensive design scenarios, and challenging review questions and exercises, this study guide helps you master the concepts and techniques that will enable you to succeed on the exam the first time.

The study guide helps you master all the topics on all eight domains of the (ISC)² CISSP exam, including:


  • Security and Risk Management
  • Asset Security
  • Security Architecture and Engineering
  • Communication and Network Security
  • Identity and Access Management (IAM)
  • Security Assessment and Testing
  • Security Operations
  • Software Development Security
   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . . . . . 19

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

   Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

   Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

   Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

   Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . 24

   Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . . . . . . . . 26

   Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . . . . . . . . 26

   Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

   Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

   Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . . . . . 29

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

   Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

   Data Management: Determining and Maintaining Ownership.. . . . . . . 32

   Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

   Data Security, Protection, Sharing, and Dissemination.. . . . . . . . . . . . . 42

   Classifying Information and Supporting Asset Classification.. . . . . . . . . 47

   Asset Management and Governance.. . . . . . . . . . . . . . . . . . . . . . . . . 51

   Determining Data Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 55

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 66

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . . . . 69

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

   Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

   U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

   International Legal Systems and Laws.. . . . . . . . . . . . . . . . . . . . . . . . 72

   Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . . . . . . . . . . 74

   Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

   Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

   Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . . . . . . 107

   Managing Risk with the Supply Chain and Third Parties.. . . . . . . . . . . 110

   Identifying and Prioritizing Business Continuity

   Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

   Developing and Implementing Security Policy.. . . . . . . . . . . . . . . . . . 123

   Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

   Implementing Personnel Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130

   Security Education, Training, and Awareness.. . . . . . . . . . . . . . . . . . . 134

   Professional Ethics Training and Awareness.. . . . . . . . . . . . . . . . . . . . 137

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 148

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . . . . 151

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

   Secure Design Guidelines and Governance Principles.. . . . . . . . . . . . . 152

   Fundamental Concepts of Security Models. . . . . . . . . . . . . . . . . . . . . 158

   Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

   Common Formal Security Models. . . . . . . . . . . . . . . . . . . . . . . . . . . 179

   Product Security Evaluation Models.. . . . . . . . . . . . . . . . . . . . . . . . . 189

   System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

   Vulnerabilities of Security Architectures. . . . . . . . . . . . . . . . . . . . . . . 195

   Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

   Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

   Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

   Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

   Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

   Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

   Public Key Infrastructure and Key Management.. . . . . . . . . . . . . . . . . 225

   Integrity and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

   Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

   Site and Facility Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 240

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 246

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

CHAPTER 5: Communications and Network Security . . . . . . . . . . . . . 249

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

   Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

   Network Models and Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

   TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

   LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

   Communication Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

   Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

   Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

   WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

   Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

   Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . . . . . . . 296

   Securing Email Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . 296

   Securing Voice and Wireless Communications.. . . . . . . . . . . . . . . . . . 298

   Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . . . . . . 316

   Network Access Control Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321

   Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326

   Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . . . . . . 331

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 337

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338

CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . . . . 341

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

   Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . . . . . . . . . 344

   Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

   Identification, Authentication, and Authorization. . . . . . . . . . . . . . . . . 358

   Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378

   Authorization and Access Control Techniques. . . . . . . . . . . . . . . . . . . 382

   Centralized and Decentralized Access Control Models. . . . . . . . . . . . . 390

   Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 408

   Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . . . . . . . . . 410

CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . . . . . 411

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412

   Security Assessments and Penetration Test Strategies. . . . . . . . . . . . . . 412

   Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424

   Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . 427

   Network Security Threats and Attack Techniques.. . . . . . . . . . . . . . . . 431

   Access Control Threats and Attack Techniques.. . . . . . . . . . . . . . . . . . 438

   Social-Based Threats and Attack Techniques. . . . . . . . . . . . . . . . . . . . 443

   Malicious Software Threats and Attack Techniques.. . . . . . . . . . . . . . . 444

   Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452

   Disaster Recovery and Business Continuity.. . . . . . . . . . . . . . . . . . . . 458

   Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 464

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465

CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . . . . . . . . 467

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468

   Foundational Security Operations Concepts.. . . . . . . . . . . . . . . . . . . . 468

   Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

   Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477

   System Resilience, Fault Tolerance, and Recovery Controls.. . . . . . . . . 486

   Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 487

   Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . . . . . . . . . 493

   Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . 495

   Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502

   Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503

   Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505

   Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . . . . . . . . 505

   Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509

   Intrusion Detection and Prevention Systems. . . . . . . . . . . . . . . . . . . . 512

   Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513

   Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . . . . . . . . . 514

   The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . 521

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 555

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558

CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . . . . . 559

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560

   Integrating Security into the Development Lifecycle.. . . . . . . . . . . . . . 560

   Development Methodologies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573

   Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580

   Database Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582

   Programming Languages, Secure Coding Guidelines, and Standards.. . . 588

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 603

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605

Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607

Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621

Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635

Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651

Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667



9780137419555, TOC, 6/7/2021


Need help? Get in touch