Peer CISSPs (Chang Zhan-Shuo, Sky Lin) who attended my class suggest developing a wall of legends and donate copies of their CISSP certificates. Our shared vision is to bombard the wall with certificates. Awesome idea!
The Wall of Legends
Reply
Monthly Archives: May 2020
Democracy and Security
A reader from Hong Kong asked me for security solutions against surveillance because he/she is worried about facial recognition and cameras that monitor people.
Democracy, I replied.
As technologies evolve, it’s getting harder for people to fight against machines that are originally created to protect us. We don’t fight against machines but the government that uses them with evil intentions.
Democracy is the administrative control to mitigate the risk of evil governance of a country.
CISSP PRACTICE QUESTIONS – 20200514
Incident response is one of the major organizational capabilities. As an information security manager, you are developing the incident management plan for incident response. Which of the following is the least concern?
A. Computer forensics
B. Call tree
C. Spokesperson
D. Relocation
I’m So Grateful for Your Comments!
After 8 months of hard working on this book, I’m so grateful for receiving comments and knowing my book helps:)
https://www.amazon.com/
CISSP PRACTICE QUESTIONS – 20200513
Your company sells toys online worldwide, which is supported by a three-tiered E-Commerce web-based system. As a security professional, you are participating in a threat modeling meeting. Which of the following is the least concern?
A. Processing in the business logic tier
B. Rendering output to the data tier
C. Accepting input from the presentation tier
D. Data flow between tiers
CISSP PRACTICE QUESTIONS – 20200512
Your company sells toys online worldwide. As a data owner, the sales manager is granting privileges of access to the customer profiles to Alice. Which of the following is the best security model that supports access control and enforces confidentiality?
A. Graham-Denning Model
B. Clark-Wilson Model
C. Biba Model
D. Bell-LaPadula model
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
CISSP PRACTICE QUESTIONS – 20200511
Your company outsourced the penetration testing project to an external party conducting ethical hacking. The project, as a black box, is conducted in secret. Which of the following is least likely to entail penetration testing?
A. Patch management
B. Risk assessment
C. Security control assessment
D. Threat modeling
CISSP PRACTICE QUESTIONS – 20200510
Your company sells toys online worldwide. Supporting information systems implements DAC, RBAC, ABAC, and RuBAC to mediate access control. The sales manager, as a data owner, is considering authorizing Alice access to the customer profiles. Which of the following is the least concern?
A. Need-to-know
B. Least privilege
C. Conflict of interest
D. Security clearance
CISSP PRACTICE QUESTIONS – 20200509
In physical security, the employment of barriers with the capacity to delay the progress of an intruder is one of the security designs of the Defense-in-Depth (DiD) strategy. To validate the effectiveness of the design, which of the following should be conducted first?
A. Target hardening
B. Universal element conceptual mapping
C. Critical path analysis
D. Fire drill to protect life
Penetration Testing Certifications: Offensive Security’s Offerings
Offensive Security’s Certification Offerings for Penetration Testing are highly recognized in the industry. They provide both training courses and certifications.
Courses and Certifications
- Penetration Testing with Kali Linux (PWK) for the Offensive Security Certified Professional (OSCP) certification
- Advanced Web Attacks and Exploitation (AWAE) for the Offensive Security Web Expert (OSWE) certification
- Cracking the Perimeter (CTP) for the Offensive Security Certified Expert (OSCE)
- Advanced Windows Exploitation (AWE) for the Offensive Security Exploitation Expert (OSEE) certification
- Offensive Security Wireless Attacks (WiFu) for the Offensive Security Wireless Professional (OSWP) certification
The Strategic Role of CISSP
CISSP plays a strategic and central role in security certifications. It builds a solid foundation to extend career path to security governance, security management, security operations, and other specialty security areas such as cloud security, software security, and infrastructure security.
CISSP incorporates comprehensive perspectives on information security. It is a mile wide and an inch deep and emphasizes both management and technical concepts. It also meets the requirements of the DoD Directive 8570.1-M as one of the baseline certifications for a majority of information assurance job positions.
A Blueprint for Your Success in CISSP
My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and informative reference for security professionals.
- It is available on Amazon.
- Readers from countries or regions not supported by Amazon can get your copy from the author’s web site.
