Certified Information Systems Security Professional CISSP (CISSP) — Questions 751–816

This is the correct Annualized Loss Expectancy (ALE), derived from accurately applying the quantitative risk analysis formula. First, the Single Loss Expectancy (SLE) is calculated as the Asset Value ($100,000) multiplied by the Exposure Factor (0.4), yielding $40,000. This SLE is then correctly multiplied by the Annualized Rate of Occurrence (2) to determine the total expected financial loss over a year, which is $80,000.

Implementing strong authentication, such as multi-factor authentication (MFA), is paramount for SSL VPNs because the gateway often presents an internet-facing web portal, making it a prime target for credential-based attacks. MFA adds a crucial layer of security by requiring users to provide two or more verification factors, significantly reducing the risk of unauthorized access even if a user's password is compromised. This protection is vital for safeguarding the internal network resources accessible via the VPN.

Isolating the server from the network is the immediate and most effective containment strategy. This action severs the malicious outbound connection, preventing further data exfiltration, command-and-control communication, and potential lateral movement to other systems. By containing the threat, the analyst preserves the compromised system's state for subsequent forensic analysis, allowing for a thorough investigation without the risk of ongoing damage or evidence tampering. This critical first step minimizes the incident's overall impact.

Regulatory frameworks such as HIPAA, PCI-DSS, and SOX mandate strict access control policies, including the prompt deprovisioning of inactive or terminated user accounts. Failing to identify and disable these orphaned accounts directly violates compliance requirements, potentially resulting in severe financial penalties, failed audits, and legal liabilities for the organization.

The Clark-Wilson integrity model is specifically designed for commercial applications requiring strong data integrity through well-formed transactions and separation of duties. It distinguishes between Constrained Data Items (CDIs) and Unconstrained Data Items (UDIs), enforcing that all modifications to CDIs must occur through certified Transformation Procedures (TPs). These TPs are executed by subjects under strict access control rules, ensuring that data integrity is maintained through controlled operations and preventing unauthorized or erroneous data manipulation, perfectly aligning with the need for doctors to write new, valid health records.

An application proxy terminates the client connection and rebuilds it to the server, fully parsing Layer 7 payloads. This lets it inspect HTTP methods and SQL statements and block specific commands, satisfying the requirement to filter application content rather than merely ports and addresses.

This scenario describes an authorization failure, not a Kerberos authentication failure. The user successfully obtained a Service Ticket from the Key Distribution Center (KDC) for the file server, indicating successful authentication. However, when the user presented this valid ticket to the file server, the server's Access Control Lists (ACLs) for the requested resource denied access, resulting in an "Access Denied" message.

The primary purpose of a chain of custody in digital forensics is to establish an unbroken, documented chronological record of the possession, handling, transfer, and analysis of digital evidence. This meticulous record demonstrates that the evidence has not been altered, substituted, or tampered with from the moment of its collection until its presentation in court, thereby preserving its integrity. By proving the evidence's authenticity and reliability, the chain of custody is absolutely critical for ensuring its legal admissibility and weight in any judicial proceeding.

The General Data Protection Regulation (GDPR) explicitly mandates that organizations report personal data breaches to the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This strict timeline applies unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. It also requires notification to affected data subjects if the breach poses a high risk.

SSRF is exactly this pattern: the API accepts a user-supplied URL or parameter and the server-side code then fetches that resource on the caller's behalf. Because the request originates from the server, it inherits the server's network position and often bypasses firewall rules that would block a direct external request. Attackers abuse this to reach internal-only services, cloud metadata endpoints, or other systems that were never intended to be reachable from outside the network perimeter.

Confidentiality is the principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. Data classification policies directly support confidentiality by categorizing information based on its sensitivity and value, thereby dictating the necessary controls to prevent unauthorized access and disclosure. Labeling information as 'confidential' explicitly aims to restrict its viewing to approved parties, making unauthorized disclosure a direct violation of this principle.

Using minimal base images significantly reduces the attack surface by including only essential components, thereby limiting potential vulnerabilities from unnecessary software packages or services. Regularly scanning these images for vulnerabilities, often through tools like Clair or Trivy, is critical to identify and remediate known Common Vulnerabilities and Exposures (CVEs) before deployment. This proactive approach ensures that the deployed microservices are built upon a secure and well-vetted foundation, minimizing exposure to exploits.

While a single service account used by multiple applications will indeed lead to mixed audit trails, making it difficult to attribute specific actions to individual applications, this is a secondary consequence. The primary operational challenge and security risk stemming from shared accounts is not merely the complexity of log analysis, but rather the inability to manage credentials effectively and securely. The difficulty in auditing is a symptom, not the root operational problem this question targets.

Hashing the password with bcrypt using a unique salt per user is the industry-standard best practice for secure password storage. Bcrypt is an adaptive, slow hashing algorithm specifically designed to be computationally intensive, making brute-force and rainbow table attacks extremely difficult and time-consuming, even with powerful hardware. The unique salt ensures that identical passwords result in different hashes, preventing pre-computation attacks and making dictionary attacks against multiple users impractical.

Fencing around the property is a primary perimeter physical security control, establishing the outermost boundary of the secured area. Its purpose is to deter unauthorized entry, define the property line, and delay intruders before they can reach the building itself. This initial barrier provides the first line of defense against external threats, making it a foundational perimeter measure.

Analyzing log events is the foundational step in incident response, providing crucial intelligence about the attacker's methods, source IPs, and targeted accounts. This forensic analysis enables security teams to identify specific attack patterns, such as brute-force or credential stuffing, and determine the scope and nature of the threat. Implementing additional controls like Multi-Factor Authentication (MFA) directly addresses the risk of compromised credentials by requiring a second verification factor, significantly enhancing account security even if a password is breached. This targeted approach ensures effective mitigation while minimizing disruption.

Risk transfer is a strategic approach where the financial liability or responsibility for a specific risk is contractually shifted to a third party. This does not eliminate the underlying risk event itself, but rather reallocates the potential financial impact or operational burden. Common methods include purchasing insurance policies, outsourcing functions to vendors who assume associated risks, or incorporating indemnification clauses into service level agreements, thereby protecting the organization from direct financial loss.

Upgrading edge routers to models equipped with hardware-accelerated IPsec encryption is the most effective solution for high CPU utilization caused by cryptographic processing. Hardware acceleration offloads the computationally intensive encryption and decryption tasks from the main CPU to specialized co-processors or ASICs. This significantly reduces the CPU load, allowing the router to handle higher volumes of encrypted traffic with lower latency and improved overall network performance, without compromising security.

A perimeter fence serves as a foundational deterrent and delay mechanism, establishing the outermost boundary of a secured area. It acts as a primary physical control, designed to discourage unauthorized entry and provide early detection of intrusion attempts by forcing an attacker to spend time breaching it. This initial barrier is crucial for defining the property line and channeling legitimate access through controlled entry points.

Privileged Access Management (PAM) solutions are specifically engineered to secure, manage, and monitor highly sensitive administrative accounts and access to critical systems. They enforce just-in-time (JIT) access, granting elevated permissions only when an administrator needs them for a specific task and for a limited duration, thereby significantly minimizing the attack surface. PAM also typically includes essential features like session recording, password vaulting, and comprehensive audit trails, which are crucial for compliance and incident response related to high-risk administrative operations.

Discretionary Access Control (DAC) is an access control model where the owner of a resource (or an authorized administrator) has the discretion to grant or revoke access permissions to other users. This is typically implemented using Access Control Lists (ACLs) or capabilities, allowing owners to specify who can perform specific actions (read, write, execute) on their owned objects. DAC is highly flexible and widely used in commercial operating systems because it empowers data owners to manage access to their own data.

A stateful inspection firewall maintains a dynamic state table that tracks the context of active network connections, including TCP handshakes, sequence numbers, and connection direction. This allows it to automatically permit return traffic for established outbound connections, such as HTTP responses, without requiring explicit inbound rules for ephemeral ports. This capability significantly enhances security by only allowing expected return traffic and simplifies rule management for common protocols like HTTP.

Pre-commit hooks are scripts configured to execute automatically on a developer's local machine before the `git commit` command successfully completes. By integrating linters, which enforce coding standards and identify syntax errors, and secret scanners, which detect hardcoded credentials or sensitive information, these hooks provide immediate feedback. This mechanism ensures that security issues and quality concerns are identified and remediated at the absolute earliest possible stage, preventing flawed code from ever entering the shared repository.

The data custodian, such as a Database Administrator (DBA), is responsible for the practical implementation and maintenance of security controls and data management tasks. They perform day-to-day operations like backups, access control enforcement, patching, and monitoring, ensuring the data's confidentiality, integrity, and availability as directed by the data owner. This role involves the technical execution of policies and procedures to safeguard the data assets.

Recertification is the essential periodic process of formally reviewing and validating that users' current access rights and privileges remain appropriate and necessary for their assigned job functions. This proactive measure ensures adherence to the principle of least privilege over time, identifying and remediating instances of 'privilege creep' where users accumulate excessive permissions. It significantly reduces the organization's attack surface by eliminating unnecessary access.

An external audit is a formal, systematic examination performed by an independent, accredited third-party certification body to verify an organization's conformity with the ISO 27001 standard. This impartial assessment ensures objectivity and credibility, providing the necessary assurance for official certification. It is the definitive step required to achieve and maintain ISO 27001 compliance, as only an external body can grant the certification.

A hot site is a fully operational and configured disaster recovery facility, mirroring the primary site with all necessary hardware, software, and up-to-date data. It is designed for immediate activation, allowing critical business operations to resume within hours or even minutes, minimizing downtime and data loss. This level of readiness is crucial for systems with very low recovery time objectives (RTOs).

Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are fundamental and effective mitigations against buffer overflow vulnerabilities. DEP marks memory regions, such as the stack and heap, as non-executable, preventing an attacker from executing injected shellcode directly from these areas. ASLR randomizes the memory locations of key program components, making it significantly more difficult for an attacker to predict the exact addresses needed to launch successful return-oriented programming (ROP) attacks or jump to injected code.

A Type 1 hypervisor, also known as a bare-metal hypervisor, runs directly on the host hardware without an intervening operating system. This architecture provides a significantly reduced attack surface because it has a minimal codebase and fewer dependencies than a hypervisor running on a host OS. Its direct control over hardware resources and strong isolation capabilities make it the most secure choice for critical infrastructure and sensitive workloads.

TEMPEST shielding involves applying specialized materials, filters, and design principles directly to electronic equipment to suppress compromising electromagnetic emanations. This standard prevents adversaries from intercepting and reconstructing sensitive data processed by the system through transient electromagnetic pulse emanations.

The Data Link layer, Layer 2, is responsible for node-to-node data transfer within the same local network segment, using Media Access Control (MAC) addresses for frame delivery. ARP (Address Resolution Protocol) directly facilitates this by resolving an IP address (Layer 3) to its corresponding MAC address (Layer 2), enabling devices to communicate directly on the local network.

Implementing client-side encryption ensures that the financial institution encrypts its customer data *before* it ever leaves their on-premises environment and is transmitted to the cloud provider. This critical step means the cloud provider only ever receives ciphertext, never the sensitive plaintext data. Furthermore, by storing the encryption keys exclusively on-premises, the institution maintains absolute control over the decryption process, preventing any unauthorized access by the cloud provider or external entities, which is paramount for data sovereignty and regulatory compliance.

Resource Public Key Infrastructure (RPKI) provides a cryptographic framework for verifying the legitimate origin of IP address blocks. It allows IP address holders to create cryptographically signed statements, called Route Origin Authorizations (ROAs), which specify which Autonomous Systems (ASes) are authorized to originate their prefixes. BGP routers can then validate incoming route announcements against these ROAs, rejecting any routes that are not authorized, thereby directly mitigating route hijacking and mis-origination.

Parameterised queries separate SQL code from user-supplied data, so input is treated as a value rather than executable syntax. This eliminates the injection vector at its source, unlike input sanitisation or escaping, which are bypassable and error-prone.

Event ID 4625 is the definitive Windows Security Event ID for a failed logon attempt. Within the event details, a specific 'Sub Status' or 'Failure Code' (e.g., 0xC0000234, which translates to `STATUS_ACCOUNT_LOCKED_OUT`) precisely indicates the reason for the logon failure. If the exhibit shows this particular sub-status, it directly confirms that the logon failed because the account was locked out, typically due to exceeding the maximum number of incorrect password attempts as defined by account lockout policy.

The Distinguished Name (DN) serves as the absolute and unambiguous identifier for every entry within an LDAP directory. It is a sequence of Relative Distinguished Names (RDNs) that traces a unique path from the root of the directory information tree (DIT) down to the specific entry. This hierarchical structure ensures that no two entries can possess the exact same DN, guaranteeing global uniqueness across the entire LDAP directory service.

The AAA (Authentication, Authorization, and Accounting) framework is the fundamental model for implementing access control systems, directly addressing the core requirements for managing user access. Authentication verifies a user's identity, ensuring only legitimate entities can attempt access to resources. Authorization then determines what specific actions the authenticated user is permitted to perform, based on defined policies and privileges. Finally, Accounting tracks user activities and resource consumption, providing an essential audit trail for accountability, billing, and compliance purposes.

SAST (Static Application Security Testing) directly examines an application's source code, bytecode, or binary code without executing it, making it a 'white-box' testing method. It identifies potential vulnerabilities such as buffer overflows, SQL injection flaws, or insecure coding practices by analyzing the code's structure, data flow, and control flow statically. This approach is ideal for developers to find and fix security flaws early in the Software Development Life Cycle (SDLC) before deployment.

Tracking open vulnerabilities segmented by severity (critical, high, medium, low) gives the board a direct, current-state view of unremediated risk exposure. Because it's broken out by severity rather than a single aggregate number, it lets leadership see whether the highest-risk items are being prioritized correctly, and trends over time reveal whether the program is keeping pace with new findings or falling behind.

The CIA triad fundamentally defines the three paramount objectives that information security strives to achieve: Confidentiality, Integrity, and Availability. This foundational model provides a universal language and framework for understanding, categorizing, and prioritizing security goals across all aspects of information systems and data protection.

For a VPN client to successfully initiate a connection, the VPN server must have its VPN service actively running and configured to listen for incoming connection requests on the expected port, typically UDP port 500 for IKE. If the service is stopped, crashed, or misconfigured to listen on a different port or interface, the server will not respond to client connection attempts on UDP port 500. This lack of response will cause the client to time out, indicating a server-side availability issue.

Implementing a developers' feedback loop for false positives is crucial for refining security tools and processes. This mechanism allows developers to report inaccurate alerts, providing essential data for security teams to tune SAST and SCA tools effectively. Tuning involves creating custom rules, adjusting sensitivity, or suppressing known benign patterns, which significantly reduces alert fatigue, improves the signal-to-noise ratio, and ensures that legitimate vulnerabilities are prioritized and addressed efficiently without sacrificing comprehensive scanning.

Storing session tokens in cookies with the Secure flag ensures they are only transmitted over encrypted HTTPS connections, preventing passive network eavesdropping. The HttpOnly flag prevents client-side scripts, such as JavaScript, from accessing the cookie's content, significantly mitigating the risk of session token theft via Cross-Site Scripting (XSS) attacks. These flags collectively enhance the confidentiality and integrity of session tokens during transit and storage.

Unlike passwords or tokens that can be reset or reissued, a compromised biometric template, derived from immutable physical characteristics like fingerprints or iris patterns, cannot be revoked or changed. This permanence means that once an attacker obtains a biometric template, that specific biometric trait is permanently compromised for authentication purposes, posing a significant long-term security risk. Organizations must implement robust template protection mechanisms, such as encryption and tokenization, to mitigate this inherent vulnerability.

The data controller is the entity that, alone or jointly with others, determines the purposes (why data is processed) and the means (how data is processed) of personal data processing. This fundamental responsibility establishes their primary accountability under GDPR for compliance and safeguarding data subjects' rights. Their decision-making power over the processing lifecycle directly aligns with the question's premise.

Deploying a Data Loss Prevention (DLP) solution directly addresses the problem by providing automated, policy-driven controls to monitor, identify, and prevent the unauthorized or accidental sharing of sensitive data. DLP systems can inspect data in motion (network traffic), data at rest (storage), and data in use (endpoints), blocking transfers that violate predefined security policies. This proactive technical control ensures that sensitive information, regardless of its format or destination, is not inadvertently or maliciously exfiltrated from the corporate environment.

The authpriv facility carries authentication and authorization messages on Linux, so forwarding it to a hardened remote collector preserves the events. Writing to write-once media plus remote shipping makes the record tamper-evident and supports the one-year retention the auditor demands, because local compromise cannot silently rewrite already-archived entries.

Full-disk encryption (FDE) provides comprehensive data protection by encrypting all data stored on the entire hard drive, including the operating system, applications, and user files. This ensures that even if a stolen laptop's hard drive is removed and connected to another system, the data remains unreadable and inaccessible without the correct decryption key or passphrase. FDE is a robust control for protecting data at rest, making it the most effective solution for preventing unauthorized access to sensitive information on a lost or stolen device.

The authorization code grant with PKCE lets the budgeting app obtain a limited access token after the customer authenticates directly with the bank, so credentials are never shared. PKCE protects the code exchange from interception on public clients such as mobile apps, matching the delegation and security requirements of this scenario.

A hard drive (HDD) or solid-state drive (SSD) stores data persistently when not actively being read from or written to. This includes files, operating system components, and applications residing on the disk, awaiting access. Such data is considered "at rest" because it is static and not actively traversing a network or being processed by a CPU, making it a prime target for encryption.

Escalating the incident to a Tier 2 analyst for further investigation is the correct and standard procedure for a Tier 1 SOC analyst who has identified a potential malware infection. Tier 1 analysts are primarily responsible for initial alert triage, basic investigation, and confirming the legitimacy of an alert. If the incident requires more advanced analysis, specialized tools, or decision-making beyond their scope, proper escalation ensures the incident is handled by personnel with the appropriate expertise and authority, following established incident response playbooks.

When Dynamic Trunking Protocol (DTP) is enabled on an access port, it allows the port to actively negotiate its trunking status with a connected device. An attacker can leverage this by sending DTP frames from their connected machine, tricking the switch port into establishing a trunk link. Once a trunk is formed, the attacker can then send specially crafted 802.1Q tagged frames, allowing them to access and communicate with any VLAN configured on that trunk, thereby successfully performing a VLAN hopping attack. This misconfiguration directly enables the vulnerability.

Separation of duties is a control designed to prevent fraud, error, and abuse by ensuring that no single individual has complete control over a critical process from start to finish. It mandates that different individuals perform distinct parts of a sensitive task, such as authorizing, recording, and reconciling transactions. This structure prevents a single employee from both initiating and approving a financial transaction, thereby mitigating the risk of unauthorized actions.

IPsec tunnel mode encrypts the entire original packet and encapsulates it, providing confidentiality and mutual endpoint authentication via IKE. This satisfies the requirement to protect all traffic across the untrusted WAN while verifying both data-centre gateways.

Automated scanning with pass/fail gating embeds security checks directly into the pipeline, so vulnerabilities halt builds without manual review stages. This enforces security consistently while preserving development velocity, unlike periodic or advisory-only scanning that adds friction or delays.

Criticality prioritization is a core activity within a Business Impact Analysis (BIA), where business processes and assets are systematically evaluated and ranked based on their importance to the organization's mission and the potential impact of their disruption. This ranking helps allocate recovery resources effectively, ensuring that the most vital functions receive immediate attention during a disruptive event. It directly informs the development of recovery strategies and objectives.

Denial of Service (DoS) is a critical incident category because it directly impacts the availability of systems and services, often rendering them inaccessible to legitimate users. This type of attack involves overwhelming a target with traffic or requests, consuming resources, and preventing normal operation. Such an event requires immediate incident response to restore service and mitigate ongoing impact.

A card reader at a building entrance is a definitive physical access control mechanism, serving as a critical layer in a defense-in-depth strategy. It enforces authentication and authorization requirements before granting physical entry to a facility, directly restricting human movement and protecting all assets within from unauthorized personnel.

IAST is a modern security testing method that instruments the application code and observes its behavior from within during automated or manual functional tests. It provides real-time analysis of application interactions, identifying vulnerabilities with high accuracy by understanding both code execution and data flow. This integration into existing testing processes makes it highly effective for finding flaws early in the development lifecycle.

A Privileged Access Management (PAM) solution is purpose-built to secure, manage, and monitor all forms of privileged access within an organization. It provides essential capabilities such as automated password rotation for privileged accounts, secure credential vaulting, just-in-time access provisioning, and comprehensive session recording and monitoring. PAM solutions generate detailed audit trails of all privileged activities, ensuring accountability, enforcing the principle of least privilege, and significantly reducing the attack surface associated with high-risk accounts.

An orphaned account is a user or service account that no longer has an active, accountable owner or associated employee, often due to an employee's departure without proper deprovisioning. When a security analyst discovers such an account during an access rights review, it represents a significant security vulnerability as it could be exploited without detection or used to maintain unauthorized access. These accounts pose a risk because they lack oversight and may retain elevated privileges, making them prime targets for malicious actors. Identifying them is a critical part of regular access reviews and identity lifecycle management.

Encoding all user-supplied data before reflecting it in the response is the primary and most effective defense against reflected Cross-Site Scripting (XSS) attacks. This process transforms potentially malicious characters (e.g., '<', '>', '&') into their safe, non-executable HTML entity equivalents (e.g., '&lt;', '&gt;', '&amp;'). By ensuring the browser interprets user input as inert data rather than executable code, this practice directly prevents the injection and execution of malicious scripts within the user's browser.

OWASP ZAP is a leading open-source Dynamic Application Security Testing (DAST) tool specifically designed to find vulnerabilities in running web applications. It actively proxies HTTP/S traffic, allowing it to scan for common web vulnerabilities like SQL injection, Cross-Site Scripting (XSS), and broken authentication by interacting with the application as a real user would. This makes it ideal for identifying security flaws that manifest at runtime, after the application has been deployed.

RASP (Runtime Application Self-Protection) directly integrates with the application's runtime environment, actively monitoring its execution, data inputs, and outputs in real-time. By instrumenting the application, RASP can detect and immediately block malicious requests or anomalous behavior that indicates an attempted exploit, such as SQL injection or cross-site scripting. Its core purpose is to provide continuous, self-contained protection against attacks in live production systems.

Automated SAST in the CI/CD pipeline provides continuous code analysis, catching vulnerabilities as code is committed. This aligns with Agile's fast iterations and enables developers to fix issues immediately. It scales security across the team without slowing down delivery, making it a best practice for integrating security into the development lifecycle.