CISSP Asset Security — Questions and Answers
Question 1: What is defense in depth in the context of CISSP security?
- Using one strong security control
- Implementing multiple layers of security controls (Correct answer)
- Focusing only on perimeter security
- Relying solely on encryption
Correct answer: Implementing multiple layers of security controls
Defense in depth uses multiple layers of security controls so that if one layer fails, additional layers continue to provide protection.
Question 2: Which principle states that users should only have access necessary for their role?
- Separation of duties
- Principle of least privilege (Correct answer)
- Need to share
- Defense in depth
Correct answer: Principle of least privilege
The principle of least privilege ensures users only have the minimum access rights needed to perform their job functions, limiting potential damage.
Question 3: In CISSP practice, what is the purpose of vulnerability scanning?
- To exploit systems
- To identify weaknesses before attackers do (Correct answer)
- To replace firewalls
- To slow down network traffic
Correct answer: To identify weaknesses before attackers do
Vulnerability scanning proactively identifies security weaknesses in systems and applications so they can be remediated before exploitation.
Question 4: What is the recommended response when a security incident is detected in an CISSP environment?
- Delete all logs immediately
- Follow the incident response plan: contain, eradicate, recover (Correct answer)
- Ignore minor incidents
- Immediately shut down all systems
Correct answer: Follow the incident response plan: contain, eradicate, recover
Following a structured incident response plan ensures containment of the threat, eradication of the cause, and recovery to normal operations.
Question 5: Which authentication factor is classified as "something you are"?
- Password
- Security token
- Biometric data (Correct answer)
- Smart card
Correct answer: Biometric data
Biometric data such as fingerprints, facial recognition, or retinal scans represents the "something you are" authentication factor.
Question 6: What is the primary purpose of encryption in CISSP security?
- To make data transfer slower
- To protect data confidentiality during storage and transmission (Correct answer)
- To compress data
- To organize data more efficiently
Correct answer: To protect data confidentiality during storage and transmission
Encryption protects data confidentiality by converting information into an unreadable format that can only be decoded with the proper key.
CISSP Asset Security
What is defense in depth in the context of CISSP security?