Register your productto gain access to bonus material or receive a coupon.
CISSP Exam Cram, 5th Edition
- ByMichael Gregg
- Published Aug 10, 2021 byPearson IT Certification. Part of theExam Cramseries.
Best Value Purchase
Book + eBook Bundle
- Your Price: $60.99
- List Price: $109.98
- About Premium Edition eBooks
More Purchase Options
Premium Edition eBook
- Your Price: $47.99
- List Price: $59.99
- About Premium Edition eBooks
About
Features
- Fully reflects the major the changes in the new CISSP exam
- Designed to help candidates rapidly assess where they stand--and quickly master what they need to learn
- Includes test-taking strategies, time-saving tips, Exam Notes, and two sample exams delivered by the state-of-the-art PCPT test engine
Description
- Copyright 2022
- Dimensions: 6" x 9"
- Pages: 800
- Edition: 5th
- Book
- ISBN-10: 0-13-741955-4
- ISBN-13: 978-0-13-741955-5
CISSP Exam Cram, Fifth Edition is the perfect study guide to help you pass the latest update to the eight-domain version of the CISSP exam. It offers knowledge and practice questions for every exam topic, with new coverage of asset retention, secure provisioning, crypto attacks, machine learning tools, threat hunting, risk-based access control, zero trust, SAML, SOAR, CASB, securing microservices, containers, managed services, and more.
Covers the critical information youll need to score higher on your CISSP exam!
- 理解安全与风险管理:道德、秒urity concepts, governance, compliance, law/regulation, policies/procedures, threat models, supply chain risk, awareness training, and more
- Ensure Secure Assets: identify/classify information and assets; handling requirements, resource provisioning, data lifecycles, retention
- Review Security Architecture & Engineering: secure processes and principles, security models and controls, system capabilities, vulnerability assessment/mitigation, crypto attacks/solutions, site/facility design and controls
- Improve Communication & Network Security: secure network architectures, components, and channels
- Strengthen Identity & Access Management (IAM): physical/logical access control, identification, authentication, federated identity services, authorization, identity/access provisioning
- Enhance Security Assessment & Testing: design/validate assessment, test, and audit strategies; test controls; collect process data; evaluate and report test results; conduct or support audits
- Manage Security Operations: investigations, logs, monitoring, resource protection, incident management, detection/prevention; configuration, patches, vulnerabilities, and change
- management; DR/BC, physical and personnel security, and more
Premium Edition
The exciting newCISSP Exam Cram, 5th Edition, Premium Edition eBook and Practice Test is a digital-only certification preparation product combining an eBook with enhanced Pearson IT Certification Practice Test. The Premium Edition eBook and Practice Test contains the following items:
- The CISSP Premium Edition Practice Test, including four full practice exams and enhanced practice test features
- PDF and EPUB formats of the CISSP Exam Cram, Fifth Edition from Pearson IT Certification, which are accessible via your PC, tablet, and Smartphone
This Premium Edition contains an enhanced version of the Pearson IT Certification Practice Test (PCPT) software with four full practice exams. In addition, it contains all the chapter-opening assessment questions from the book. This integrated learning package:
- Allows you to focus on individual topic areas or take complete, timed exams
- Includes direct links from each question to detailed tutorials to help you understand the concepts behind the questions
- Provides unique sets of exam-realistic practice questions
- Tracks your performance and provides feedback on a module-by-module basis, laying out a complete assessment of your knowledge to help you focus your study where it is needed most
Pearson IT Certification Practice Test online system requirements:
Browsers: Chrome version 40 and above; Firefox version 35 and above; Safari version 7; Internet Explorer 10, 11; Microsoft Edge; Opera.
Devices: Desktop and laptop computers, tablets running on Android and iOS, smartphones with a minimum screen size of 4.7". Internet access required.
Pearson IT Certification Practice Test offline system requirements:
Windows 10, Windows 8.1, Windows 7; Microsoft .NET Framework 4.5 Client; Pentium-class 1 GHz processor (or equivalent); 512 MB RAM; 650 MB disk space plus 50 MB for each downloaded practice exam; access to the Internet to register and download exam databases
About the Premium Edition eBook
CISSP Exam Cram, 5th Edition, focuses specifically on the objectives for the CISSP exam introduced by (ISC)² in May 2021. It contains new or updated coverage of topics including asset retention, secure provisioning, crypto attacks, machine learning tools, threat hunting, risk-based access control, zero trust, SAML, SOAR, securing microservices, containers, and managed services, and more.
Internationally renowned cybersecurity expert Michael Gregg shares preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.
CISSP Exam Cram, 5th Edition presents you with an organized test preparation routine through the use of proven series elements and techniques. Extensive preparation tools include topic overviews, exam alerts, CramQuizzes, chapter-ending review questions, author notes and tips, an extensive glossary, flash cards, and the handy Cram Sheet tear-out: key facts in an easy-to-review format.
Well-regarded for its level of detail, assessment features, and challenging review questions and exercises, this study guide helps you master the concepts and techniques that will enable you to succeed on the exam the first time.
The study guide helps you master all the topics on all eight domains of the (ISC)² CISSP exam, including:
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management (IAM)
- Security Assessment and Testing
- Security Operations
- Software Development Security
Sample Content
Sample Pages
Download the sample pages(includes Chapter 2)
Table of Contents
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
CHAPTER 1: The CISSP Certification Exam. . . . . . . . . . . . . . . . . . . . 19
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Assessing Exam Readiness.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Exam Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Taking the Exam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Examples of CISSP Test Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . 24
Answer to Multiple-Choice Question.. . . . . . . . . . . . . . . . . . . . . . . . 26
Answer to Drag and Drop Question.. . . . . . . . . . . . . . . . . . . . . . . . . 26
Answer to Hotspot Question.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Question-Handling Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Mastering the Inner Game.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 28
CHAPTER 2: Understanding Asset Security . . . . . . . . . . . . . . . . . . . . 29
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Basic Security Principles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Data Management: Determining and Maintaining Ownership.. . . . . . . 32
Data Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Data Security, Protection, Sharing, and Dissemination.. . . . . . . . . . . . . 42
Classifying Information and Supporting Asset Classification.. . . . . . . . . 47
Asset Management and Governance.. . . . . . . . . . . . . . . . . . . . . . . . . 51
Determining Data Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . 55
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 66
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 67
CHAPTER 3: Security and Risk Management... . . . . . . . . . . . . . . . . . 69
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Security Governance.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
U.S. Legal System and Laws. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
International Legal Systems and Laws.. . . . . . . . . . . . . . . . . . . . . . . . 72
Global Legal and Regulatory Issues. . . . . . . . . . . . . . . . . . . . . . . . . . 74
Risk Management Concepts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Selecting Countermeasures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Threat Modeling Concepts and Methodologies. . . . . . . . . . . . . . . . . . 107
Managing Risk with the Supply Chain and Third Parties.. . . . . . . . . . . 110
Identifying and Prioritizing Business Continuity
Requirements Based on Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Developing and Implementing Security Policy.. . . . . . . . . . . . . . . . . . 123
Types of Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Implementing Personnel Security.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Security Education, Training, and Awareness.. . . . . . . . . . . . . . . . . . . 134
Professional Ethics Training and Awareness.. . . . . . . . . . . . . . . . . . . . 137
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 148
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 150
CHAPTER 4: Security Architecture and Engineering.. . . . . . . . . . . . . . 151
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Secure Design Guidelines and Governance Principles.. . . . . . . . . . . . . 152
Fundamental Concepts of Security Models. . . . . . . . . . . . . . . . . . . . . 158
Security Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Common Formal Security Models. . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Product Security Evaluation Models.. . . . . . . . . . . . . . . . . . . . . . . . . 189
System Validation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Vulnerabilities of Security Architectures. . . . . . . . . . . . . . . . . . . . . . . 195
Cryptography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Algorithms.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Cipher Types and Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Symmetric Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Asymmetric Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Hybrid Encryption.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Public Key Infrastructure and Key Management.. . . . . . . . . . . . . . . . . 225
Integrity and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Cryptographic Attacks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Site and Facility Security Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 240
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 246
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 248
CHAPTER 5: Communications and Network Security . . . . . . . . . . . . . 249
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Secure Network Design.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Network Models and Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
TCP/IP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
LANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Communication Standards.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Network Equipment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
Routing.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
WANs and Their Components.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Cloud Computing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Software-Defined WAN (SD-WAN).. . . . . . . . . . . . . . . . . . . . . . . . . 296
Securing Email Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . 296
Securing Voice and Wireless Communications.. . . . . . . . . . . . . . . . . . 298
Securing TCP/IP with Cryptographic Solutions.. . . . . . . . . . . . . . . . . 316
Network Access Control Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Remote Access.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Message Privacy and Multimedia Collaboration.. . . . . . . . . . . . . . . . . 331
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 337
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 338
CHAPTER 6: Identity and Access Management. . . . . . . . . . . . . . . . . . 341
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
Perimeter Physical Control Systems.. . . . . . . . . . . . . . . . . . . . . . . . . 344
Employee Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Identification, Authentication, and Authorization. . . . . . . . . . . . . . . . . 358
Single Sign-On (SSO).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
Authorization and Access Control Techniques. . . . . . . . . . . . . . . . . . . 382
Centralized and Decentralized Access Control Models. . . . . . . . . . . . . 390
Audits and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 408
Suggesting Reading and Resources.. . . . . . . . . . . . . . . . . . . . . . . . . . 410
CHAPTER 7: Security Assessment and Testing. . . . . . . . . . . . . . . . . . . 411
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412
Security Assessments and Penetration Test Strategies. . . . . . . . . . . . . . 412
Test Techniques and Methods.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424
Security Threats and Vulnerabilities.. . . . . . . . . . . . . . . . . . . . . . . . . 427
Network Security Threats and Attack Techniques.. . . . . . . . . . . . . . . . 431
访问控制威胁和攻击技术. .。。. . . . . . . . . . . . . . . 438
Social-Based Threats and Attack Techniques. . . . . . . . . . . . . . . . . . . . 443
Malicious Software Threats and Attack Techniques.. . . . . . . . . . . . . . . 444
Investigating Computer Crime.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
Disaster Recovery and Business Continuity.. . . . . . . . . . . . . . . . . . . . 458
Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 464
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 465
CHAPTER 8: Security Operations... . . . . . . . . . . . . . . . . . . . . . . . . . . 467
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468
Foundational Security Operations Concepts.. . . . . . . . . . . . . . . . . . . . 468
Resource Protection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
Telecommunication Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
System Resilience, Fault Tolerance, and Recovery Controls.. . . . . . . . . 486
Monitoring and Auditing Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . 487
Perimeter Security Controls and Risks. . . . . . . . . . . . . . . . . . . . . . . . 493
Facility Concerns and Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . 495
Environmental Controls.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502
Electrical Power.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503
Equipment Lifecycle.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Fire Prevention, Detection, and Suppression. . . . . . . . . . . . . . . . . . . . 505
Alarm Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509
Intrusion Detection and Prevention Systems. . . . . . . . . . . . . . . . . . . . 512
Investigations and Incidents.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Digital Forensics, Tools, Tactics, and Procedures.. . . . . . . . . . . . . . . . . 514
The Disaster Recovery Lifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 555
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 558
CHAPTER 9: Software Development Security... . . . . . . . . . . . . . . . . . . 559
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
Integrating Security into the Development Lifecycle.. . . . . . . . . . . . . . 560
Development Methodologies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573
Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
Database Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582
Programming Languages, Secure Coding Guidelines, and Standards.. . . 588
Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
Answers to Exam Prep Questions.. . . . . . . . . . . . . . . . . . . . . . . . . . . 603
需要知道更多 ?.. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 605
Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607
Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621
Answers to Practice Exam I.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
Answers to Practice Exam II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651
Glossary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
9780137419555, TOC, 6/7/2021
Updates
Errata
We've made every effort to ensure the accuracy of this book and its companion content. Any errors that have been confirmed since this book was published can be downloaded below.
Download the errata(48 KB .doc)