Monthly Archives: October 2019

CISSP PRACTICE QUESTIONS – 20191004

Posted on by
1

Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house by an integrated product team (IPT). In a meeting, the IPT is discussing the solution using UML diagrams from a variety of views, such as user, logical, process, implementation, and deployment views. Which of the following is the IPT doing?
A. Feasibility analysis
B. Requirement analysis
C. Developing User Requirement Specification (URS)
D. Design review

Continue reading →

CISSP PRACTICE QUESTIONS – 20191003

Posted on by
Reply

Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house.  The client is executed in modern web browsers. The development team is evaluating the single sign-on (SSO) solution. Which of the following least likely meets the requirement of SSO?
A. OAuth
B. OIDC (OpenId Connect)
C. SAML (Security Assertion Markup Language)
D. XACML (eXtensible Access Control Markup Language)
Continue reading →

CISSP PRACTICE QUESTIONS – 20191002

Posted on by
Reply

Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house.  The development team is evaluating the software runtime environment of the client with security concerns as the first priority. Considering the confinement and bound issues, which of the following is the most secure or restrictive environment?
A. Application Runtime Framework (e.g. JVM or .NET)
B. Modern Web Browser
C. Bare metal hypervisor (Type I)
D. Hosted hypervisor (Type II)
Continue reading →

DNSSEC – What Is It and Why Is It Important?

Posted on by
Reply

Digest

  • DNSSEC strengthens authentication in DNS using digital signatures based on public key cryptography.
  • Every DNS zone has a public/private key pair. The zone owner uses the zone’s private key to sign DNS data in the zone and generate digital signatures over that data.
  • The zone’s public key, however, is published in the zone itself for anyone to retrieve.
  • Recursive resolvers cache the DNS data they receive from authoritative name servers to speed up the resolution process.
  • This reliance on caching has a downside, however: if an attacker sends a forged DNS response that is accepted by a recursive resolver, the attacker has poisoned the cache of the recursive resolver. The resolver will then proceed to return the fraudulent DNS data to other devices that query for it.

Source: DNSSEC – What Is It and Why Is It Important?

Example

As an example of the threat posed by a cache-poisoning attack, consider what happens when a user visits their bank’s website. The user’s device queries its configured recursive name server for the bank web site’s IP address. But an attacker could have poisoned the resolver with an IP address that points not to the legitimate site but to a web site created by the attacker. This fraudulent website impersonates the bank website and looks just the same. The unknowing user would enter their name and password, as usual. Unfortunately, the user has inadvertently providing their banking credentials to the attacker, who could then log in as that user at the legitimate bank web site to transfer funds or take other unauthorized actions.

Source: DNSSEC – What Is It and Why Is It Important?

Recommended Reading