CISSP Flashcards

Which access control model uses security labels and clearance levels to enforce mandatory access controls?

Answer: Bell-LaPadula Model

Bell-LaPadula enforces confidentiality using classification labels and clearances, with 'no read up, no write down' rules.

A security engineer needs to ensure that a cryptographic key is never stored in plaintext anywhere. Which technique best addresses this requirement?

Answer: Key wrapping

Key wrapping encrypts a cryptographic key with another key so the plaintext key is never exposed in storage.

During a penetration test, the tester finds an application concatenating user input directly into SQL queries. Which vulnerability class is this?

Answer: SQL injection

SQL injection occurs when untrusted input is inserted directly into SQL queries, allowing attackers to manipulate database commands.

What is the PRIMARY goal of a Business Impact Analysis (BIA)?

Answer: Determine recovery time objectives for critical processes

A BIA identifies critical business functions and determines RTOs, RPOs, and financial impacts of disruptions.

Which protocol provides authentication and encryption for remote access but operates at the network layer?

Answer: IPsec

IPsec operates at the network layer (Layer 3) and provides authentication and encryption for IP traffic, commonly used in VPNs.

An organization discovers that an employee has been accessing files outside their job role for six months. Which preventive control would have been MOST effective?

Answer: Principle of least privilege enforcement

Enforcing least privilege would have restricted the employee's access to only the files required for their job duties.

In PKI, what is the role of a Certificate Revocation List (CRL)?

Answer: Publish a list of certificates no longer trusted before expiration

A CRL is published by a CA and lists certificates that have been revoked prior to their scheduled expiration date.