CISSP Passport 1st Edition Bobby E.

Rogers
Visit to download the full and correct content document:
https://ebookmass.com/product/cissp-passport-1st-edition-bobby-e-rogers/
More products digital (pdf, epub, mobi) instant
download maybe you interests ...

CISSP Passport 1st Edition Bobby E. Rogers

https://ebookmass.com/product/cissp-passport-1st-edition-bobby-e-
rogers/

CompTIA CySA+ Cybersecurity Analyst Certification

Passport (Exam CS0-002) Bobby E. Rogers

https://ebookmass.com/product/comptia-cysa-cybersecurity-analyst-
certification-passport-exam-cs0-002-bobby-e-rogers/

CRISC Certified in Risk and Information Systems Control

All-in-One Exam Guide, Second Edition, 2nd Edition
Peter H. Gregory & Bobby E. Rogers & Dawn Dunkerley

https://ebookmass.com/product/crisc-certified-in-risk-and-
information-systems-control-all-in-one-exam-guide-second-
edition-2nd-edition-peter-h-gregory-bobby-e-rogers-dawn-
dunkerley/

Understanding Urbanism 1st ed. Edition Dallas Rogers

https://ebookmass.com/product/understanding-urbanism-1st-ed-
edition-dallas-rogers/
Temporalities, Texts, Ideologies Bobby Xinyue

https://ebookmass.com/product/temporalities-texts-ideologies-
bobby-xinyue/

Entrepreneurial Finance 4th Edition Steven Rogers

https://ebookmass.com/product/entrepreneurial-finance-4th-
edition-steven-rogers/

CISSP Exam Certification Companion: 1000+ Practice

Questions and Expert Strategies for Passing the CISSP
Exam (Certification Study Companion Series) 1st Edition
Bouke
https://ebookmass.com/product/cissp-exam-certification-
companion-1000-practice-questions-and-expert-strategies-for-
passing-the-cissp-exam-certification-study-companion-series-1st-
edition-bouke/

CISSP Practice Exams, Fourth Edition Shon Harris

https://ebookmass.com/product/cissp-practice-exams-fourth-
edition-shon-harris/

The Promise of Bitcoin Bobby C. Lee

https://ebookmass.com/product/the-promise-of-bitcoin-bobby-c-lee/
Mike Meyers’

A+
CISSP
CompTIA ® ®

CERTIFICATION
PASSPORT
PASSPORT SEVENTH
(Exams 220-1001 & 220-1002) EDITION
About the Author

Bobby Rogers (he/his/him) is a cybersecurity proessional with over 30 years in the inor-
mation technology and cybersecurity ields. He currently works with a major engineering
company in Huntsville, Alabama, helping to secure networks and manage cyber risk or its
customers. Bobby’s customers include the U.S. Army, NASA, the State o ennessee, and
private/commercial companies and organizations. His specialties are cybersecurity engineer-
ing, security compliance, and cyber risk management, but he has worked in almost every area
o cybersecurity, including network deense, computer orensics and incident response, and
penetration testing.
Bobby is a retired Master Sergeant rom the U.S. Air Force, having served or over 21 years.
He has built and secured networks in the United States, Chad, Uganda, South Arica, Germany,
Saudi Arabia, Pakistan, Aghanistan, and several other remote locations. His decorations
include two Meritorious Service medals, three Air Force Commendation medals, the National
Deense Service medal, and several Air Force Achievement medals. He retired rom active
duty in 2006.
Bobby has a master o science in inormation assurance and a bachelor o science in
computer inormation systems (with a dual concentration in Russian language), and two
associate o science degrees. His many certiications include CISSP-ISSEP, CRISC, CySA+,
CEH, and MCSE: Security.
Bobby has narrated and produced over 30 computer training videos or several training
companies and currently produces them or Pluralsight (https://www.pluralsight.com). He
is also the author o CompTIA Mobility+ All-in-One Exam Guide (Exam MB0-001), CRISC
Certiied in Risk and Inormation Systems Control All-in-One Exam Guide, and Mike Meyers’
CompTIA Security+ Certiication Guide (Exam SY0-401), and is the contributing author/
technical editor or the popular CISSP All-in-One Exam Guide, Ninth Edition, all o which are
published by McGraw Hill.

About the Technical Editor

Nichole O’Brien is a creative business leader with over 25 years o experience in cybersecurity
and I leadership, program management, and business development across commercial,
education, and ederal, state, and local business markets. Her ocus on innovative solutions is
demonstrated by the development o a commercial cybersecurity and I business group, which
she currently manages in a Fortune 500 corporation and has received the corporation’s annual
Outstanding Customer Service Award. She currently serves as Vice President o Outreach or
Cyber Huntsville, is on the Foundation Board or the National Cyber Summit, and supports
cyber education initiatives like the USSRC Cyber Camp. Nichole has bachelor’s and master’s
degrees in business administration and has a CISSP certiication.
 Mike Meyers’

A+
CISSP
CompTIA ® ®

CERTIFICATION
PASSPORT
PASSPORT SEVENTH
(Exams 220-1001 & 220-1002) EDITION

Bobby E. Rogers

New York Chicago San Francisco Athens

London Madrid Mexico City Milan
New Delhi Singapore Sydney Toronto

McGraw Hill is an independent entity rom (ISC)²® and is not afliated with (ISC)² in any manner. Tis study/training guide and/or material is not
sponsored by, endorsed by, or afliated with (ISC)2 in any manner. Tis publication and accompanying media may be used in assisting students to
prepare or the CISSP exam. Neither (ISC)² nor McGraw Hill warrants that use o this publication and accompanying media will ensure passing any
exam. (ISC)²®, CISSP®, CAP®, ISSAP®, ISSEP®, ISSMP®, SSCP®, and CBK® are trademarks or registered trademarks o (ISC)² in the United States and
certain other countries. All other trademarks are trademarks o their respective owners.
Copyright © 2023 by McGraw Hill. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no
part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system,
without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and
executed in a computer system, but they may not be reproduced for publication.

ISBN: 978-1-26-427798-8
MHID: 1-26-427798-9

The material in this eBook also appears in the print version of this title: ISBN: 978-1-26-427797-1,
MHID: 1-26-427797-0.

eBook conversion by codeMantra

Version 1.0

All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trade-
marked name, we use names in an editorial fashion only, and to the benet of the trademark owner, with no intention of infringe-
ment of the trademark. Where such designations appear in this book, they have been printed with initial caps.

McGraw Hill eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate
training programs. To contact a representative, please visit the Contact Us page at www.mhprofessional.com.

Information has been obtained by McGraw Hill from sources believed to be reliable. However, because of the possibility of hu-
man or mechanical error by our sources, McGraw Hill, or others, McGraw Hill does not guarantee the accuracy, adequacy, or
completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such
information.

TERMS OF USE

This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work
is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the
work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit,
distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent. You
may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to
use the work may be terminated if you fail to comply with these terms.

THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES
OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED
FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA
HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUD-
ING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will
meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors
shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages
resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work.
Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive,
consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of
the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or
cause arises in contract, tort or otherwise.
I’d like to dedicate this book to the cybersecurity proessionals who
tirelessly, and sometimes, thanklessly, protect our inormation and
systems rom all who would do them harm.
I also dedicate this book to the people who serve in uniorm as
military personnel, public saety proessionals, police, frefghters,
and medical proessionals, sacrifcing sometimes all that they are
and have so that we may all live in peace, security, and saety.

—Bobby Rogers
This page intentionally left blank
 DOMAIN vii

Contents at a Glance

1.0 Security and Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2.0 Asset Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
3.0 Security Architecture and Engineering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
4.0 Communication and Network Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
5.0 Identity and Access Management (IAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
6.0 Security Assessment and esting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
7.0 Security Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
8.0 Sotware Development Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
A About the Online Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431

vii
This page intentionally left blank
 DOMAIN ix

Contents

Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxix

1.0 Security and Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Objective 1.1 Understand, adhere to,
and promote professional ethics . . . . . . . . . . . . . . . . . . . . . . . . . . 2
The (ISC)2 Code of Ethics                                              3
Code of Ethics Preamble                                         3
Code of Ethics Canons                                          3
Organizational Code of Ethics                                          4
Workplace Ethics Statements and Policies                          4
Other Sources for Ethics Requirements                             5
REVIEW                                                          7
11 QUESTIONS                                               7
11 ANSWERS                                                8
Objective 1.2 Understand and apply security concepts . . . . . . . . . . . 9
Security Concepts                                                   9
Data, Information, Systems, and Entities                            9
Confidentiality                                                10
Integrity                                                      11
Availability                                                   11
Supporting Tenets of Information Security                                11
Identification                                                  11
Authentication                                                11
Authenticity                                                  12
Authorization                                                 12
Auditing and Accountability                                      12
Nonrepudiation                                                12
Supporting Security Concepts                                    13

ix
x CISSP Passport

REVIEW                                                          14
12 QUESTIONS                                               14
12 ANSWERS                                                15
Objective 1.3 Evaluate and apply security governance principles . . . 16
Security Governance                                                 16
External Governance                                            16
Internal Governance                                            16
Alignment of Security Functions to Business Requirements                  17
Business Strategy and Security Strategy                            17
Organizational Processes                                        18
Organizational Roles and Responsibilities                           18
Security Control Frameworks                                     19
Due Care/Due Diligence                                         20
REVIEW                                                          21
13 QUESTIONS                                               21
13 ANSWERS                                                22
Objective 1.4 Determine compliance and other requirements . . . . . . 23
Compliance                                                        23
Legal and Regulatory Compliance                                 24
Contractual Compliance                                         25
Compliance with Industry Standards                               25
Privacy Requirements                                           25
REVIEW                                                          26
14 QUESTIONS                                               27
14 ANSWERS                                                28
Objective 1.5 Understand legal and regulatory issues that pertain to
information security in a holistic context. . . . . . . . . . . . . . . . . . . . 29
Legal and Regulatory Requirements                                     29
Cybercrimes                                                  29
Licensing and Intellectual Property Requirements                     30
Import/Export Controls                                          31
Transborder Data Flow                                          32
Privacy Issues                                                 32
REVIEW                                                          33
15 QUESTIONS                                               33
15 ANSWERS                                                34
Objective 1.6 Understand requirements for investigation types (i.e.,
administrative, criminal, civil, regulatory, industry standards) . . . 35
Investigations                                                      35
Administrative Investigations                                     35
Civil Investigations                                             35
 Contents xi
Criminal Investigations                                          36
Regulatory Investigations                                        36
Industry Standards for Investigations                              37
REVIEW                                                          37
16 QUESTIONS                                               38
16 ANSWERS                                                39
Objective 1.7 Develop, document, and implement security policy,
standards, procedures, and guidelines . . . . . . . . . . . . . . . . . . . . . 39
Internal Governance                                                 40
Policy                                                        40
Procedures                                                   40
Standards                                                    41
Guidelines                                                    41
Baselines                                                    42
REVIEW                                                          42
17 QUESTIONS                                               43
17 ANSWERS                                                44
Objective 1.8 Identify, analyze, and prioritize Business Continuity (BC)
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Business Continuity                                                  45
Business Impact Analysis                                        46
Developing the BIA                                             46
REVIEW                                                          47
18 QUESTIONS                                               47
18 ANSWERS                                                48
Objective 1.9 Contribute to and enforce personnel security policies
and procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Personnel Security                                                   49
Candidate Screening and Hiring                                   49
Employment Agreements and Policies                              50
Onboarding, Transfers, and Termination Processes                    50
Vendor, Consultant, and Contractor Agreements and Controls           52
Compliance Policy Requirements                                  53
Privacy Policy Requirements                                      53
REVIEW                                                          54
19 QUESTIONS                                               55
19 ANSWERS                                                56
Objective 1.10 Understand and apply risk management concepts . . . 57
Risk Management                                                   57
Elements of Risk                                               57
Identify Threats and Vulnerabilities                                59
xii CISSP Passport

Risk Assessment/Analysis                                       60
Risk Response                                                 63
Risk Frameworks                                               64
Countermeasure Selection and Implementation                      64
Applicable Types of Controls                                     65
Control Assessments (Security and Privacy)                         66
Monitoring and Measurement                                    67
Reporting                                                    67
Continuous Improvement                                        68
REVIEW                                                          68
110 QUESTIONS                                              69
110 ANSWERS                                               69
Objective 1.11 Understand and apply threat modeling concepts and
methodologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Threat Modeling                                                    70
Threat Components                                            70
Threat Modeling Methodologies                                  72
REVIEW                                                          73
111 QUESTIONS                                              73
111 ANSWERS                                               73
Objective 1.12 Apply Supply Chain Risk Management
(SCRM) concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Supply Chain Risk Management                                        74
Risks Associated with Hardware, Software, and Services              74
Third-Party Assessment and Monitoring                            76
Minimum Security Requirements                                  77
Service Level Requirements                                      77
REVIEW                                                          77
112 QUESTIONS                                              78
112 ANSWERS                                               79
Objective 1.13 Establish and maintain a security awareness, education,
and training program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Security Awareness, Education, and Training Program                      80
Methods and Techniques to Present Awareness and Training           80
Periodic Content Reviews                                        82
Program Effectiveness Evaluation                                 82
REVIEW                                                          82
113 QUESTIONS                                              83
113 ANSWERS                                               84
 Contents xiii

2.0 Asset Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Objective 2.1 Identify and classify information and assets. . . . . . . . . 86
Asset Classification                                                  86
Data Classification                                                  87
REVIEW                                                         
89
21 QUESTIONS                                               89
21 ANSWERS                                                90
Objective 2.2 Establish information and asset handling
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Information and Asset Handling                                        90
Handling Requirements                                         91
Information Classification and Handling Systems                     93
REVIEW                                                          94
22 QUESTIONS                                               95
22 ANSWERS                                                95
Objective 2.3 Provision resources securely . . . . . . . . . . . . . . . . . . . . . 96
Securing Resources                                                  96
Asset Ownership                                              96
Asset Inventory                                                96
Asset Management                                            97
REVIEW                                                          98
23 QUESTIONS                                               99
23 ANSWERS                                                99
Objective 2.4 Manage data lifecycle . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Managing the Data Life Cycle                                          100
Data Roles                                                   100
Data Collection                                                102
Data Location                                                 102
Data Maintenance                                             102
Data Retention                                                103
Data Remanence                                              103
Data Destruction                                               103
REVIEW                                                          104
24 QUESTIONS                                               104
24 ANSWERS                                                105
Objective 2.5 Ensure appropriate asset retention
(e.g., End-of-Life (EOL), End-of-Support (EOS)). . . . . . . . . . . . . . . 105
Asset Retention                                                     105
Asset Life Cycle                                               106
End-of-Life and End-of-Support                                   106
xiv CISSP Passport

REVIEW                                                          108
25 QUESTIONS                                               108
25 ANSWERS                                                108
Objective 2.6 Determine data security controls and compliance
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Data Security and Compliance                                         109
Data States                                                   109
Control Standards Selection                                      110
Scoping and Tailoring Data Security Controls                        111
Data Protection Methods                                        111
REVIEW                                                          113
26 QUESTIONS                                               113
26 ANSWERS                                                114
3.0 Security Architecture and Engineering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Objective 3.1 Research, implement, and manage engineering
processes using secure design principles . . . . . . . . . . . . . . . . . . . 116
Threat Modeling                                                    116
Least Privilege                                                      116
Defense in Depth                                                    117
Secure Defaults                                                     117
Fail Securely                                                       117
Separation of Duties                                                 118
Keep It Simple                                                      119
Zero Trust                                                          119
Privacy by Design                                                   119
Trust But Verify                                                     119
Shared Responsibility                                                120
REVIEW                                                          120
31 QUESTIONS                                               121
31 ANSWERS                                                122
Objective 3.2 Understand the fundamental concepts of security
models (e.g., Biba, Star Model, Bell-LaPadula) . . . . . . . . . . . . . . . 122
Security Models                                                    122
Terms and Concepts                                            123
System States and Processing Modes                              124
Confidentiality Models                                          126
Integrity Models                                               127
Other Access Control Models                                     128
REVIEW                                                          128
32 QUESTIONS                                               129
32 ANSWERS                                                130
 Contents xv
Objective 3.3 Select controls based upon systems security
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Selecting Security Controls                                            130
Performance and Functional Requirements                          131
Data Protection Requirements                                    131
Governance Requirements                                       132
Interface Requirements                                         132
Risk Response Requirements                                     133
REVIEW                                                          133
33 QUESTIONS                                               134
33 ANSWERS                                                134
Objective 3.4 Understand security capabilities of Information Systems
(IS) (e.g., memory protection, Trusted Platform Module (TPM),
encryption/decryption) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Information System Security Capabilities                                 135
Hardware and Firmware System Security                           135
Secure Processing                                             137
REVIEW                                                          138
34 QUESTIONS                                               139
34 ANSWERS                                                139
Objective 3.5 Assess and mitigate the vulnerabilities of security
architectures, designs, and solution elements . . . . . . . . . . . . . . . 139
Vulnerabilities of Security Architectures, Designs, and Solutions              140
Client-Based Systems                                           140
Server-Based Systems                                          140
Distributed Systems                                            141
Database Systems                                             141
Cryptographic Systems                                          142
Industrial Control Systems                                       142
Internet of Things                                              143
Embedded Systems                                            143
Cloud-Based Systems                                           144
Virtualized Systems                                            145
Containerization                                               146
Microservices                                                 146
Serverless                                                    146
High-Performance Computing Systems                             146
Edge Computing Systems                                        146
REVIEW                                                          147
35 QUESTIONS                                               148
35 ANSWERS                                                148
xvi CISSP Passport

Objective 3.6 Select and determine cryptographic solutions . . . . . . . 148

Cryptography                                                       149
Cryptographic Life Cycle                                         149
Cryptographic Methods                                         151
Integrity                                                      154
Hybrid Cryptography                                            155
Digital Certificates                                             156
Public Key Infrastructure                                        156
Nonrepudiation and Digital Signatures                             158
Key Management Practices                                      158
REVIEW                                                          159
36 QUESTIONS                                               160
36 ANSWERS                                                161
Objective 3.7 Understand methods of cryptanalytic attacks. . . . . . . . 161
Cryptanalytic Attacks                                                161
Brute Force                                                   162
Ciphertext Only                                                162
Known Plaintext                                               162
Chosen Ciphertext and Chosen Plaintext                            163
Frequency Analysis                                             163
Implementation                                                163
Side Channel                                                  163
Fault Injection                                                 164
Timing                                                       164
Man-in-the-Middle (On-Path)                                     164
Pass the Hash                                                 165
Kerberos Exploitation                                           165
Ransomware                                                  165
REVIEW                                                          166
37 QUESTIONS                                               166
37 ANSWERS                                                167
Objective 3.8 Apply security principles to site and facility design . . . 167
Site and Facility Design                                               167
Site Planning                                                  167
Secure Design Principles                                        168
REVIEW                                                          172
38 QUESTIONS                                               172
38 ANSWERS                                                173
Objective 3.9 Design site and facility security controls . . . . . . . . . . . . 173
Designing Facility Security Controls                                     173
Crime Prevention Through Environmental Design                     174
Key Facility Areas of Concern                                     174
 Contents xvii
REVIEW                                                          181
39 QUESTIONS                                               181
39 ANSWERS                                                182
4.0 Communication and Network Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Objective 4.1 Assess and implement secure design principles
in network architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Fundamental Networking Concepts                                     184
Open Systems Interconnection and Transmission Control Protocol/Internet
Protocol Models                                             185
Internet Protocol Networking                                     187
Secure Protocols                                               189
Application of Secure Networking Concepts                              193
Implications of Multilayer Protocols                               193
Converged Protocols                                            194
Micro-segmentation                                            195
Wireless Technologies                                               197
Wireless Theory and Signaling                                   197
Wi-Fi                                                        199
Bluetooth                                                    202
Zigbee                                                       202
Satellite                                                     203
Li-Fi                                                         203
Cellular Networks                                              204
Content Distribution Networks                                         205
REVIEW                                                          206
41 QUESTIONS                                               206
41 ANSWERS                                                207
Objective 4.2 Secure network components . . . . . . . . . . . . . . . . . . . . . 207
Network Security Design and Components                               208
Operation of Hardware                                          208
Transmission Media                                            212
Endpoint Security                                              213
REVIEW                                                          214
42 QUESTIONS                                               214
42 ANSWERS                                                214
Objective 4.3 Implement secure communication channels
according to design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Securing Communications Channels                                     215
Voice                                                        215
Multimedia Collaboration                                        218
xviii CISSP Passport

Remote Access                                                219

Data Communications                                          220
Virtualized Networks                                           222
Third-Party Connectivity                                         222
REVIEW                                                          223
43 QUESTIONS                                               223
43 ANSWERS                                                224
5.0 Identity and Access Management (IAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
Objective 5.1 Control physical and logical access to assets . . . . . . . . 226
Controlling Logical and Physical Access                                  226
Logical Access                                                227
Physical Access                                               228
REVIEW                                                          228
51 QUESTIONS                                               228
51 ANSWERS                                                229
Objective 5.2 Manage identification and authentication of people,
devices, and services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Identification and Authentication                                       229
Identity Management Implementation                              230
Single/Multifactor Authentication                                 230
Accountability                                                 231
Session Management                                           232
Registration, Proofing, and Establishment of Identity                  232
Federated Identity Management                                  233
Credential Management Systems                                 233
Single Sign-On                                                234
Just-in-Time                                                  234
REVIEW                                                          235
52 QUESTIONS                                               236
52 ANSWERS                                                236
Objective 5.3 Federated identity with a third-party service . . . . . . . . 237
Third-Party Identity Services                                           237
On-Premise                                                   237
Cloud                                                        238
Hybrid                                                       238
REVIEW                                                          238
53 QUESTIONS                                               239
53 ANSWERS                                                239
 Contents xix
Objective 5.4 Implement and manage authorization mechanisms. . . 239
Authorization Mechanisms and Models                                  240
Discretionary Access Control                                     241
Mandatory Access Control                                       241
Role-Based Access Control                                      242
Rule-Based Access Control                                      242
Attribute-Based Access Control                                   243
Risk-Based Access Control                                       243
REVIEW                                                          243
54 QUESTIONS                                               244
54 ANSWERS                                                244
Objective 5.5 Manage the identity and access provisioning
lifecycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Identity and Access Provisioning Life Cycle                               245
Provisioning and Deprovisioning                                  245
Role Definition                                                247
Privilege Escalation                                            248
Account Access Review                                              249
REVIEW                                                          251
55 QUESTIONS                                               251
55 ANSWERS                                                252
Objective 5.6 Implement authentication systems . . . . . . . . . . . . . . . . 252
Authentication Systems                                              252
Open Authorization                                             253
OpenID Connect                                               253
Security Assertion Markup Language                              253
Kerberos                                                     254
Remote Access Authentication and Authorization                    256
REVIEW                                                          257
56 QUESTIONS                                               257
56 ANSWERS                                                258
6.0 Security Assessment and esting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Objective 6.1 Design and validate assessment,
test, and audit strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Defining Assessments, Tests, and Audits                                 260
Designing and Validating Evaluations                                    261
Goals and Strategies                                           261
Use of Internal, External, and Third-Party Assessors                   262
REVIEW                                                          263
61 QUESTIONS                                               263
61 ANSWERS                                                264
Another random document with
no related content on Scribd:
THE FULL PROJECT GUTENBERG LICENSE
 PLEASE READ THIS BEFORE YOU DISTRIBUTE OR USE THIS WORK

To protect the Project Gutenberg™ mission of promoting the free

distribution of electronic works, by using or distributing this work (or
any other work associated in any way with the phrase “Project
Gutenberg”), you agree to comply with all the terms of the Full
Project Gutenberg™ License available with this file or online at
www.gutenberg.org/license.

Section 1. General Terms of Use and

Redistributing Project Gutenberg™
electronic works
1.A. By reading or using any part of this Project Gutenberg™
electronic work, you indicate that you have read, understand, agree
to and accept all the terms of this license and intellectual property
(trademark/copyright) agreement. If you do not agree to abide by all
the terms of this agreement, you must cease using and return or
destroy all copies of Project Gutenberg™ electronic works in your
possession. If you paid a fee for obtaining a copy of or access to a
Project Gutenberg™ electronic work and you do not agree to be
bound by the terms of this agreement, you may obtain a refund from
the person or entity to whom you paid the fee as set forth in
paragraph 1.E.8.

1.B. “Project Gutenberg” is a registered trademark. It may only be

used on or associated in any way with an electronic work by people
who agree to be bound by the terms of this agreement. There are a
few things that you can do with most Project Gutenberg™ electronic
works even without complying with the full terms of this agreement.
See paragraph 1.C below. There are a lot of things you can do with
Project Gutenberg™ electronic works if you follow the terms of this
agreement and help preserve free future access to Project
Gutenberg™ electronic works. See paragraph 1.E below.
1.C. The Project Gutenberg Literary Archive Foundation (“the
Foundation” or PGLAF), owns a compilation copyright in the
collection of Project Gutenberg™ electronic works. Nearly all the
individual works in the collection are in the public domain in the
United States. If an individual work is unprotected by copyright law in
the United States and you are located in the United States, we do
not claim a right to prevent you from copying, distributing,
performing, displaying or creating derivative works based on the
work as long as all references to Project Gutenberg are removed. Of
course, we hope that you will support the Project Gutenberg™
mission of promoting free access to electronic works by freely
sharing Project Gutenberg™ works in compliance with the terms of
this agreement for keeping the Project Gutenberg™ name
associated with the work. You can easily comply with the terms of
this agreement by keeping this work in the same format with its
attached full Project Gutenberg™ License when you share it without
charge with others.

1.D. The copyright laws of the place where you are located also
govern what you can do with this work. Copyright laws in most
countries are in a constant state of change. If you are outside the
United States, check the laws of your country in addition to the terms
of this agreement before downloading, copying, displaying,
performing, distributing or creating derivative works based on this
work or any other Project Gutenberg™ work. The Foundation makes
no representations concerning the copyright status of any work in
any country other than the United States.

1.E. Unless you have removed all references to Project Gutenberg:

1.E.1. The following sentence, with active links to, or other

immediate access to, the full Project Gutenberg™ License must
appear prominently whenever any copy of a Project Gutenberg™
work (any work on which the phrase “Project Gutenberg” appears, or
with which the phrase “Project Gutenberg” is associated) is
accessed, displayed, performed, viewed, copied or distributed:
 This eBook is for the use of anyone anywhere in the United
States and most other parts of the world at no cost and with
almost no restrictions whatsoever. You may copy it, give it away
or re-use it under the terms of the Project Gutenberg License
included with this eBook or online at www.gutenberg.org. If you
are not located in the United States, you will have to check the
laws of the country where you are located before using this
eBook.

1.E.2. If an individual Project Gutenberg™ electronic work is derived

from texts not protected by U.S. copyright law (does not contain a
notice indicating that it is posted with permission of the copyright
holder), the work can be copied and distributed to anyone in the
United States without paying any fees or charges. If you are
redistributing or providing access to a work with the phrase “Project
Gutenberg” associated with or appearing on the work, you must
comply either with the requirements of paragraphs 1.E.1 through
1.E.7 or obtain permission for the use of the work and the Project
Gutenberg™ trademark as set forth in paragraphs 1.E.8 or 1.E.9.

1.E.3. If an individual Project Gutenberg™ electronic work is posted

with the permission of the copyright holder, your use and distribution
must comply with both paragraphs 1.E.1 through 1.E.7 and any
additional terms imposed by the copyright holder. Additional terms
will be linked to the Project Gutenberg™ License for all works posted
with the permission of the copyright holder found at the beginning of
this work.

1.E.4. Do not unlink or detach or remove the full Project

Gutenberg™ License terms from this work, or any files containing a
part of this work or any other work associated with Project
Gutenberg™.

1.E.5. Do not copy, display, perform, distribute or redistribute this

electronic work, or any part of this electronic work, without
prominently displaying the sentence set forth in paragraph 1.E.1 with
active links or immediate access to the full terms of the Project
Gutenberg™ License.
1.E.6. You may convert to and distribute this work in any binary,
compressed, marked up, nonproprietary or proprietary form,
including any word processing or hypertext form. However, if you
provide access to or distribute copies of a Project Gutenberg™ work
in a format other than “Plain Vanilla ASCII” or other format used in
the official version posted on the official Project Gutenberg™ website
(www.gutenberg.org), you must, at no additional cost, fee or expense
to the user, provide a copy, a means of exporting a copy, or a means
of obtaining a copy upon request, of the work in its original “Plain
Vanilla ASCII” or other form. Any alternate format must include the
full Project Gutenberg™ License as specified in paragraph 1.E.1.

1.E.7. Do not charge a fee for access to, viewing, displaying,

performing, copying or distributing any Project Gutenberg™ works
unless you comply with paragraph 1.E.8 or 1.E.9.

1.E.8. You may charge a reasonable fee for copies of or providing

access to or distributing Project Gutenberg™ electronic works
provided that:

• You pay a royalty fee of 20% of the gross profits you derive from
the use of Project Gutenberg™ works calculated using the
method you already use to calculate your applicable taxes. The
fee is owed to the owner of the Project Gutenberg™ trademark,
but he has agreed to donate royalties under this paragraph to
the Project Gutenberg Literary Archive Foundation. Royalty
payments must be paid within 60 days following each date on
which you prepare (or are legally required to prepare) your
periodic tax returns. Royalty payments should be clearly marked
as such and sent to the Project Gutenberg Literary Archive
Foundation at the address specified in Section 4, “Information
about donations to the Project Gutenberg Literary Archive
Foundation.”

• You provide a full refund of any money paid by a user who

notifies you in writing (or by e-mail) within 30 days of receipt that
s/he does not agree to the terms of the full Project Gutenberg™
License. You must require such a user to return or destroy all
 copies of the works possessed in a physical medium and
discontinue all use of and all access to other copies of Project
Gutenberg™ works.

• You provide, in accordance with paragraph 1.F.3, a full refund of

any money paid for a work or a replacement copy, if a defect in
the electronic work is discovered and reported to you within 90
days of receipt of the work.

• You comply with all other terms of this agreement for free
distribution of Project Gutenberg™ works.

1.E.9. If you wish to charge a fee or distribute a Project Gutenberg™

electronic work or group of works on different terms than are set
forth in this agreement, you must obtain permission in writing from
the Project Gutenberg Literary Archive Foundation, the manager of
the Project Gutenberg™ trademark. Contact the Foundation as set
forth in Section 3 below.

1.F.

1.F.1. Project Gutenberg volunteers and employees expend

considerable effort to identify, do copyright research on, transcribe
and proofread works not protected by U.S. copyright law in creating
the Project Gutenberg™ collection. Despite these efforts, Project
Gutenberg™ electronic works, and the medium on which they may
be stored, may contain “Defects,” such as, but not limited to,
incomplete, inaccurate or corrupt data, transcription errors, a
copyright or other intellectual property infringement, a defective or
damaged disk or other medium, a computer virus, or computer
codes that damage or cannot be read by your equipment.

1.F.2. LIMITED WARRANTY, DISCLAIMER OF DAMAGES - Except

for the “Right of Replacement or Refund” described in paragraph
1.F.3, the Project Gutenberg Literary Archive Foundation, the owner
of the Project Gutenberg™ trademark, and any other party
distributing a Project Gutenberg™ electronic work under this
agreement, disclaim all liability to you for damages, costs and
expenses, including legal fees. YOU AGREE THAT YOU HAVE NO
REMEDIES FOR NEGLIGENCE, STRICT LIABILITY, BREACH OF
WARRANTY OR BREACH OF CONTRACT EXCEPT THOSE
PROVIDED IN PARAGRAPH 1.F.3. YOU AGREE THAT THE
FOUNDATION, THE TRADEMARK OWNER, AND ANY
DISTRIBUTOR UNDER THIS AGREEMENT WILL NOT BE LIABLE
TO YOU FOR ACTUAL, DIRECT, INDIRECT, CONSEQUENTIAL,
PUNITIVE OR INCIDENTAL DAMAGES EVEN IF YOU GIVE
NOTICE OF THE POSSIBILITY OF SUCH DAMAGE.

1.F.3. LIMITED RIGHT OF REPLACEMENT OR REFUND - If you

discover a defect in this electronic work within 90 days of receiving it,
you can receive a refund of the money (if any) you paid for it by
sending a written explanation to the person you received the work
from. If you received the work on a physical medium, you must
return the medium with your written explanation. The person or entity
that provided you with the defective work may elect to provide a
replacement copy in lieu of a refund. If you received the work
electronically, the person or entity providing it to you may choose to
give you a second opportunity to receive the work electronically in
lieu of a refund. If the second copy is also defective, you may
demand a refund in writing without further opportunities to fix the
problem.

1.F.4. Except for the limited right of replacement or refund set forth in
paragraph 1.F.3, this work is provided to you ‘AS-IS’, WITH NO
OTHER WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR ANY PURPOSE.

1.F.5. Some states do not allow disclaimers of certain implied

warranties or the exclusion or limitation of certain types of damages.
If any disclaimer or limitation set forth in this agreement violates the
law of the state applicable to this agreement, the agreement shall be
interpreted to make the maximum disclaimer or limitation permitted
by the applicable state law. The invalidity or unenforceability of any
provision of this agreement shall not void the remaining provisions.
1.F.6. INDEMNITY - You agree to indemnify and hold the
Foundation, the trademark owner, any agent or employee of the
Foundation, anyone providing copies of Project Gutenberg™
electronic works in accordance with this agreement, and any
volunteers associated with the production, promotion and distribution
of Project Gutenberg™ electronic works, harmless from all liability,
costs and expenses, including legal fees, that arise directly or
indirectly from any of the following which you do or cause to occur:
(a) distribution of this or any Project Gutenberg™ work, (b)
alteration, modification, or additions or deletions to any Project
Gutenberg™ work, and (c) any Defect you cause.

Section 2. Information about the Mission of

Project Gutenberg™
Project Gutenberg™ is synonymous with the free distribution of
electronic works in formats readable by the widest variety of
computers including obsolete, old, middle-aged and new computers.
It exists because of the efforts of hundreds of volunteers and
donations from people in all walks of life.

Volunteers and financial support to provide volunteers with the

assistance they need are critical to reaching Project Gutenberg™’s
goals and ensuring that the Project Gutenberg™ collection will
remain freely available for generations to come. In 2001, the Project
Gutenberg Literary Archive Foundation was created to provide a
secure and permanent future for Project Gutenberg™ and future
generations. To learn more about the Project Gutenberg Literary
Archive Foundation and how your efforts and donations can help,
see Sections 3 and 4 and the Foundation information page at
www.gutenberg.org.

Section 3. Information about the Project

Gutenberg Literary Archive Foundation
The Project Gutenberg Literary Archive Foundation is a non-profit
501(c)(3) educational corporation organized under the laws of the
state of Mississippi and granted tax exempt status by the Internal
Revenue Service. The Foundation’s EIN or federal tax identification
number is 64-6221541. Contributions to the Project Gutenberg
Literary Archive Foundation are tax deductible to the full extent
permitted by U.S. federal laws and your state’s laws.

The Foundation’s business office is located at 809 North 1500 West,

Salt Lake City, UT 84116, (801) 596-1887. Email contact links and up
to date contact information can be found at the Foundation’s website
and official page at www.gutenberg.org/contact

Section 4. Information about Donations to

the Project Gutenberg Literary Archive
Foundation
Project Gutenberg™ depends upon and cannot survive without
widespread public support and donations to carry out its mission of
increasing the number of public domain and licensed works that can
be freely distributed in machine-readable form accessible by the
widest array of equipment including outdated equipment. Many small
donations ($1 to $5,000) are particularly important to maintaining tax
exempt status with the IRS.

The Foundation is committed to complying with the laws regulating

charities and charitable donations in all 50 states of the United
States. Compliance requirements are not uniform and it takes a
considerable effort, much paperwork and many fees to meet and
keep up with these requirements. We do not solicit donations in
locations where we have not received written confirmation of
compliance. To SEND DONATIONS or determine the status of
compliance for any particular state visit www.gutenberg.org/donate.

While we cannot and do not solicit contributions from states where

we have not met the solicitation requirements, we know of no
prohibition against accepting unsolicited donations from donors in
such states who approach us with offers to donate.

International donations are gratefully accepted, but we cannot make

any statements concerning tax treatment of donations received from
outside the United States. U.S. laws alone swamp our small staff.

Please check the Project Gutenberg web pages for current donation
methods and addresses. Donations are accepted in a number of
other ways including checks, online payments and credit card
donations. To donate, please visit: www.gutenberg.org/donate.

Section 5. General Information About Project

Gutenberg™ electronic works
Professor Michael S. Hart was the originator of the Project
Gutenberg™ concept of a library of electronic works that could be
freely shared with anyone. For forty years, he produced and
distributed Project Gutenberg™ eBooks with only a loose network of
volunteer support.

Project Gutenberg™ eBooks are often created from several printed

editions, all of which are confirmed as not protected by copyright in
the U.S. unless a copyright notice is included. Thus, we do not
necessarily keep eBooks in compliance with any particular paper
edition.

Most people start at our website which has the main PG search
facility: www.gutenberg.org.

This website includes information about Project Gutenberg™,

including how to make donations to the Project Gutenberg Literary
Archive Foundation, how to help produce our new eBooks, and how
to subscribe to our email newsletter to hear about new eBooks.