Which of the following is the most important ISC2 Code of Ethics Canons?
Correct Answer: C
The 4 Canons of the ISC(2) Code of Ethics are specifically ordered according to their importance. The ordering is as follows. 1.Protect society, the commonwealth, and the infrastructure. 2.Act honorably, honestly, justly, responsibly, and legally. 3.Provide diligent and competent service to prinicipals. 4.Advance and protect the profession. The FULL code of ethics is available at: https://www.isc2.org/uploadedFiles/(ISC)2_Public_Content/Code_of_ethics/ISC2-Code-of-Ethics.pdf Even thou you don't have numbering in front of the canons listed in the document above, there is a paragraph talking about the order of the canons and which one is more important than the other one. Close the end of the second page of the code of Ethics they say clearly: Compliance with the preamble and canons is mandatory. Conficts between the canons should be resolved in the order of the canons. The canons are not equal and conficts between them are not intended to create ethical binds. TIP: I would STRONGLY recommend you visit the link above and you download a copy of the code of ethics. There will be questions on the exam covering some of it's details for sure. It is easy points you can get. CONFLICTING INFORMATION The ISC2 website at https://www.isc2.org/ethics/default.aspx has some brief information on the Code of Ethics where they list 4 canons that are NOT the same as their full Code of Ethis available at the link above. Code of Ethics Canons: Protect society, the common good, necessary public trust and confidence, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals. Advance and protect the profession. The following answers are incorrect (not the most important but still VERY important): Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to prinicipals. Advance and protect the profession The following reference(s) were/was used to create this question: CISSP Study Guide 11th Hour by Eric Conrad. Page 171. and https://www.isc2.org/uploadedFiles/(ISC)2_Public_Content/Code_of_ethics/ISC2-Code-of-Ethics.pdf
CISSP Exam Question 297
Which of the following Kerberos components holds all users' and services' cryptographic keys?
Correct Answer: C
Explanation/Reference: Explanation: The Key Distribution Center (KDC) is the most important component within a Kerberos environment as it holds all users' and services' secret keys. Incorrect Answers: A: Key Distribution Service is not a valid Kerberos term. B: The authentication service is a part of the KDC that authenticates a principal. It does not hold all users' and services' cryptographic keys D: Key Granting Service is not a valid Kerberos term. References: Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 209-213
CISSP Exam Question 298
Which of the following would NOT violate the Due Diligence concept?
Correct Answer: D
To be effective a patch management program must be in place (due diligence) and detailed procedures would specify how and when the patches are applied properly (Due Care). Remember, the question asked for NOT a violation of Due Diligence, in this case, applying patches demonstrates due care and the patch management process in place demonstrates due diligence. Due diligence is the act of investigating and understanding the risks the company faces. A company practices by developing and implementing security policies, procedures, and standards. Detecting risks would be based on standards such as ISO 2700, Best Practices, and other published standards such as NIST standards for example. Due Diligence is understanding the current threats and risks. Due diligence is practiced by activities that make sure that the protection mechanisms are continually maintained and operational where risks are constantly being evaluated and reviewed. The security policy being outdated would be an example of violating the due diligence concept. Due Care is implementing countermeasures to provide protection from those threats. Due care is when the necessary steps to help protect the company and its resources from possible risks that have been identifed. If the information owner does not lay out the foundation of data protection (doing something about it) and ensure that the directives are being enforced (actually being done and kept at an acceptable level), this would violate the due care concept. If a company does not practice due care and due diligence pertaining to the security of its assets, it can be legally charged with negligence and held accountable for any ramifications of that negligence. Liability is usually established based on Due Diligence and Due Care or the lack of either. A good way to remember this is using the first letter of both words within Due Diligence (DD) and Due Care (DC). Due Diligence = Due Detect Steps you take to identify risks based on best practices and standards. Due Care = Due Correct. Action you take to bring the risk level down to an acceptable level and maintaining that level over time. The Following answer were wrong: Security policy being outdated: While having and enforcing a security policy is the right thing to do (due care), if it is outdated, you are not doing it the right way (due diligence). This questions violates due diligence and not due care. Data owners not laying out the foundation for data protection: Data owners are not recognizing the "right thing" to do. They don't have a security policy. Network administrator not taking mandatory two week vacation: The two week vacation is the "right thing" to do, but not taking the vacation violates due diligence (not doing the right thing the right way) Reference(s) used for this question: Shon Harris, CISSP All In One, Version 5, Chapter 3, pg 110
CISSP Exam Question 299
Tape arrays use a large device with multiple (sometimes 32 or 64) tapes that are configured as a?
Correct Answer: A
This is the function of a tape robot/changer working on a media library / jukebox. We can get as many as 32 / 64 or even more tapes action as a single logical unit. You can have a robot that changes and retrieves the different tapes when they are needed, so you see the whole bunch of tapes as it's a single logical storage solution for you. This kind of solutions are very expensive.
CISSP Exam Question 300
In an expert system, the process of beginning with a possible solution and using the knowledge in the knowledge base to justify the solution based on the raw input data is called:
Correct Answer: D
Backward chaining is generally used when there are a large number of possible solutions relative to the number of inputs. *Answer Dynamic reasoning is a distracter. Answer forward chaining, is the reasoning approach that can be used when there is a small number of solutions relative to the number of inputs. The input data is used to reason forward to prove that one of the possible solutions in a small solution set is the correct one. *The blackboard is an expert system reasoning methodology in which a solution is generated by the use of a virtual blackboard wherein information or potential solutions are placed on the blackboard by a plurality of individuals or expert knowledge sources. As more information is placed on the blackboard in an iterative process, a solution is generated.