Practice Questions

[rslade]

Right.

For (and from) all the newbies out there who want help for studying, there have been numerous questions about, well, questions.  As in, "what's the best set of practice questions to use while studying for the exam?"

The answer is, none of them.

I have looked at an awful lot of practice question sets, and they are uniformly awful.  Most try to be "hard" by bringing in trivia: that is not representative of the exam.  Most concentrate on a bunch of facts: that is not representative of the exam.

So, from my own stash, collected and developed over the decades, I'm going to give you some samples that do represent the types of questions that you will probably see on the exam.  Note that none of these questions will appear on the exam.  You can't pass the CISSP exam by memorizing a brain dump.  These will just give you a feel.

For each question I'll give the answer, what type of question this represents, and possibly ways to approach this type of question.

I'll be doing this over time, "replying" to this post to add questions.  Others are free to add sample questions if they wish, but be ready to be (possibly severely) critiqued.

[Startzc]

Good call kamalamalhotra, I had it right, but backwards. I was thinking deterrent was a subset of Preventative. It does make more sense the other way around, because of course you would want an attacker to just decide it's not worth it before actually trying and being blocked (and that's how the Sybex book has them listed after looking again). 

Yes, I am taking the exam tomorrow. I think I will be good to go as long as I don't rush, read carefully, and remember the advice from this thread. I'll let y'all know how it goes.

[rslade]

> Startzc (Newcomer II) posted a new reply in Exams on 01-10-2021 10:08 PM in the

>   Because Deterrent is not a category

Sorry, but deterrent is very much one of the control categories.

(But it's a stupidly written question, anyway.)

====================== (quote inserted randomly by Pegasus Mailer)
rslade@gmail.com rmslade@outlook.com rslade@computercrime.org
How is it possible to have a civil war?
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://community.isc2.org/t5/forums/recentpostspage/user-id/1324864413

[rslade]

> kamalamalhotra (Newcomer I) posted a new reply in Exams on 01-11-2021 12:04 AM

> there is an access control called a deterrent. The deterrent is just like your
> traffic signal, it can tell you to stop, however, cant prevent you from not
> stopping. preventive is a variant of deterrent however it takes an action, just
> like a cop who stops you if you cut the red signal.

Hmmmmm. Sorta, but maybe not quite. You *are* correct in that a deterrent
does not absolutely prevent. A deterrent control might be thought of as making
the attack more difficult, rather than impossible. The difficulty might be physical
(such as a taller fence), or it might sometimes be administrative or psychological
(warning signs or banners that might remind the attacker of consequences), or it
might be technical (addition of encryption). Deterrent controls can come in a
variety of ways.

Note that, in terms of divisons of control categories, we've got the
governmental/military list that contains deterrent and preventive, and the admin,
technical, physical divisions used more by business. The finer grading and
codifying of controls that we can do, the better our analysis of our total security
posture, and the two classifications are orthogonal. Therefore the two divisions
can be used as the basis for a matrix of controls, which can be used to assess the
completeness of protection for a given system. Details of the process may be
found in volume 3 of the 5th edition of the "Information Security Management
Handbook," pages 179-182.

====================== (quote inserted randomly by Pegasus Mailer)
rslade@gmail.com rmslade@outlook.com rslade@computercrime.org
Advertising (n): the science of arresting the human intelligence
for long enough to get money from it. -- Stephen Leacock
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://community.isc2.org/t5/forums/recentpostspage/user-id/1324864413

[rslade]

Which one of the following is NOT a passive network attack method?

a. Wiretapping
b. Spoofing
c. Packet sniffer
d. Traffic analysis

Answer: b.
Reference: Info Sys Security; Fites; 1996; pg 439.

Discussion:
Answer a - wrong - can be active but generally used as passive for monitoring
purposes.
Answer b - correct. A passive attack does not involve injecting any data, and
spoofing definitely requires you to say something, even if it is only idntifying
yourself incorrectly.
Answer c - wrong - passive packet capture.
Answer d - wrong - passive capturing of traffic patterns.

======================
rslade@gmail.com rmslade@outlook.com rslade@computercrime.org
"If you do buy a computer, don't turn it on." - Richards' 2nd Law
"Robert Slade's Guide to Computer Viruses" 0-387-94663-2
"Viruses Revealed" 0-07-213090-3
"Software Forensics" 0-07-142804-6
"Dictionary of Information Security" Syngress 1-59749-115-2
"Cybersecurity Lessons from CoVID-19" CRC Press 978-0-367-68269-9
============= for back issues:
[Base URL] site http://victoria.tc.ca/techrev/
CISSP refs: [Base URL]mnbksccd.htm
PC Security: [Base URL]mnvrrvsc.htm
Security Dict.: [Base URL]secgloss.htm
Security Educ.: [Base URL]comseced.htm
Book reviews: [Base URL]mnbk.htm
[Base URL]review.htm
Partial/recent: http://groups.yahoo.com/group/techbooks/
http://en.wikipedia.org/wiki/Robert_Slade
https://is.gd/RotlWB http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/

[Startzc]

Thank you to all contributors, as of about 10:15am CST - I am (provisionally) CISSP Certified!!! I finished with 70 minutes to spare, so there is time to think if you need to. I would give more info, but the NDA is very vague and I don't want to violate the NDA before I even get my full membership approved. 

Some questions are as just as badly worded as mentioned and seen here, even for a native English speaker. You definitely need to read the question and all answers very carefully, just as rslade and many others have stated. Other than that, it was broad and gave me lots of "correct-ish" answers for each question as expected.

[kamalamalhotra]

 that is awesome. type to party and take some rest

[CISOScott]

---

@kamalamalhotra wrote:

 so now is the time to share as to what type of questions are on the assessment, 

---

That would be against the code of ethics and violate the non-disclosure agreement.

[kamalamalhotra]

oh ok. my bad. 

[Startzc]

I can tell you that the advice you see from other CISSPs on here and other forums is not exaggeration. You need to know your stuff, even if you memorize the entire Sybex book, you will still need to apply critical thinking to the concepts within it. Also fairly certain it is safe to say that if something has multiple names, know all of them. I will also be making a separate post with the study materials that I used...as soon as I have time. Besides studying for this, I am working full time and taking the last 5 classes I need to finish my BAS in Cybersecurity this semester.

Which basically means my fun/free time is talking to you nerds, how sad is that? Jk, nerds rule!

[rslade]

Phreaking is a term associated with

a. the fraudulent use of telephone services.
b. message flooding attacks.
c. increasing the transmitter power of cell phones.
d. monitoring e-mail message traffic.

Answer: a.

Reference: Hacker Proof; Lois Klander; Jamsa Press; 1997; pg 20.

Discussion:
Answer a - correct - phreakers use stolen telephone services.
Answer b - wrong - could be spamming, but this has nothing to do with phones.
Answer c - wrong - irrevelant or fabricated.
Answer d - wrong - not the definition, fabricated.

======================
rslade@gmail.com rmslade@outlook.com rslade@computercrime.org
"If you do buy a computer, don't turn it on." - Richards' 2nd Law
"Robert Slade's Guide to Computer Viruses" 0-387-94663-2
"Viruses Revealed" 0-07-213090-3
"Software Forensics" 0-07-142804-6
"Dictionary of Information Security" Syngress 1-59749-115-2
"Cybersecurity Lessons from CoVID-19" CRC Press 978-0-367-68269-9
============= for back issues:
[Base URL] site http://victoria.tc.ca/techrev/
CISSP refs: [Base URL]mnbksccd.htm
PC Security: [Base URL]mnvrrvsc.htm
Security Dict.: [Base URL]secgloss.htm
Security Educ.: [Base URL]comseced.htm
Book reviews: [Base URL]mnbk.htm
[Base URL]review.htm
Partial/recent: http://groups.yahoo.com/group/techbooks/
http://en.wikipedia.org/wiki/Robert_Slade
https://is.gd/RotlWB http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/