The weakest point in the communication based on asymmetric encryption is the knowledge about the real owners of keys. Somebody evil could generate a key pair, give the public key away and tell everybody, that it belongs to somebody else. Now, everyone believing it will use this key for encryption, resulting in the evil man being able to read the messages. If he encrypts the messages again with the public key of the real recipient, he will not be easily recognized. This sort of attack is called ``man-in-the-middle'' attack and can only be prevented by making sure, public keys really belong to the one being designated as owner.

Explanation
Section: Security Operations

A demilitarized zone (DMZ) is a network segment that is separated from both the internal and external networks by firewalls. The purpose of a DMZ is to provide limited access to public resources, such as web servers, email servers, or DNS servers, while protecting the internal network from unauthorized access. A DMZ should not contain database servers, file servers, or hosts that store sensitive or unimportant data, as these could be compromised by attackers who gain access to the DMZ. References: CISSP Official Study Guide, 9th Edition, page 414; CISSP All-in-One Exam Guide, 8th Edition, page 1130

Explanation/Reference:
Explanation:
One drawback of security guards is that the cost of maintaining a guard function either internally or through an external service is expensive.
With common physical security risk countermeasures such as door entry control systems or perimeter fencing, there is typically a one-off cost when the countermeasure is implemented. With security guards, you have the ongoing cost of paying the salary of the security guard.
Incorrect Answers:
A: Procedural controls consist of approved written policies, procedures, standards and guidelines. The cost of implement procedural controls is not more costly than the ongoing costs associated with security guards. Therefore, this answer is incorrect.
B: Hardware Devices typically have a one-off cost when they are implemented and they may have a small cost for maintenance. However, this cost not more costly than the ongoing costs associated with security guards. Therefore, this answer is incorrect.
C: Electronic Systems typically have a one-off cost when they are implemented and they may have a small cost for maintenance. However, this cost not more than the ongoing costs associated with security guards.
Therefore, this answer is incorrect.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p. 535

Explanation/Reference:
Explanation:
Some Intrusion Detection System (IDS) evasion techniques involve deliberately violating the TCP or IP protocols in a way the target computer will handle differently from the IDS. For example, the TCP Urgent Pointer is handled differently on different operating systems and may not be handled correctly by the IDS.
Incorrect Answers:
B: It is very unlikely that a changed TCP Urgent pointer value is caused by a hardware problem, such as a damaged network cable.
C: It is very unlikely that a changed TCP Urgent pointer value is caused by a hardware problem, such as a damaged network card, or by a corrupt driver.
D: The TCP Urgent pointer field does not contain checksums.
References:
https://en.wikipedia.org/wiki/Intrusion_detection_system_evasion_techniques