Your organization implemented a database that allows multiple tuples in a relation sharing the same primary key and distinguished by their security levels. Which of the following is the primary security objective for the implementation?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Learning is a process of gaining a continuum of knowledge that entails different activities, such as awareness, training, and education. Which of the following is the best teaching method for training?
A. Videos
B. Posters
C. Case study
D. Seminar and discussion
The in-house development team developed a microservices-based customer relationship management (CRM) system, deployed as a private cloud solution utilizing containerization services. Your company is expected to gain a sustainable competitive advantage because of the novel software architectural design and innovative data analytics. Which of the following is the best intellectual property law to protect your source code?
A. Patent
B. Trade secret
C. Copyright
D. Trademark
As the customer relationship management (CRM) system owner, you collaborate with data owners and other stakeholders to determine the scope of security controls. Which of the following actions should be taken first?
A. Select controls
B. Categorize the system
C. Assess risk to the system
D. Determine the impact of data
An information security assessment is the process of determining how effectively an entity being assessed (e.g., host, system, network, procedure, person—known as the assessment object) meets specific security objectives. Three types of assessment methods can be used to accomplish this—testing, examination, and interviewing.
Assessment results are used to support the determination of security control effectiveness over time.
Source: NIST SP 800-115
CISSP不是黃金證照，它只是資安專業人員的入門磚。建立這個基本的專業要求，是本群組成立的主要宗旨。
Effective CISSP英文群組自2019年08月成立以來，至今1年半的時間，會員人數已成長至4200人左右。但其內容以英文為主，台灣的朋友參與英文群組或論壇的程度仍相當有限。希望透過中文群組”追求高效能的CISSP“，能啟動台灣資安人員對於CISSP認證的重視。也希望能透過CISSP證照的推廣，為台灣業界對於基本資安素養的要求，立下新標竿！
期待不久的未來，台灣每一位把資安作為專業的人員，都有一張CISSP的基本證照！
學而時習之，不亦說乎！祝大家考試順利！
Continue readingAs the customer relationship management (CRM) system owner, you collaborate with data owners and other stakeholders to determine the scope of security controls. Which of the following is the best source to inform the scoping decision?
A. The assessment of risk to the system
B. The result of business impact analysis (BIA)
C. The design of the security architecture
D. The detailed plan for certification and accreditation
The Code of Federal Regulations (CFR) is the codification of the general and permanent rules and regulations (sometimes called administrative law) published in the Federal Register by the executive departments and agencies of the federal government of the United States. The CFR is divided into 50 titles that represent broad areas subject to federal regulation.
The CFR annual edition is the codification of the general and permanent rules published by the Office of the Federal Register (part of the National Archives and Records Administration) and the Government Publishing Office.[1] In addition to this annual edition, the CFR is published in an unofficial format online on the Electronic CFR website, which is updated daily.
Source: Wikipedia
The Federal Register (FR or sometimes Fed. Reg.) is the official journal of the federal government of the United States that contains government agency rules, proposed rules, and public notices. It is published every weekday, except on federal holidays.
The final rules promulgated by a federal agency and published in the Federal Register are ultimately reorganized by topic or subject matter and codified in the Code of Federal Regulations (CFR), which is updated annually.
The Federal Register is compiled by the Office of the Federal Register (within the National Archives and Records Administration) and is printed by the Government Publishing Office. There are no copyright restrictions on the Federal Register; as a work of the U.S. government, it is in the public domain.
Source: Wikipedia
Source: The provisions of Executive Order 12356 of Apr. 2, 1982, appear at 47 FR 14874 and 15557, 3 CFR, 1982 Comp., p. 166, unless otherwise noted.
I want to share my success story by presenting my accomplishment in the certification exams and introducing my books to help you succeed in 2021!
After working in the IT industry for 26 years and engaging in various business areas, I effectively and efficiently passed several major cybersecurity exams. I passed the CISSP exam in 53 days and other ISC2 certification exams in less than two weeks, as the following diagram shows.
In addition to work experience and security certifications, I am also certified in various areas:
– EMBA/CBAP/PMP/ACP/PBA/RMP
– CGEIT/CISM/CRISC/CISA
– CISSP-ISSMP,ISSEP,ISSAP/CCSP/CSSLP
– CEH/ECSA/AWS-CSAA/MCSD/MCSE/MCDBA
– SCRUM: PSM Level I/PSPO Level I/PSD Level I
– ISO 27001 LA/ISO 27701 LA Courses Completed
So, it’s an advantage for me to organize the core cybersecurity concepts from multiple disciplines, such as business administration, information technologies, information security, risk management, systems and software engineering, requirement engineering, project management, agile, cloud computing, ISO standards, NIST guidelines, etc.
My first book introduces those core cybersecurity concepts that:
My second book is a compilation of the CISSP question of the day or QOTD (aka Wentz QOTD). While they are available for free on my blog, this book organizes QOTDs into categories, which helps you learn more efficiently.
You can get my books on Amazon through the following links:
I hope you enjoy the journey to success in 2021 and look forward to your good news!