CISSP Exam Cram, 5th edition

Published by Pearson IT Certification (August 10, 2021) © 2022
Michael Gregg

Title overview

Thoroughly updated to prepare candidates for the new exam, this book includes: 
  • Chapters that map directly to the exam objectives
  • Comprehensive foundational learning on all topics covered on the exam 
  • An extensive collection of practice questions (including two full exams) 
  • A state-of-the-art practice test engine that provides real-time practice and feedback 
  • Notes, tips, sidebars, cautions, test-taking strategies, and time-saving tips that make studying as effective and time-efficient as possible 
  • The Cram Sheet tear-out card including tips, acronyms, and memory joggers not available anywhere else--perfect for last-minute study 

Topics covered in this book include physical, network, applications, systems, and operations security; access control; cryptography; securing architecture and modeling; business continuity and disaster recovery; security forensics; security management practices; and much more.
  • Fully reflects the major the changes in the new CISSP exam
  • Designed to help candidates rapidly assess where they stand--and quickly master what they need to learn
  • Includes test-taking strategies, time-saving tips, Exam Notes, and two sample exams delivered by the state-of-the-art PCPT test engine
Updated for the new CISSP exam. 

Table of contents

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . . . . . 19

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

   Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

   Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

   Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

   Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . 24

   Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . . . . . . . . 26

   Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . . . . . . . . 26

   Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

   Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

   Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . . . . . 29

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

   Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

   Data Management: Determining and Maintaining Ownership.. . . . . . . 32

   Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

   Data Security, Protection, Sharing, and Dissemination.. . . . . . . . . . . . . 42

   Classifying Information and Supporting Asset Classification.. . . . . . . . . 47

   Asset Management and Governance.. . . . . . . . . . . . . . . . . . . . . . . . . 51

   Determining Data Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 55

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 66

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . . . . 69

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

   Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

   U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

   International Legal Systems and Laws.. . . . . . . . . . . . . . . . . . . . . . . . 72

   Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . . . . . . . . . . 74

   Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

   Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

   Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . . . . . . 107

   Managing Risk with the Supply Chain and Third Parties.. . . . . . . . . . . 110

   Identifying and Prioritizing Business Continuity

   Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

   Developing and Implementing Security Policy.. . . . . . . . . . . . . . . . . . 123

   Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

   Implementing Personnel Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130

   Security Education, Training, and Awareness.. . . . . . . . . . . . . . . . . . . 134

   Professional Ethics Training and Awareness.. . . . . . . . . . . . . . . . . . . . 137

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 148

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . . . . 151

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

   Secure Design Guidelines and Governance Principles.. . . . . . . . . . . . . 152

   Fundamental Concepts of Security Models. . . . . . . . . . . . . . . . . . . . . 158

   Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

   Common Formal Security Models. . . . . . . . . . . . . . . . . . . . . . . . . . . 179

   Product Security Evaluation Models.. . . . . . . . . . . . . . . . . . . . . . . . . 189

   System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

   Vulnerabilities of Security Architectures. . . . . . . . . . . . . . . . . . . . . . . 195

   Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

   Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

   Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

   Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

   Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

   Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

   Public Key Infrastructure and Key Management.. . . . . . . . . . . . . . . . . 225

   Integrity and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

   Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

   Site and Facility Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 240

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 246

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

CHAPTER 5: Communications and Network Security . . . . . . . . . . . . . 249

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

   Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

   Network Models and Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

   TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

   LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

   Communication Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

   Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

   Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

   WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

   Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

   Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . . . . . . . 296

   Securing Email Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . 296

   Securing Voice and Wireless Communications.. . . . . . . . . . . . . . . . . . 298

   Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . . . . . . 316

   Network Access Control Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321

   Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326

   Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . . . . . . 331

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 337

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338

CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . . . . 341

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

   Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . . . . . . . . . 344

   Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

   Identification, Authentication, and Authorization. . . . . . . . . . . . . . . . . 358

   Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378

   Authorization and Access Control Techniques. . . . . . . . . . . . . . . . . . . 382

   Centralized and Decentralized Access Control Models. . . . . . . . . . . . . 390

   Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 408

   Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . . . . . . . . . 410

CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . . . . . 411

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412

   Security Assessments and Penetration Test Strategies. . . . . . . . . . . . . . 412

   Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424

   Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . 427

   Network Security Threats and Attack Techniques.. . . . . . . . . . . . . . . . 431

   Access Control Threats and Attack Techniques.. . . . . . . . . . . . . . . . . . 438

   Social-Based Threats and Attack Techniques. . . . . . . . . . . . . . . . . . . . 443

   Malicious Software Threats and Attack Techniques.. . . . . . . . . . . . . . . 444

   Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452

   Disaster Recovery and Business Continuity.. . . . . . . . . . . . . . . . . . . . 458

   Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 464

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465

CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . . . . . . . . 467

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468

   Foundational Security Operations Concepts.. . . . . . . . . . . . . . . . . . . . 468

   Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

   Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477

   System Resilience, Fault Tolerance, and Recovery Controls.. . . . . . . . . 486

   Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 487

   Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . . . . . . . . . 493

   Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . 495

   Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502

   Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503

   Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505

   Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . . . . . . . . 505

   Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509

   Intrusion Detection and Prevention Systems. . . . . . . . . . . . . . . . . . . . 512

   Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513

   Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . . . . . . . . . 514

   The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . 521

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 555

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558

CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . . . . . 559

   Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560

   Integrating Security into the Development Lifecycle.. . . . . . . . . . . . . . 560

   Development Methodologies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573

   Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580

   Database Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582

   Programming Languages, Secure Coding Guidelines, and Standards.. . . 588

   Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599

   Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 603

   Need to Know More?.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605

Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607

Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621

Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635

Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651

Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667



9780137419555, TOC, 6/7/2021


Author bios

Michael Gregg has more than 20 years of experience in information security and risk management. He holds two associate's degrees, a bachelor's degree, and a master's degree. Some of the certifications he holds include CISSP, SSCP, MCSE, CTT+, A+, N+, Security+, CASP, CCNA, GSEC, CEH, CHFI, CEI, CISA, CISM, and CGEIT.


In addition to his experience performing security management, audits, and assessments, Gregg has authored or coauthored more than 25 books, including Certified Ethical Hacker Exam Prep (Que), CISSP Exam Cram 2 (Que), and Security Administrator Street Smarts (Sybex). He has testified before the U.S. Congress, his articles have been published on IT websites, and he has been sourced as an industry expert for CBS, ABC, CNN, Fox News, and the New York Times. He has created more than 15 security-related courses and training classes for various companies and universities. Although leading, building, and managing security programs is where he spends the bulk of his time, contributing to the written body of IT security knowledge is how Michael believes he can give something back to the community that has given him so much.

Loading...Loading...Loading...