A trojan horse is a type of malware that masquerades as a legitimate program or file, but performs malicious actions in the background.  A trojan horse may open unauthorized ports on the infected system, allowing remote access or communication by the attacker or other malware 1 2 .  References :  1 : CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6, page 643 2 : CISSP For Dummies, 7th Edition, Chapter 6, page 189.

The least effective process for eliminating data prior to the media being discarded is high-level formatting. High-level formatting is the process of preparing a storage device, such as a hard disk or a flash drive, for data storage by creating a file system and marking the bad sectors. However, high-level formatting does not erase the data that was previously stored on the device. The data can still be recovered using data recovery tools or forensic techniques.  To prevent inadvertent disclosure of restricted information, more secure methods of data sanitization should be used, such as multiple-pass overwriting, degaussing, or physical destruction 3 4 .  References :  3 : Delete Sensitive Data before Discarding Your Media 9 4 : Best Practices for Media Destruction 10

A forensic specialist can exclude from examination a large percentage of operating system files residing on a copy of the target system by creating a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level. This method is also known as known file filtering or file signature analysis. It allows the forensic specialist to quickly identify and eliminate the files that are part of the standard operating system installation and focus on the files that are unique or relevant to the investigation.  This makes the process of exclusion much faster and more accurate than manually deleting or discarding files 1 2 .  References :  1 : Computer Forensics: Forensic Techniques, Part 1 [Updated 2019] 3 2 : Point Checklist: cissp book 4

The level of confidentiality of the information is the most important factor to consider when deciding whether to encrypt it or not when transmitting it over public networks.  Confidentiality is the property of preventing unauthorized disclosure of information, and encryption is a technique of transforming information into an unreadable format that can only be decrypted by authorized parties 2 . Public networks, such as the internet, are inherently insecure and vulnerable to interception, eavesdropping, or modification of the transmitted data. Therefore, encryption is necessary to protect the confidentiality of sensitive or classified information that may have legal, financial, or personal implications if disclosed.  The estimated monetary value, the presence of transient nodes, and the volume of the information are not as relevant as the level of confidentiality, as they do not directly reflect the impact or risk of data exposure.  References :  2 : CISSP For Dummies, 7th Edition, Chapter 3, page 63.

The goal of software assurance in application development is to prevent the creation of vulnerable applications. Software assurance is the process of ensuring that the software is designed, developed, and maintained in a secure, reliable, and trustworthy manner. Software assurance involves applying security principles, standards, and best practices throughout the software development life cycle, such as security requirements, design, coding, testing, deployment, and maintenance. Software assurance aims to prevent or reduce the introduction of vulnerabilities, defects, or errors in the software that could compromise its security, functionality, or quality .  References : : Software Assurance : Software Assurance - OWASP Cheat Sheet Series

Ensuring accountability for changes to the environment is the primary reason for implementing change management. Change management is a process that ensures that any changes to the system or network environment, such as the hardware, software, configuration, or documentation, are planned, approved, implemented, and documented in a controlled and consistent manner. Change management can provide several benefits, such as:

Improving the security and reliability of the system or network environment by preventing or reducing the errors, conflicts, or disruptions that might occur due to the changes

Enhancing the performance and efficiency of the system or network environment by optimizing the resources and functions

Increasing the compliance and alignment of the system or network environment with the internal or external requirements and standards

Facilitating the monitoring and improvement of the system or network environment by tracking and logging the changes and their outcomes

Ensuring accountability for changes to the environment is the primary reason for implementing change management, because it can ensure that the changes are authorized, justified, and traceable, and that the parties involved in the changes are responsible and accountable for their actions and results. Accountability can also help to deter or detect any unauthorized or malicious changes that might compromise the system or network environment.

The other options are not the primary reasons for implementing change management, but rather secondary or specific reasons for different aspects or phases of change management. Certifying and approving releases to the environment is a reason for implementing change management, but it is more relevant for the approval phase of change management, which is the phase that involves reviewing and validating the changes and their impacts, and granting or denying the permission to proceed with the changes. Providing version rollbacks for system changes is a reason for implementing change management, but it is more relevant for the implementation phase of change management, which is the phase that involves executing and monitoring the changes and their effects, and providing the backup and recovery options for the changes. Ensuring that all applications are approved is a reason for implementing change management, but it is more relevant for the application changes, which are the changes that affect the software components or services that provide the functionality or logic of the system or network environment.

 A continuous information security monitoring program can best reduce risk through encompassing people, process, and technology. A continuous information security monitoring program is a process that involves maintaining the ongoing awareness of the security status, events, and activities of a system or network, by collecting, analyzing, and reporting the security data and information, using various methods and tools. A continuous information security monitoring program can provide several benefits, such as:

Improving the security and risk management of the system or network by identifying and addressing the security weaknesses and gaps

Enhancing the security and decision making of the system or network by providing the evidence and information for the security analysis, evaluation, and reporting

Increasing the security and improvement of the system or network by providing the feedback and input for the security response, remediation, and optimization

Facilitating the compliance and alignment of the system or network with the internal or external requirements and standards

A continuous information security monitoring program can best reduce risk through encompassing people, process, and technology, because it can ensure that the continuous information security monitoring program is holistic and comprehensive, and that it covers all the aspects and elements of the system or network security. People, process, and technology are the three pillars of a continuous information security monitoring program, and they represent the following:

People: the human resources that are involved in the continuous information security monitoring program, such as the security analysts, the system administrators, the management, and the users. People are responsible for defining the security objectives and requirements, implementing and operating the security tools and controls, and monitoring and responding to the security events and incidents.

Process: the procedures and policies that are followed in the continuous information security monitoring program, such as the security standards and guidelines, the security roles and responsibilities, the security workflows and tasks, and the security metrics and indicators. Process is responsible for establishing and maintaining the security governance and compliance, ensuring the security consistency and efficiency, and measuring and evaluating the security performance and effectiveness.

Technology: the tools and systems that are used in the continuous information security monitoring program, such as the security sensors and agents, the security loggers and collectors, the security analyzers and correlators, and the security dashboards and reports. Technology is responsible for supporting and enabling the security functions and capabilities, providing the security visibility and awareness, and delivering the security data and information.

The other options are not the best ways to reduce risk through a continuous information security monitoring program, but rather specific or partial ways that can contribute to the risk reduction. Collecting security events and correlating them to identify anomalies is a specific way to reduce risk through a continuous information security monitoring program, but it is not the best way, because it only focuses on one aspect of the security data and information, and it does not address the other aspects, such as the security objectives and requirements, the security controls and measures, and the security feedback and improvement. Facilitating system-wide visibility into the activities of critical user accounts is a partial way to reduce risk through a continuous information security monitoring program, but it is not the best way, because it only covers one element of the system or network security, and it does not cover the other elements, such as the security threats and vulnerabilities, the security incidents and impacts, and the security response and remediation. Logging both scheduled and unscheduled system changes is a specific way to reduce risk through a continuous information security monitoring program, but it is not the best way, because it only focuses on one type of the security events and activities, and it does not focus on the other types, such as the security alerts and notifications, the security analysis and correlation, and the security reporting and documentation.

Recovery strategies of a Disaster Recovery planning (DRP) must be aligned with the cost/benefit analysis and business objectives. A DRP is a part of a BCP/DRP that focuses on restoring the normal operation of the organization’s IT systems and infrastructure after a disruption or disaster. A DRP should include various components, such as:

Risk assessment: a process that identifies and evaluates the potential threats and vulnerabilities that might affect the IT systems and infrastructure, and estimates the likelihood and impact of a disruption or disaster

Recovery objectives: a process that defines and quantifies the acceptable levels of recovery for the IT systems and infrastructure, such as the recovery point objective (RPO), which is the maximum amount of data loss that can be tolerated, and the recovery time objective (RTO), which is the maximum amount of downtime that can be tolerated

Recovery strategies: a process that selects and implements the appropriate methods and resources to recover the IT systems and infrastructure, such as backup, replication, redundancy, or failover

DRP document: a document that outlines and details the scope, purpose, and features of the DRP, such as the roles and responsibilities, the recovery procedures, and the contact information

Testing, training, and exercises: a process that evaluates and validates the effectiveness and readiness of the DRP, and educates and trains the relevant stakeholders, such as the IT staff, the management, and the users, on the DRP and their roles and responsibilities

Maintenance and review: a process that monitors and updates the DRP, and addresses any changes or issues that might affect the DRP, such as the IT requirements, the threat landscape, or the feedback and lessons learned

Recovery strategies of a DRP must be aligned with the cost/benefit analysis and business objectives, because it can ensure that the DRP is feasible and suitable, and that it can achieve the desired outcomes and objectives in a cost-effective and efficient manner. A cost/benefit analysis is a technique that compares the costs and benefits of different recovery strategies, and determines the optimal one that provides the best value for money. A business objective is a goal or a target that the organization wants to achieve through its IT systems and infrastructure, such as increasing the productivity, profitability, or customer satisfaction. A recovery strategy that is aligned with the cost/benefit analysis and business objectives can help to:

Optimize the use and allocation of the IT resources and funds for the recovery

Minimize the negative impacts and risks of a disruption or disaster on the IT systems and infrastructure

Maximize the positive outcomes and benefits of the recovery for the IT systems and infrastructure

Support and enable the achievement of the organizational goals and targets through the IT systems and infrastructure

The other options are not the factors that the recovery strategies of a DRP must be aligned with, but rather factors that should be considered or addressed when developing or implementing the recovery strategies of a DRP. Hardware and software compatibility issues are factors that should be considered when developing the recovery strategies of a DRP, because they can affect the functionality and interoperability of the IT systems and infrastructure, and may require additional resources or adjustments to resolve them. Applications’ criticality and downtime tolerance are factors that should be addressed when implementing the recovery strategies of a DRP, because they can determine the priority and urgency of the recovery for different applications, and may require different levels of recovery objectives and resources. Budget constraints and requirements are factors that should be considered when developing the recovery strategies of a DRP, because they can limit the availability and affordability of the IT resources and funds for the recovery, and may require trade-offs or compromises to balance them.

Simulation is the type of business continuity test that includes assessment of resilience to internal and external risks without endangering live operations. Business continuity is the ability of an organization to maintain or resume its critical functions and operations in the event of a disruption or disaster. Business continuity testing is the process of evaluating and validating the effectiveness and readiness of the business continuity plan (BCP) and the disaster recovery plan (DRP) through various methods and scenarios. Business continuity testing can provide several benefits, such as:

Improving the confidence and competence of the organization and its staff in handling a disruption or disaster

Enhancing the performance and efficiency of the organization and its systems in recovering from a disruption or disaster

Increasing the compliance and alignment of the organization and its plans with the internal or external requirements and standards

Facilitating the monitoring and improvement of the organization and its plans by identifying and addressing any gaps, issues, or risks

There are different types of business continuity tests, depending on the scope, purpose, and complexity of the test. Some of the common types are:

Walkthrough: a type of business continuity test that involves reviewing and discussing the BCP and DRP with the relevant stakeholders, such as the business continuity team, the management, and the staff. A walkthrough can provide a basic and qualitative assessment of the BCP and DRP, and can help to familiarize and educate the stakeholders with the plans and their roles and responsibilities.

Simulation: a type of business continuity test that involves performing and practicing the BCP and DRP with the relevant stakeholders, using simulated or hypothetical scenarios, such as a fire drill, a power outage, or a cyberattack. A simulation can provide a realistic and quantitative assessment of the BCP and DRP, and can help to test and train the stakeholders with the plans and their actions and reactions.

Parallel: a type of business continuity test that involves activating and operating the alternate site or system, while maintaining the normal operations at the primary site or system. A parallel test can provide a comprehensive and comparative assessment of the BCP and DRP, and can help to verify and validate the functionality and compatibility of the alternate site or system.

Full interruption: a type of business continuity test that involves shutting down and transferring the normal operations from the primary site or system to the alternate site or system. A full interruption test can provide a conclusive and definitive assessment of the BCP and DRP, and can help to evaluate and measure the impact and effectiveness of the plans.

Simulation is the type of business continuity test that includes assessment of resilience to internal and external risks without endangering live operations, because it can simulate various types of risks, such as natural, human, or technical, and assess how the organization and its systems can cope and recover from them, without actually causing any harm or disruption to the live operations. Simulation can also help to identify and mitigate any potential risks that might affect the live operations, and to improve the resilience and preparedness of the organization and its systems.

The other options are not the types of business continuity tests that include assessment of resilience to internal and external risks without endangering live operations, but rather types that have other objectives or effects. Walkthrough is a type of business continuity test that does not include assessment of resilience to internal and external risks, but rather a review and discussion of the BCP and DRP, without any actual testing or practice. Parallel is a type of business continuity test that does not endanger live operations, but rather maintains them, while activating and operating the alternate site or system. Full interruption is a type of business continuity test that does endanger live operations, by shutting them down and transferring them to the alternate site or system.

When returning electronic storage media to third parties for repair, it is important to ensure that the media does not contain any sensitive or confidential data that could be compromised or disclosed. One way to do this is to establish a contract with the third party that specifies the security requirements and obligations for the handling, storage, and disposal of the media. This contract should also include provisions for auditing, reporting, and remediation in case of any security incidents or breaches. The other options are not effective practices, as they either do not protect the data adequately (A), damage the media unnecessarily (B and C), or are not feasible or practical in some cases.  References :  CISSP All-in-One Exam Guide, Eighth Edition , Chapter 5, page 239;  CISSP For Dummies, 7th Edition , Chapter 2, page 43.

Security Assertion Markup Language (SAML) is the best solution for the manufacturing organization that wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. FIM is a process that allows the sharing and recognition of identities across different organizations that have a trust relationship. FIM enables the users of one organization to access the resources or services of another organization without having to create or maintain multiple accounts or credentials. FIM can provide several benefits, such as:

Improving the user experience and convenience by reducing the need for multiple logins and passwords

Enhancing the security and privacy by minimizing the exposure and duplication of sensitive information

Increasing the efficiency and productivity by streamlining the authentication and authorization processes

Reducing the cost and complexity by simplifying the identity management and administration

SAML is a standard protocol that supports FIM by allowing the exchange of authentication and authorization information between different parties. SAML uses XML-based messages, called assertions, to convey the identity, attributes, and entitlements of a user to a service provider. SAML defines three roles for the parties involved in FIM:

Identity provider (IdP): the party that authenticates the user and issues the SAML assertion

Service provider (SP): the party that provides the resource or service that the user wants to access

User or principal: the party that requests access to the resource or service

SAML works as follows:

The user requests access to a resource or service from the SP

The SP redirects the user to the IdP for authentication

The IdP authenticates the user and generates a SAML assertion that contains the user’s identity, attributes, and entitlements

The IdP sends the SAML assertion to the SP

The SP validates the SAML assertion and grants or denies access to the user based on the information in the assertion

SAML is the best solution for the manufacturing organization that wants to establish a FIM system with its 20 different supplier companies, because it can enable the seamless and secure access to the resources or services across the different organizations, without requiring the users to create or maintain multiple accounts or credentials. SAML can also provide interoperability and compatibility between different platforms and technologies, as it is based on a standard and open protocol.

The other options are not the best solutions for the manufacturing organization that wants to establish a FIM system with its 20 different supplier companies, but rather solutions that have other limitations or drawbacks. Trusted third-party certification is a process that involves a third party, such as a certificate authority (CA), that issues and verifies digital certificates that contain the public key and identity information of a user or an entity. Trusted third-party certification can provide authentication and encryption for the communication between different parties, but it does not provide authorization or entitlement information for the access to the resources or services. Lightweight Directory Access Protocol (LDAP) is a protocol that allows the access and management of directory services, such as Active Directory, that store the identity and attribute information of users and entities. LDAP can provide a centralized and standardized way to store and retrieve identity and attribute information, but it does not provide a mechanism to exchange or federate the information across different organizations. Cross-certification is a process that involves two or more CAs that establish a trust relationship and recognize each other’s certificates. Cross-certification can extend the trust and validity of the certificates across different domains or organizations, but it does not provide a mechanism to exchange or federate the identity, attribute, or entitlement information.

Limiting access to predefined queries is the control that would prevent the users from obtaining an individual employee’s salary, if they only require access rights that allow them to view the average salary of groups of employees. A query is a request for information from a database, which can be expressed in a structured query language (SQL) or a graphical user interface (GUI). A query can spec ify the criteria, conditions, and operations for selecting, filtering, sorting, grouping, and aggregating the data from the database. A predefined query is a query that has been created and stored in advance by the database administrator or the data owner, and that can be executed by the authorized users without any modification. A predefined query can provide several benefits, such as:

Improving the performance and efficiency of the database by reducing the processing time and resources required for executing the queries

Enhancing the security and confidentiality of the database by restricting the access and exposure of the sensitive data to the authorized users and purposes

Increasing the accuracy and reliability of the database by preventing the errors or inconsistencies that might occur due to the user input or modification of the queries

Reducing the cost and complexity of the database by simplifying the query design and management

Limiting access to predefined queries is the control that would prevent the users from obtaining an individual employee’s salary, if they only require access rights that allow them to view the average salary of groups of employees, because it can ensure that the users can only access the data that is relevant and necessary for their tasks, and that they cannot access or manipulate the data that is beyond their scope or authority. For example, a predefined query can be created and stored that calculates and displays the average salary of groups of employees based on certain criteria, such as department, position, or experience. The users who need to view this information can execute this predefined query, but they cannot modify it or create their own queries that might reveal the individual employee’s salary or other sensitive data.

The other options are not the controls that would prevent the users from obtaining an individual employee’s salary, if they only require access rights that allow them to view the average salary of groups of employees, but rather controls that have other purposes or effects. Segregating the database into a small number of partitions each with a separate security level is a control that would improve the performance and security of the database by dividing it into smaller and manageable segments that can be accessed and processed independently and concurrently. However, this control would not prevent the users from obtaining an individual employee’s salary, if they have access to the partition that contains the salary data, and if they can create or modify their own queries. Implementing Role Based Access Control (RBAC) is a control that would enforce the access rights and permissions of the users based on their roles or functions within the organization, rather than their identities or attributes. However, this control would not prevent the users from obtaining an individual employee’s salary, if their roles or functions require them to access the salary data, and if they can create or modify their own queries. Reducing the number of people who have access to the system for statistical purposes is a control that would reduce the risk and impact of unauthorized access or disclosure of the sensitive data by minimizing the exposure and distribution of the data. However, this control would not prevent the users from obtaining an individual employee’s salary, if they are among the people who have access to the system, and if they can create or modify their own queries.

 Code signing is the mobile code security model that relies only on trust. Mobile code is a type of software that can be transferred from one system to another and executed without installation or compilation. Mobile code can be used for various purposes, such as web applications, applets, scripts, macros, etc. Mobile code can also pose various security risks, such as malicious code, unauthorized access, data leakage, etc. Mobile code security models are the techniques that are used to protect the systems and users from the threats of mobile code. Code signing is a mobile code secu rity model that relies only on trust, which means that the security of the mobile code depends on the reputation and credibility of the code provider. Code signing works as follows:

The code provider has a pair of public and private keys, and obtains a digital certificate from a trusted third party, such as a certificate authority (CA), that binds the public key to the identity of the code provider.

The code provider signs the mobile code with its private key and attaches the digital certificate to the mobile code.

The code consumer receives the mobile code and verifies the signature and the certificate with the public key of the code provider and the CA, respectively.

The code consumer decides whether to trust and execute the mobile code based on the identity and reputation of the code provider.

Code signing relies only on trust because it does not enforce any security restrictions or controls on the mobile code, but rather leaves the decision to the code consumer. Code signing also does not guarantee the quality or functionality of the mobile code, but rather the authenticity and integrity of the code provider. Code signing can be effective if the code consumer knows and trusts the code provider, and if the code provider follows the security standards and best practices. However, code signing can also be ineffective if the code consumer is unaware or careless of the code provider, or if the code provider is compromised or malicious.

The other options are not mobile code security models that rely only on trust, but rather on other techniques that limit or isolate the mobile code. Class authentication is a mobile code security model that verifies the permissions and capabilities of the mobile code based on its class or type, and allows or denies the execution of the mobile code accordingly. Sandboxing is a mobile code security model that executes the mobile code in a separate and restricted environment, and prevents the mobile code from accessing or affecting the system resources or data. Type safety is a mobile code security model that checks the validity and consistency of the mobile code, and prevents the mobile code from performing illegal or unsafe operations.

The second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management is the initialization phase. PKI is a system that uses public key cryptography and digital certificates to provide authentication, confidentiality, integrity, and non-repudiation for electronic transactions. PKI key/certificate life-cycle management is the process of managing the creation, distribution, usage, storage, revocation, and expiration of keys and certificates in a PKI system. The key/certificate life-cycle management consists of six phases: pre-certification, initialization, certification, operational, suspension, and termination. The initialization phase is the second phase, where the key pair and the certificate request are generated by the end entity or the registration authority (RA). The initialization phase involves the following steps:

The end entity or the RA generates a key pair, consisting of a public key and a private key, using a secure and random method.

The end entity or the RA creates a certificate request, which contains the public key and other identity information of the end entity, such as the name, email, organization, etc.

The end entity or the RA submits the certificate request to the certification authority (CA), which is the trusted entity that issues and signs the certificates in the PKI system.

The end entity or the RA securely stores the private key and protects it from unauthorized access, loss, or compromise.

The other options are not the second phase of PKI key/certificate life-cycle management, but rather other phases. The implementation phase is not a phase of PKI key/certificate life-cycle management, but rather a phase of PKI system deployment, where the PKI components and policies are installed and configured. The cancellation phase is not a phase of PKI key/certificate life-cycle management, but rather a possible outcome of the termination phase, where the key pair and the certificate are permanently revoked and deleted. The issued phase is not a phase of PKI key/certificate life-cycle management, but rather a possible outcome of the certification phase, where the CA verifies and approves the certificate request and issues the certificate to the end entity or the RA.

 Virtualization is a technology that enables the creation of multiple virtual servers that run on a single physical server, sharing its resources, such as CPU, memory, disk, or network. The best approach to implement multiple servers on a virtual system is to implement one primary function per virtual server and apply individual security configuration for each virtual server. This approach can enhance the security, performance, and availability of the virtual servers, as it can isolate the functions and resources of each virtual server, prevent interference or conflicts between different functions, and allow for customized and granular security settings and controls for each virtual server. This approach can also facilitate the management, monitoring, and backup of the virtual servers, as it can simplify the identification, configuration, and recovery of each virtual server.  References :  Official (ISC)2 CISSP CBK Reference, Fifth Edition , Domain 3: Security Architecture and Engineering, pp. 507-508;  CISSP All-in-One Exam Guide, Eighth Edition , Chapter 7: Security Architecture and Engineering, pp. 721-722.