CISSP Practice Questions and Answers | CISSP Exam 2024 | CISSP Questions and Answers | CISSP Cert

Main Ideas and Concepts Covered

1) Access Control (Access Control Models)

Definition of Access Control

A security mechanism that determines:

• Who can access a resource
• What actions they can perform

It uses:

• Authentication: verifying identity
• Authorization: granting permissions

Core Example: Logging into Email

When you log into an email account:

• The system verifies identity (e.g., user ID/password)
• It checks what resources/actions you’re authorized for
• Permissions are enforced based on your account settings

Two Main Categories

DAC (Discretionary Access Control)

• Decision maker: resource owner/creator/data custodian
• Implemented using ACLs (Access Control Lists) listing permissions per resource
• Identity-based: permissions depend on user identity and owner discretion

Pros

• Flexible for owners to grant/deny access
• Fine-grained control
• Simpler and comparatively cost-effective

Cons

• Security risk if owners grant access to untrustworthy/malicious users
• Limited central control → inconsistent policies and hard management in large orgs

Non-DAC (Non-discretionary Access Control)

• Central authority manages access
• Based on policies and rules set by the authority

Pros

• Better security and consistency (predefined policies)
• Easier to manage and more scalable in large organizations

Cons

• Less flexible
• Can be complex due to centralized policy management

Other Non-DAC Models Mentioned

• RBAC (Role-Based Access Control)

  • Access is based on job roles
  • Permissions assigned to roles (often via groups)
  • Emphasizes least privilege
  • Reduces privilege creep by changing role membership instead of individual permissions

• Task-Based Access Control (TBAC)

  • Similar concept to RBAC, but permission is based on tasks

• Rule-Based Access Control

  • Decisions driven by global predefined rules
  • Example: firewalls filtering traffic by rules

• Attribute-Based Access Control (ABAC)

  • More granular than rule-based control
  • Uses attributes such as:
    • location, device type, time/working hours
  • Example: allow access only from a specific location (or only company laptops)

• MAC (Mandatory Access Control) (often label-based / “letters model”)

  • Used in high-security environments
  • Access determined by security labels
    • users have clearance labels
    • objects have sensitivity labels
  • Two variants:
    • Hierarchical model
      • Higher clearance grants access to its level and lower levels (not higher)
    • Compartmentalized model
      • Enforces need-to-know
      • Labels/clearances are isolated by compartments; access limited to required domains

• Risk-Based Access Control

  • Decisions consider context at login time, such as:
    • device trust/history
    • location
    • network/IP familiarity
    • sensitivity of the target resource
  • May require stronger proof (e.g., MFA/OTP or device registration)

Match-the-Following (Practice Outcomes)

• DAC → Identity-based
• RBAC → Group membership/roles
• Rule-based → Access Control Lists (ACL-related)
• MAC → Labels

---

2) Service Organization Control (SOC) Reports

SOC Meaning and Purpose

• SOC stands for: Service Organization Control
• Purpose: auditing service providers’ controls for customers/auditors

SOC Types and Type 1 vs Type 2

• Type 1
  • Evaluates that policies/procedures are designed and in place at a single point in time
• Type 2
  • Evaluates that controls are in place and operating effectively over time
  • Typically over ~6 consecutive months
• Key takeaway: Type 2 is more useful because it confirms operational effectiveness

SOC 1 / SOC 2 / SOC 3

• SOC 1

  • Focus: financial controls
  • Impacts customer financial statements

• SOC 2

  • Focus: Trust Services Criteria (AICPA)
  • Five trust principles:
    • Security (mandatory)
    • Availability (optional)
    • Processing Integrity (optional)
    • Confidentiality (optional)
    • Privacy (optional)

• SOC 3

  • Public-facing summary
  • Same scope/principles as SOC 2, but removes sensitive details
  • Mainly for marketing/seal of approval
  • Not detailed enough for security personnel

Practice Question Key Result

• SOC 1 Type 1 & Type 2 are both focused on financial controls

---

3) Core Security Questions (Encryption, Protocols, Controls)

Protect Data Even If Attacker Gains Access → Encryption

• Firewalls/sandboxing/access control can limit access
• But once data is obtained, encryption protects confidentiality without keys

Secure Web Communication → TLS/SSL

• SSL/TLS used for securing web traffic (encryption + authentication)

Cloud Confidentiality Algorithm → AES

• AES is chosen over options like WEP/3DES/RSA (commonly used for cloud data confidentiality)

Most Effective Control to Prevent Privilege Escalation

• MAC (strict label/rule enforcement)

MAC Spoofing Definition

• Changing/forging a network interface’s MAC address to impersonate another device
• Selected answer: “changing the physical address of a network interface to masquerade as a different device.”

---

4) IAAA: Identification, Authentication, Authorization, Auditing, Accountability

Definitions

• Identification: establishing identity (username/user ID/email)
• Authentication: verifying identity (password/PIN/token/biometrics/location-based factors)
  • Includes single-factor and multi-factor (must use different factor types)
• Authorization: determining what the identity can do (permissions/roles/groups)
• Auditing: logging/monitoring actions/events for detection and compliance
• Accountability: holding subjects accountable; tied to reviewing logs and ownership of actions/data
• Non-repudiation: achieved through the combined controls—users can’t deny actions due to evidence

Practice Question Mapping Outcome

• Identification → username
• Authentication → passphrase/password
• Authorization → user group
• Auditing → log files
• Accountability → owner of an event

---

5) Availability/Resilience Metrics & True Positives

MTBF

• MTBF = mean time between failures (average time between failures)

True Positive Example

• “Firewall blocks unpermitted traffic.”

When Not to Update BCP/DR Plan

• Chosen answer: when a disaster is declared (updates are not made at that moment)

---

6) DNS Concepts and Threats

DNS

• Resolves FQDN → IP address
• Uses UDP port 53

DNS Threats Described

• Footprinting: gathering DNS zone data (zone transfer/info)
• Shadowing: creating bogus subdomains
• Zone signing (DNSSEC): validating zone transfers using digital signatures
• Spoofing: cache poisoning / incorrect information used

Practice Matching Outcomes

• Shadowing → bogus subdomains
• Footprinting → gather DNS domain names/IPs
• Zone signing → validate zone transfers (digital signature)
• Spoofing → cache poisoning

---

7) Intellectual Property (IP) Protection

Types

• Copyright: protects expression of ideas (music, books, movies, etc.)
• Trademark: protects brands/logo/identifiers
• Patent: protects inventions/processes (new machines)
• Trade secrets: confidential business value (customer lists, formulas); can last indefinitely if kept secret

Practice Question Mapping

• customer list → trade secret
• brand/logo → trademark
• newly invented machine → patent
• music/draw movies → copyright

---

8) Threat Modeling Methods

STRIDE

Categories:

• Spoofing
• Tampering
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

PASTA

• Process for Attack Simulation and Threat Analysis
• 7 stages (business objectives → scope/assets → decomposition → threat analysis → vulnerability analysis → attack simulation → risk/impact + countermeasures)

DREAD

Risk rating (1–10) using:

• Damage
• Reproducibility
• Exploitability
• Affected users
• Discoverability

Risk is computed from these scores (as described in the subtitles).

“L L A W / DREAD comparison + SAFE CODE”

• SafeCode: secure software guidance/organization, not a threat model method

Practice Question Outcomes

• Option not verified by STRIDE: scenario involving budget impact from resource spinning (per subtitles selection logic)
• “Which cannot be used as an application threat model at ASM DREAD PASTA SAFE CODE?” → SafeCode

---

9) Risk Management and Risk Assessment (NIST SP 800-30 style)

Risk Assessment Types

• Qualitative: subjective likelihood/impact (high/medium/low)
  • Techniques: brainstorming, focus groups, interviews, Delphi method, etc.
• Quantitative: numeric/monetary; more objective
• Hybrid: combination of both

Quantitative Risk Formula Chain

• SLE (Single Loss Expectancy)
  • SLE = Asset Value × Exposure Factor
• ARO (Annualized Rate of Occurrence)
• ALE (Annualized Loss Expectancy)
  • ALE = SLE × ARO

Cost-benefit for safeguards

• Value of safeguard = (ALE before safeguard − ALE after safeguard) − cost of countermeasure

• If negative → not financially responsible (though may still be required legally/prudently)

Risk Response / Treatment Options

• Mitigate (reduce risk)
• Accept
• Transfer (insurance/SLA)
• Avoid (stop the risky activity)
• Ignore/reject: stated as not a valid option

Key Risk Terms

• Total risk vs residual risk vs secondary risk
• Residual risk remains after controls; risk cannot be eliminated entirely

---

10) Data Hiding Techniques (Privacy/De-identification)

AISC / Masking (subtitle wording)

Makes data less meaningful through methods such as:

• substitution (random/algorithmic)
• scrambling/shuffling
• deleting/nulling
• data masking (e.g., reveal only last 4 digits of SSN)
• static vs dynamic masking

Tokenization

• Replace sensitive data with tokens
• Store mapping securely
• Supports detokenization

Anonymization

• Remove both:
  • direct identifiers
  • indirect identifiers
• So individuals cannot be re-identified using other fields

Practice Outcome

• Best answer to “hiding data to prevent identifying specific individuals based on other data fields” → Anonymization

---

11) Zero Trust Model

Core Principle

Never trust, always verify

Access is not based on location/perimeter; every request is continuously evaluated.

Five Steps (as described)

1. Identify resources / inventory
2. Identify protect surface
3. Map data flows
4. Architect Zero Trust environments with mechanisms (e.g., JIT access, just enough access, encryption/tokenization, micro-segmentation)
5. Define dynamic policies and continuous monitoring (SIEM/SOAR-style coverage mentioned)

Practice Outcome

• “Not one of the steps” → prioritize the external network

---

12) TLS, Digital Signatures, and Network Access by Geography

TLS Has Two Protocol Components

• Handshake: negotiate algorithms/keys/authentication
• Record: protects actual data transfer (integrity/origin)

Digital Signatures

• Provide integrity, authenticity, non-repudiation
• Do not provide confidentiality (message isn’t encrypted in the described flow)

Geo-fencing

• Best solution for access control based on geographic borders/location

---

Speakers / Sources Featured

Speakers

• None explicitly named in the subtitles (only channel references like “hey guys welcome to Cy platter”).

Sources / Organizations Mentioned

• AICPA
• NIST
• SSAE 16
• SOC (Service Organization Control)
• ISO 1548 (as stated; likely intended as a Common Criteria reference)
• Common Criteria (CC)
• NIST SP 800-30
• SafeCode
• US military / government systems (used as an example for MAC)