ISC2 CISSP Exam Dumps

A Disaster Recovery (DR) package is a set of documents, tools, and resources that are needed to restore the normal operations of a system or network after a disaster. A DR package should include the following documentation: hardware configuration instructions, hardware configuration software, an operating system image, a data restoration option, media retrieval instructions, backup and recovery procedures, contact lists, and emergency response plans. These documents can help to rebuild the system or network from scratch, restore the data from backups, and resume the business functions as quickly as possible. Source code, compiled code, firmware updates, operational log book and manuals are not essential for a DR package, as they are more related to development, maintenance, or operation of the system or network. Data encrypted in original format, auditable transaction data, and recovery instructions for future extraction on demand are not part of a DR package, as they are more related to data security, audit, or compliance. System configuration including hardware, software, hardware, interfaces, software Application Programming Interface (API) configuration, data structure, ... are not sufficient for a DR package, as they do not include the instructions, software, or procedures to restore the system or network.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 10: Business Continuity and Disaster Recovery Planning, page 631;CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 7: Security Operations, Question 7.16, page 276.

The best way to protect an organization's data assets is to encrypt data in transit and at rest using up-to-date cryptographic algorithms. Encryption is a process of transforming data into an unintelligible form using a secret key, so that only authorized parties can access or modify the data. Encryption can protect data in transit, which is data that is moving across a network or a communication channel, from eavesdropping, interception, or modification. Encryption can also protect data at rest, which is data that is stored on a device or a media, from unauthorized access, theft, or loss. Encryption should use up-to-date cryptographic algorithms, such as AES, RSA, or SHA, that are proven to be secure and resistant to attacks. Monitoring and enforcing adherence to security policies is a good practice, but it may not be sufficient to protect data assets from internal or external threats. Creating the DMZ with proxies, firewalls, and hardened bastion hosts is a way to isolate and protect the network perimeter, but it may not protect data assets that are inside or outside the network. Requiring MFA and SoD is a way to enhance the identity and access management, but it may not protect data assets from unauthorized disclosure or modification.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Cryptography and Symmetric Key Algorithms, page 331.

The best approach to mitigate future internal client-based attacks is to harden the client image before deployment. Hardening the client image means to apply the security configurations and measures to the client operating system and applications, such as disabling unnecessary services, installing patches and updates, enforcing strong passwords, and enabling encryption and firewall. Hardening the client image can help to reduce the attack surface and the vulnerabilities of the client, and to prevent or resist the client-based attacks, such as web exploits, malware, or phishing. Blocking all client side web exploits at the perimeter, removing all non-essential client-side web services from the network, and screening for harmful exploits of client-side services before implementation are not the best approaches to mitigate future internal client-based attacks, as they are related to the network or the server level, not the client level, and they may not address all the possible types or sources of the client-based attacks.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3, Security Architecture and Engineering, page 295.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 3, Security Architecture and Engineering, page 311.

According to the CISSP For Dummies4, the best way to determine the priority of the remediation efforts after a vulnerability assessment has been conducted is to use a risk-based approach. A vulnerability assessment is the process of identifying and measuring the weaknesses and exposures in a system, network, or application, that may be exploited by threats and cause harm to the organization or its assets. A risk-based approach is a method that prioritizes the remediation efforts based on the level of risk associated with each vulnerability, which is calculated by considering the impact and likelihood of the threat exploiting the vulnerability. A risk-based approach helps to allocate the resources and efforts to the most critical and urgent vulnerabilities, and to reduce the overall risk to an acceptable level. Using an impact-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the potential consequences of the threat exploiting the vulnerability, but not the probability of the occurrence. An impact-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities. Using a criticality-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the importance or value of the asset or system that is affected by the vulnerability, but not the threat or the vulnerability itself. A criticality-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities. Using a threat-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the characteristics and capabilities of the threat that may exploit the vulnerability, but not the vulnerability or the impact itself.A threat-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities.Reference:4

Guest OS audit logs are what an administrator must review to audit a user's access to data files in a VM environment that has five guest OS and provides strong isolation. A VM environment is a system that allows multiple virtual machines (VMs) to run on a single physical machine, each with its own OS and applications. A VM environment can provide several benefits, such as:

Improving the utilization and efficiency of the physical resources by sharing them among multiple VMs

Enhancing the security and isolation of the VMs by preventing or limiting the interference or communication between them

Increasing the flexibility and scalability of the VMs by allowing them to be created, modified, deleted, or migrated easily and quickly

A guest OS is the OS that runs on a VM, which is different from the host OS that runs on the physical machine. A guest OS can have its own security controls and mechanisms, such as access controls, encryption, authentication, and audit logs. Audit logs are records that capture and store the information about the events and activities that occur within a system or a network, such as the access and usage of the data files. Audit logs can provide a reactive and detective layer of security by enabling the monitoring and analysis of the system or network behavior, and facilitating the investigation and response of the incidents.

Guest OS audit logs are what an administrator must review to audit a user's access to data files in a VM environment that has five guest OS and provides strong isolation, because they can provide the most accurate and relevant information about the user's actions and interactions with the data files on the VM. Guest OS audit logs can also help the administrator to identify and report any unauthorized or suspicious access or disclosure of the data files, and to recommend or implement any corrective or preventive actions.

The other options are not what an administrator must review to audit a user's access to data files in a VM environment that has five guest OS and provides strong isolation, but rather what an administrator might review for other purposes or aspects. Host VM monitor audit logs are records that capture and store the information about the events and activities that occur on the host VM monitor, which is the software or hardware component that manages and controls the VMs on the physical machine. Host VM monitor audit logs can provide information about the performance, status, and configuration of the VMs, but they cannot provide information about the user's access to data files on the VMs. Guest OS access controls are rules and mechanisms that regulate and restrict the access and permissions of the users and processes to the resources and services on the guest OS. Guest OS access controls can provide a proactive and preventive layer of security by enforcing the principles of least privilege, separation of duties, and need to know. However, guest OS access controls are not what an administrator must review to audit a user's access to data files, but rather what an administrator must configure and implement to protect the data files. Host VM access controls are rules and mechanisms that regulate and restrict the access and permissions of the users and processes to the VMs on the physical machine. Host VM access controls can provide a granular and dynamic layer of security by defining and assigning the roles and permissions according to the organizational structure and policies. However, host VM access controls are not what an administrator must review to audit a user's access to data files, but rather what an administrator must configure and implement to protect the VMs.