CISSP Exam Questions & Answers

For an organization considering two-factor authentication for secure network access, the most secure option is smart card and biometrics. A smart card is a physical device that contains a microchip or a magnetic stripe that stores information, such as a digital certificate, a private key, or a personal identification number (PIN). A biometric is a physical or behavioral characteristic of a user that can be measured and compared, such as a fingerprint, a retina scan, a voice print, or a facial recognition. Smart card and biometrics are two different types of factors that can provide strong and reliable authentication for network access. A smart card can prove that the user has a valid credential or key, while a biometric can prove that the user is who they claim to be.Smart card and biometrics can prevent unauthorized or fraudulent access, as they are difficult to forge, copy, or share56Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6: Communication and Network Security, pp. 322-323;Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 4: Communication and Network Security, pp. 450-451.

Availability is a security principle that ensures that information and systems are accessible and usable by authorized parties when needed. Availability is one of the three components of the CIA triad, along with confidentiality and integrity. A security architect is assessing the availability of an application by reviewing its Recovery Point Objective (RPO), which is the maximum amount of data loss that is acceptable in the event of a disaster or disruption. The RPO determines how frequently the data should be backed up or replicated. The current design of having all of the application infrastructure located within one co-location data center poses a risk to the availability of the application, as it creates a single point of failure. If the data center suffers a power outage, a fire, a flood, or any other disaster, the application may not be able to meet its RPO of 15 minutes. The security architect may recommend adding another data center in a different location to provide redundancy and resilience for the application. The other options are not security principles, but rather related concepts or processes. Disaster recovery (DR) is the process of restoring the normal operations of an organization after a disaster or disruption. DR involves the implementation of a DR plan, which defines the roles, responsibilities, procedures, and resources for recovering the critical functions and systems of the organization. Redundancy is a technique that provides duplication or backup of information and systems to ensure availability and reliability. Redundancy can be implemented at different levels, such as data, hardware, software, network, or site. Business continuity (BC) is the process of ensuring the continuity of the essential functions and operations of an organization during and after a disaster or disruption. BC involves the implementation of a BC plan, which defines the scope, objectives, strategies, and actions for maintaining the business processes and services of the organization.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, pp. 17-18, 23-24;CISSP Practice Exam | Boson, Question 9

The highest priority in agile development is early and continuous delivery of software. Agile development is a type of software development methodology that is based on the principles of the Agile Manifesto, which values individuals and interactions, working software, customer collaboration, and responding to change. Agile development aims to deliver software products or services that meet the changing needs and expectations of the customers and stakeholders, by using an iterative, incremental, and collaborative approach. Agile development involves various methods or frameworks, such as Scrum, Kanban, or Extreme Programming. The highest priority in agile development is early and continuous delivery of software, as stated in the first principle of the Agile Manifesto: 'Our highest priority is to satisfy the customer through early and continuous delivery of valuable software.' Early and continuous delivery of software means that the software products or services are delivered to the customers or stakeholders in short and frequent cycles, rather than in long and infrequent cycles. Early and continuous delivery of software can help to improve the quality and value of the software products or services, by enabling faster feedback, validation, and verification of the software products or services, as well as by allowing more flexibility and adaptability to the changing requirements and preferences of the customers or stakeholders. Selecting appropriate coding language, managing costs of product delivery, or maximizing the amount of code delivered are not the highest priorities in agile development, as they are either more related to the technical, financial, or quantitative aspects of software development, rather than the customer-oriented or value-driven aspects of software development.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 21: Software Development Security, page 1155;CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 8: Software Development Security, Question 8.11, page 305.

A network security assessment is a process of evaluating the security posture of a network by identifying and analyzing vulnerabilities, threats, and risks. The results of the assessment can help measure how well the network controls are performing and where they need improvement.

B, C, and D are incorrect because they are not the main objectives or outcomes of a network security assessment. A penetration test is a type of security assessment that simulates an attack on the network, but it does not guarantee that the network will fail or succeed. The network may or may not be compliant to industry standards depending on the criteria and scope of the assessment. Not all unpatched vulnerabilities may be identified by the assessment, as some may be unknown or undetectable by the tools or methods used.

When implementing a secure wireless network, the option that supports authentication and authorization for individual client endpoints is Wi-Fi Protected Access 2 (WPA2) Enterprise. WPA2 is a security protocol that provides encryption and authentication for wireless networks, based on the IEEE 802.11i standard. WPA2 has two modes: Personal and Enterprise. WPA2 Personal uses a Pre-Shared Key (PSK) that is shared among all the devices on the network, and does not require a separate authentication server. WPA2 Enterprise uses an Extensible Authentication Protocol (EAP) that authenticates each device individually, using a username and password or a certificate, and requires a Remote Authentication Dial-In User Service (RADIUS) server or another authentication server. WPA2 Enterprise provides more security and granularity than WPA2 Personal, as it can support different levels of access and permissions for different users or groups, and can prevent unauthorized or compromised devices from joining the network. Temporal Key Integrity Protocol (TKIP), Wi-Fi Protected Access (WPA) Pre-Shared Key (PSK), and Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) are not the options that support authentication and authorization for individual client endpoints, as they are related to the encryption or integrity of the wireless data, not the identity or access of the wireless devices.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4, Communication and Network Security, page 506.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4, Communication and Network Security, page 522.