CISSP Practice question #20

An attacker gets access to our hashed passwords we haven’t used salting or nonces on, why is this a problem?
A: The attacker can circumvent clipping levels.
B: It isn’t a problem, hashes are one-way functions and can’t be reversed.
C: Because the attacker now known our encryption keys.
D: The attacker can now reverse the hash to the real password by hashing the hash he stole.

CBK 5: Identity and Access Management
Source: ThorTeaches.com practice tests

Answer


A: If an attacker can get access to the file of hashed passwords guessing can be done off-line, rapidly testing candidate passwords against the true password’s hash value. This will circumvent the clipping levels, stealing is always easier than decrypting it.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #19

In which phase of incident management do we write the procedures?
A: Preparation.
B: Detection.
C: Response.
D: Recovery.

CBK 7: Security Operations
Source: ThorTeaches.com practice tests

Answer


A: Preparation: This are all the steps we take to prepare for incidences. We write the policies, procedures, we train our staff, we procure the detection soft/hardware, we give our incidence response team the tools they need to respond to an incident. The more we train our team, the better they will handle the response, the faster we recover, the better we preserve the crime scene (if there is one), the less impactful an incident will be.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #18

In Scrum what is the product owners role?
A: Representing the stakeholders/customers.
B: Developing the code/product at the end of each sprint.
C: Removing obstacles for the development team.
D: Being a traditional project manager.

CBK 8: Software Development Security
Source: ThorTeaches.com practice tests

Answer


A: The product owner: Representing the product’s stakeholders, the voice of the customer, and is accountable for ensuring that the team delivers value to the business.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #17

We are implementing governance standard and control frameworks focused on stakeholder IT related goals. What should we implement?
A: COBIT.
B: ITIL.
C: COSO.
D: FRAP

CBK 1: Security and Risk Management
Source: ThorTeaches.com practice tests

Answer


A: COBIT (Control Objectives for Information and related Technology) focuses on goals for IT. Stakeholder needs are mapped down to IT related goals.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice exams and all udemy courses for $10 or $12.

To celebrate Diwali every single Udemy courses are discounted to $10 for students in India and $12 for everyone else for the next 4 days.

My 4 full CISSP practice exams below are four $10 for everyone using the coupon below.
If you follow the link you can buy anything else on udemy for $10/$12 until 10/20 at midnight PST.

CISSP study and training! | Study material recommendations image 1
CISSP certification: Full 250 question practice test #1 2017

https://goo.gl/5gciyA

CISSP study and training! | Study material recommendations image 2
CISSP certification: Full 250 question practice test #2 2017
https://goo.gl/RZxVYx

CISSP study and training! | Study material recommendations image 3
CISSP certification: Full 250 question practice test #3 2017
https://goo.gl/vgWL8p

CISSP study and training! | Study material recommendations image 4
CISSP certification: Full 250 question practice test #4 2017
https://goo.gl/F9RDx2

Other interesting courses @ $10/$12:

The Complete Cyber Security Course : Hackers Exposed! – 4.6 (5,564 ratings) – 11 hours.
https://goo.gl/u7EiF4

The Complete Ethical Hacking Course: Beginner to Advanced! 4.4 (14,282 ratings) – 24.5 hours.
https://goo.gl/DYc7me

CompTIA A+ Certification 901. The Total Course – 4.6 star rating with 4,936 ratings – 15.5 hours.
https://goo.gl/SqoCkh

CompTIA A+ Certification 902. The Total Course – 4.7 star rating with 1,298 ratings – 14 hours.
https://goo.gl/tsy4j9

CompTIA Network+ Cert.; N10-006. The Total Course – 4.7 star rating with 5,925 ratings – 15.5 hours.
https://goo.gl/GYAN9j

CompTIA Security+ Certification; SY0-401 – The Total Course 4.6 star rating with 1,425 ratings – 13.5 hours.
https://goo.gl/u94ZjB

 

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #16

What can possibly protect a backup tape that has been stolen from leading to the data on it being accessible?
A: Proper data handling.
B: Proper data storage.
C: Proper data retention.
D: Proper data encryption.

CBK 2: Asset Security
Source: ThorTeaches.com practice tests

Answer


D: Proper encryption can prevent data compromise even if the physical tape is lost. This obviously requires that the encryption is strong enough.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #15

We are implementing database shadowing, how does it help us ensure we can recover from a data loss on our primary systems?
A: It sends transaction logs to a remote location, but not the files themselves. We can rebuild the transactions from the logs.
B: It uses a remote backups service that sends backup files electronically offsite at a certain interval or when the files change.
C: It makes an exact real time copy at another location, this can be another local disk or preferred remote to another type of media.
D: It takes a full backup of our database once a week to tape.

CBK 8: Software Development Security
Source: ThorTeaches.com practice tests

Answer


C: Database shadowing: Exact real time copy of the database or files to another location. It can be another disk in the same server, but best practices dictates another geographical location, often on a different media.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #14

Our IPS lets permitted traffic pass, what is this an example of?
A: True positive.
B: True negative.
C: False positive.
D: False negative.

CBK 7: Security Operations
Source: ThorTeaches.com practice tests

Answer


A: True Positive: An attack is happening and the system detects it and acts.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

IT Security – from Novinite “New Мeasures to Scale up EU Cybersecurity”

New Мeasures to Scale up EU Cybersecurity – Novinite.com – Sofia News Agency

A new set of wide-ranging measures to build strong cybersecurity in the European Union is on the table. The European Commission has proposed the creation of an EU Cybersecurity Agency to assist member states in dealing with cyber-attacks, as well as a new European certification scheme that will ensure that products and services in the digital world are safe to use.

Source: www.novinite.com/articles/183428/

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #13

When we create an application whitelist we are doing what?
A: Make a list of allowed applications.
B: Making a list of prohibited applications.
C: Making a list of all applications.
D: Making a list of all of our own developed applications.

CBK 7: Security Operations
Source: ThorTeaches.com practice tests

Answer


A: Application whitelisting: We can whitelist the applications we want to allow to run on our environments, but it can also be compromised. We would whitelist against a trusted digital certificate, a known hash or path and name, the latter is the least secure, an attacker can replace the file at the path with a malicious copy.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading