The best way to reduce the impact of an externally sourced flood attack is to have the service provider block the source address. A flood attack is a type of denial-of-service attack that aims to overwhelm the target system or network with a large amount of traffic, such as SYN packets, ICMP packets, or UDP packets. An externally sourced flood attack is a flood attack that originates from outside the target’s network, such as from the internet. Having the service provider block the source address can help to reduce the impact of an externally sourced flood attack, as it can prevent the malicious traffic from reaching the target’s network, and thus conserve the network bandwidth and resources. Having the source service provider block the address, blocking the source address at the firewall, or blocking all inbound traffic until the flood ends are not the best ways to reduce the impact of an externally sourced flood attack, as they may not be feasible, effective, or efficient, respectively.  References :  CISSP All-in-One Exam Guide, Eighth Edition , Chapter 6: Communication and Network Security, page 745;  Official (ISC)2 Guide to the CISSP CBK, Fifth Edition , Chapter 4: Communication and Network Security, page 525.

A shock sensor is a type of alarm system that detects intrusions through windows by sensing the vibrations or impacts caused by breaking glass or forced entry. A shock sensor is recommended for a high-noise, occupied environment, as it is less prone to false alarms caused by ambient noise or movement. A shock sensor can be mounted on the window frame or glass, and can be configured to trigger an alarm or a notification when a certain threshold of vibration or impact is exceeded. A shock sensor can also be combined with other types of sensors, such as magnetic contacts or glass break detectors, to provide a layered defense. An acoustic sensor is a type of alarm system that detects intrusions through windows by listening to the sound of breaking glass or forced entry. An acoustic sensor is not recommended for a high-noise, occupied environment, as it can be easily triggered by other sources of noise, such as music, conversation, or traffic. An acoustic sensor can be placed near the window or in the room, and can be tuned to recognize the frequency and pattern of glass breaking sounds. A motion sensor is a type of alarm system that detects intrusions by sensing the movement or presence of an intruder in a protected area. A motion sensor is not recommended for a high-noise, occupied environment, as it can be triggered by legitimate occupants or authorized visitors. A motion sensor can be installed on the wall, ceiling, or floor, and can use different technologies, such as infrared, ultrasonic, microwave, or video, to detect motion. A photoelectric sensor is a type of alarm system that detects intrusions by sensing the interruption of a beam of light between a transmitter and a receiver. A photoelectric sensor is not recommended for a high-noise, occupied environment, as it can be triggered by objects or animals that cross the beam. A photoelectric sensor can be placed on the window or across the room, and can be configured to trigger an alarm or a notification when the beam is broken. 

Anonymous proxies are servers that act as intermediaries between the user and the internet, hiding the user’s real IP address and allowing them to bypass network restrictions and access unauthorized websites. The best way to prevent users from visiting unauthorized websites using anonymous proxies is to block the IP address of known anonymous proxies on the firewall or router. This will prevent the user from establishing a connection with the proxy server and accessing the blocked content. Removing the anonymity from the proxy, analyzing IP traffic for proxy requests, or disabling the proxy server on the firewall are not effective ways to prevent future occurrences, as they do not address the root cause of the problem or require more resources and time to implement.  References :  The 17 Best Proxy Sites to Help You Browse Anonymously ;  Buy HTTP proxies and Socks5 | Anonymous Proxies ;  The Best Free Proxy Server List: Tested & Working! (2024) .

The residual risk is 25% in this scenario. Residual risk is the portion of risk that remains after security measures have been applied to mitigate the risk. Residual risk can be calculated by subtracting the risk reduction from the total risk. In this scenario, the total risk is 100%, and the risk reduction is 75%. The risk reduction is 75% because the control stops 50% of attacks, and reduces the impact of an attack by 50%. Therefore, the residual risk is 100% - 75% = 25%. Alternatively, the residual risk can be calculated by multiplying the probability and the impact of the remaining risk. In this scenario, the probability of an attack is 50%, and the impact of an attack is 50%. Therefore, the residual risk is 50% x 50% = 25%. 50%, 75%, and 100% are not the correct answers to the question, as they do not reflect the correct calculation of the residual risk. 

The management process that allows only those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates is configuration. Configuration is the process of setting and adjusting the parameters and options of a system or a network, such as hardware, software, or services, to meet the requirements and objectives of the organization. Configuration can provide some benefits for security, such as enhancing the performance and the functionality of the system or the network, preventing or mitigating some types of attacks or vulnerabilities, and supporting the audit and compliance activities. Configuration can involve various techniques and tools, such as configuration management, configuration control, configuration auditing, or configuration baselines. Configuration can allow only those services required for users to accom plish their tasks, change default user passwords, and set servers to retrieve antivirus updates, by using the following methods:

Enabling or disabling the services that are necessary or unnecessary for the system or the network, such as file sharing, remote access, or printing. This can help to reduce the attack surface and the exposure of the system or the network, as well as to optimize the resource utilization and the bandwidth consumption.

Changing the default user passwords that are provided by the vendors or the manufacturers of the system or the network, such as routers, switches, or servers. This can help to prevent or mitigate some types of attacks or unauthorized access, such as brute force, dictionary, or credential stuffing, by using strong and unique passwords that are difficult to guess or crack.

Setting the servers to retrieve antivirus updates automatically or periodically from the trusted sources, such as the antivirus vendors or the security providers. This can help to protect the system or the network from malware infections or exploits, by updating and applying the latest malware signatures, heuristics, or behavioral analysis to the system or the network.

Information ownership is the most important factor when determining who can accept the risk associated with a vulnerability. Information ownership is the concept that assigns the roles and responsibilities for the creation, maintenance, protection, and disposal of information assets within an organization. Information owners are the individuals or entities who have the authority and accountability for the information assets, and who can make decisions regarding the information lifecycle, classification, access, and usage. Information owners are also responsible for accepting or rejecting the risk associated with the information assets, and for ensuring that the risk is managed and communicated appropriately. Information owners can delegate some of their responsibilities to other roles, such as information custodians, information users, or information stewards, but they cannot delegate their accountability for the information assets and the associated risk. Countermeasure effectiveness, type of potential loss, and incident likelihood are not the most important factors when determining who can accept the risk associated with a vulnerability, although they are relevant or useful factors. Countermeasure effectiveness is the measure of how well a security control reduces or eliminates the risk. Countermeasure effectiveness can help to evaluate the cost-benefit and performance of the security control, and to determine the level of residual risk. Type of potential loss is the measure of the adverse impact or consequence that can result from a risk event. Type of potential loss can include financial, operational, reputational, legal, or strategic losses. Type of potential loss can help to assess the severity and priority of the risk, and to justify the investment and implementation of the security control. Incident likelihood is the measure of the probability or frequency of a risk event occurring. Incident likelihood can be influenced by various factors, such as the threat capability, the vulnerability exposure, the environmental conditions, or the historical data. Incident likelihood can help to estimate the level and trend of the risk, and to select the appropriate risk response and security control.

Gratuitous ARP is a special type of ARP message that a sender device broadcasts on the network without any other device requesting it. It can be useful for updating the ARP table, changing the address of an interface, or informing the network of the sender’s own MAC address. However, it also introduces the risk of a Man-in-the-Middle (MITM) attack, where an attacker can send a spoofed gratuitous ARP message to trick other devices into associating a legitimate IP address with a malicious MAC address. This way, the attacker can intercept, modify, or redirect the traffic intended for the legitimate device. Therefore, the network architect likely designed the VoIP system with gratuitous ARP disabled to prevent such attacks and ensure the security and integrity of the voice communication.  References :  Gratuitous ARP – Definition and Use Cases - Practical Networking .net ;  Gratuitous_ARP - Wireshark

The most significant security challenge when adopting DevOps practices compared to a more traditional control framework is maintaining segregation of duties. DevOps is a set of practices and methodologies that aim to integrate and automate the development and the operations of a system or a network, such as software, applications, or services, to enhance the quality and the speed of the delivery and the deployment of the system or the network. DevOps can provide some benefits for security, such as enhancing the performance and the functionality of the system or the network, preventing or mitigating some types of attacks or vulnerabilities, and supporting the audit and the compliance activities. DevOps can involve various tools and techniques, such as continuous integration, continuous delivery, continuous testing, continuous monitoring, or continuous feedback. A traditional control framework is a set of policies and procedures that aim to establish and enforce the security and the governance of a system or a network, such as software, applications, or services, to protect the confidentiality, the integrity, and the availability of the system or the network. A traditional control framework can provide some benefits for security, such as enhancing the visibility and the accountability of the system or the network, preventing or detecting any unauthorized or improper activities or changes, and supporting the audit and the compliance activities. A traditional control framework can involve various controls and mechanisms, such as risk assessment, change management, configuration management, access control, or audit trail. Maintaining segregation of duties is the most significant security challenge when adopting DevOps practices compared to a more traditional control framework, as it can be difficult and costly to implement and manage, due to the differences and the conflicts between the DevOps and the traditional control framework principles and objectives. Segregation of duties is a security principle or a technique that requires that different roles or functions are assigned to different parties, and that no single party can perform all the steps of a process or a task, such as development, testing, deployment, or maintenance. Segregation of duties can provide some benefits for security, such as enhancing the accuracy and the reliability of the process or the task, preventing or detecting fraud or errors, and supporting the audit and the compliance activities. 

The first step when purchasing Commercial Off-The-Shelf (COTS) software is to establish policies and procedures on system and services acquisition. This involves defining the objectives, scope, and criteria for acquiring the software, as well as the roles and responsibilities of the stakeholders involved in the acquisition process. The policies and procedures should also address the legal, contractual, and regulatory aspects of the acquisition, such as the terms and conditions, the service level agreements, and the compliance requirements. Undergoing a security assessment, establishing a risk management strategy, and hardening the hosting server are not the first steps when purchasing COTS software, but they may be part of the subsequent steps, such as the evaluation, selection, and implementation of the software.  References :  CISSP All-in-One Exam Guide, Eighth Edition , Chapter 1: Security and Risk Management, page 64;  Official (ISC)2 Guide to the CISSP CBK, Fifth Edition , Chapter 1: Security and Risk Management, page 56.

Password encryption is a capability that would typically be included in a commercially available software package designed for access control. Password encryption is a technique that transforms the plain text passwords into unreadable ciphertexts, using a cryptographic algorithm and a key. Password encryption can help to protect the passwords from unauthorized access, disclosure, or modification, as well as to prevent password cracking or guessing attacks. File encryption, source library control, and file authentication are not capabilities related to access control, but to data protection, configuration management, and data integrity, respectively.  References :  CISSP All-in-One Exam Guide, Eighth Edition , Chapter 5: Security Engineering, page 605;  Official (ISC)2 Guide to the CISSP CBK, Fifth Edition , Chapter 3: Security Architecture and Engineering, page 386.

A Configuration Management Database (CMDB) is a database that stores information about configuration items (CIs) for use in change, release, incident, service request, problem, and configuration management processes. A CI is any component or resource that is part of a system or a network, such as hardware, software, documentation, or personnel. A CMDB can provide some benefits for security compliance audits, such as:

Reducing the time it takes to perform network, system, and application security compliance audits, by providing a centralized and updated source of information about the CIs, their attributes, their relationships, and their dependencies, which can help to identify and locate the CIs that are subject to the audit, and to avoid duplication or omission of the audit tasks.

Increasing the quality and effectiveness of the results of network, system, and application security compliance audits, by providing a consistent and accurate view of the current and historical state of the CIs, their compliance status, and their changes, which can help to verify and validate the compliance of the CIs with the policies and standards, and to detect and report any deviations or violations.

A source code repository, a configuration management plan (CMP), and a system performance monitoring application are not the best options to achieve the desired results of reducing the time and increasing the quality and effectiveness of network, system, and application security compliance audits, although they may be related or useful tools or techniques. A source code repository is a database or a system that stores and manages the source code of a software or an application, and that supports version control, collaboration, and documentation of the code. A source code repository can provide some benefits for security compliance audits, such as:

Reducing the time it takes to perform application security compliance audits, by providing a centralized and accessible source of information about the code, its versions, its changes, and its history, which can help to identify and locate the code that is subject to the audit, and to avoid duplication or omission of the audit tasks.

Increasing the quality and effectiveness of the results of application security compliance audits, by providing a consistent and accurate view of the current and historical state of the code, its compliance status, and its changes, which can help to verify and validate the compliance of the code with the policies and standards, and to detect and report any deviations or violations.

However, a source code repository is not the best option to achieve the desired results of reducing the time and increasing the quality and effectiveness of network, system, and application security compliance audits, as it is only applicable to the application layer, and it does not provide information about the other CIs that are part of the system or the network, such as hardware, documentation, or personnel. A configuration management plan (CMP) is a document or a policy that defines and describes the objectives, scope, roles, responsibilities, processes, and procedures of configura tion management, which is the process of identifying, controlling, tracking, and auditing the changes to the CIs. A CMP can provide some benefits for security compliance audits, such as:

Reducing the time it takes to perform network, system, and application security compliance audits, by providing a clear and comprehensive guidance and direction for the configuration management activities, which can help to ensure the consistency and the efficiency of the configuration management process, and to avoid confusion or conflicts among the configuration management stakeholders.

Increasing the quality and effectiveness of the results of network, system, and application security compliance audits, by providing a framework and a standard for the configuration management activities, which can help to ensure the alignment and the compliance of the configuration management process with the policies and standards, and to support the audit and the compliance activities.

However, a CMP is not the best option to achieve the desired results of reducing the time and increasing the quality and effectiveness of network, system, and application security compliance audits, as it is not a database or a system that stores and provides information about the CIs, but rather a document or a policy that defines and describes the configuration management process. A system performance monitoring application is a software or a tool that collects and analyzes data and metrics about the performance and the behavior of a system or a network, such as availability, reliability, throughput, response time, or resource utilization. A system performance monitoring application can provide some benefits for security compliance audits, such as:

Reducing the time it takes to perform network and system security compliance audits, by providing a real-time and automated source of information about the performance and the behavior of the system or the network, which can help to identify and locate the issues or the problems that may affect the compliance of the system or the network, and to avoid manual or tedious audit tasks.

Increasing the quality and effectiveness of the results of network and system security compliance audits, by providing a quantitative and objective view of the performance and the behavior of the system or the network, which can help to measure and evaluate the compliance of the system or the network with the policies and standards, and to detect and report any anomalies or deviations.

However, a system performance monitoring application is not the best option to achieve the desired results of reducing the time and increasing the quality and effectiveness of network, system, and application security compliance audits, as it is only applicable to the network and system layers, and it does not provide information about the other CIs that are part of the system or the network, such as software, documentation, or personnel.

The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of the system implementation phase. The SDLC is a framework that describes the stages and activities involved in the development, deployment, and maintenance of a system. The SDLC typically consists of the following phases: system initiation, system acquisition and development, system implementation, system operations and maintenance, and system disposal. The security accreditation task is the process of formally authorizing a system to operate in a specific environment, based on the security requirements, controls, and risks. The security accreditation task is part of the security certification and accreditation (C & A) process, which also includes the security certification task, which is the process of technically evaluating and testing the security controls and functionality of a system. The security accreditation task is completed at the end of the system implementation phase, which is the phase where the system is installed, configured, integrated, and tested in the target environment. The security accreditation task involves reviewing the security certification results and documentation, such as the security plan, the security assessment report, and the plan of action and milestones, and making a risk-based decision to grant, deny, or conditionally grant the authorization to operate (ATO) the system. The security accreditation task is usually performed by a senior official, such as the authorizing official (AO) or the designated approving authority (DAA), who has the authority and responsibility to accept the security risks and approve the system operation. The security accreditation task is not completed at the end of the system acquisition and development, system operations and maintenance, or system initiation phases. The system acquisition and development phase is the phase where the system requirements, design, and development are defined and executed, and the security controls are selected and implemented. The system operations and maintenance phase is the phase where the system is used and supported in the operational environment, and the security controls are monitored and updated. The system initiation phase is the phase where the system concept, scope, and objectives are established, and the security categorization and planning are performed. 

Before performing the next step in an incident response, it must be considered or evaluated that removing the server from the network may prevent catching the intruder who has planted a backdoor. This is because the intruder may still be connected to the server or may try to reconnect later, and disconnecting the server may alert the intruder or lose the opportunity to trace the intruder’s source or identity. Therefore, it may be better to isolate the server from the network or monitor the network traffic to gather more evidence and information about the intruder. Notifying law enforcement, identifying who executed the incident, and copying the contents of the hard drive are not the factors that must be considered or evaluated before performing the next step, as they are either irrelevant or premature at this stage of the incident response.  References :  CISSP All-in-One Exam Guide, Eighth Edition , Chapter 8: Software Development Security, page 973;  Official (ISC)2 Guide to the CISSP CBK, Fifth Edition , Chapter 8: Security Operations, page 1019.

The most appropriate measure to implement when a group of system administrators must share a high-level access set of credentials due to system constraints is a credential check-out process for a per-use basis. This means that the system administrators must request and obtain the credentials from a secure source each time they need to use them, and return them after they finish their tasks. This can help to reduce the risk of unauthorized access, misuse, or compromise of the credentials, as well as to enforce accountability and traceability of the system administrators’ actions. Increasing console lockout times, reducing the group size, and enabling full logging are not as effective as a credential check-out process, as they do not address the root cause of the problem, which is the sharing of the credentials.  References :  CISSP All-in-One Exam Guide, Eighth Edition , Chapter 5: Security Engineering, page 633;  Official (ISC)2 Guide to the CISSP CBK, Fifth Edition , Chapter 3: Security Architecture and Engineering, page 412.

The minimum frequency for audits of permissions to individual or group accounts is continually. Audits of permissions are the processes of reviewing and verifying the user accounts and access rights on a system or a network, and ensuring that they are appropriate, necessary, and compliant with the policies and standards. Audits of permissions can provide some benefits for security, such as enhancing the accuracy and the reliability of the user accounts and access rights, identifying and removing any excessive, obsolete, or unauthorized access rights, and supporting the audit and the compliance activities. Audits of permissions should be performed continually, which means that they should be conducted on a regular and consistent basis, without any interruption or delay. Continual audits of permissions can help to maintain the security and the integrity of the system or the network, by detecting and addressing any changes or issues that may affect the user accounts and access rights, such as role changes, transfers, promotions, or terminations. Continual audits of permissions can also help to ensure the effectiveness and the feasibility of the audit process, by reducing the workload and the complexity of the audit tasks, and by providing timely and relevant feedback and results. Annually, to correspond with staff promotions, and to correspond with terminations are not the minimum frequencies for audits of permissions to individual or group accounts, although they may be related or possible frequencies. Annually means that the audits of permissions are performed once a year, which may not be sufficient or adequate to maintain the security and the integrity of the system or the network, as the user accounts and access rights may change or become outdated more frequently than that, due to various factors, such as role changes, transfers, promotions, or terminations. Annually audits of permissions may also increase the workload and the complexity of the audit process, as they may involve a large number of user accounts and access rights to review and verify, and they may not provide timely and relevant feedback and results. To correspond with staff promotions means that the audits of permissions are performed whenever a staff member is promoted to a higher or a different position within the organization, which may affect their user accounts and access rights. To correspond with staff promotions audits of permissions can help to ensure that the user accounts and access rights are aligned with the current roles or functions of the staff members, and that they follow the principle of least privilege. However, to correspond with staff promotions audits of permissions may not be sufficient or adequate to maintain the security and the integrity of the system or the network, as the user accounts and access rights may change or become outdated due to other factors, such as role changes, transfers, or terminations, and they may not be performed on a regular and consistent basis. To correspond with terminations means that the audits of permissions are performed whenever a staff member leaves the organization, which may affect their user accounts and access rights. To correspond with terminations audits of permissions can help to ensure that the user accounts and access rights are revoked or removed from the system or the network, and that they prevent any unauthorized or improper access or use. However, to correspond with terminations audits of permissions may not be sufficient or adequate to maintain the security and the integrity of the system or the network, as the user accounts and access rights may change or become outdated due to other factors, such as role changes, transfers, or promotions, and they may not be performed on a regular and consistent basis.