CISSP Study Guide / Edition 3

by Eric Conrad, Seth Misenar, Joshua Feldman

Overview

The CISSP certification is the most prestigious, globally-recognized, vendor neutral exam for information security professionals.The newest edition of this acclaimed study guide is aligned to cover all of the material included in the newest version of the exam’s Common Body of Knowledge. The ten domains are covered completely and as concisely as possible with an eye to acing the exam.

Each of the ten domains has its own chapter that includes specially designed pedagogy to aid the test-taker in passing the exam, including:Clearly stated exam objectives; Unique terms/Definitions; Exam Warnings; Learning by Example; Hands-On Exercises; Chapter ending questions. Furthermore, special features include:Two practice exams; Tiered chapter ending questions that allow for a gradual learning curve;anda self-test appendix

• Provides the most complete and effective study guide to prepare you for passing the CISSP exam—contains only what you need to pass the test, with no fluff!
• Eric Conrad has prepared hundreds of professionals for passing the CISSP exam through SANS, a popular and well-known organization for information security professionals
• Covers all of the new information in the Common Body of Knowledge updated in January 2012, and also provides two practice exams, tiered end-of-chapter questions for a gradual learning curve, and a complete self-test appendix

Product Details

ISBN-13:	9780128024379
Publisher:	Elsevier Science
Publication date:	12/17/2015
Edition description:	Study Guid
Pages:	622
Product dimensions:	7.50(w) x 9.20(h) x 1.30(d)

About the Author

Eric Conrad (CISSP, GIAC GSE, GPEN, GCIH, GCIA, GCFA, GAWN, GSEC, Security+), is a SANS-certified instructor and President of Backshore Communications, which provides information warfare, penetration testing, incident handling, and intrusion detection consulting services. Eric started his professional career in 1991 as a UNIX systems administrator for a small oceanographic communications company. He gained information security experience in a variety of industries, including research, education, power, Internet, and healthcare, in positions ranging from systems programmer to security engineer to HIPAA security officer and ISSO. He has taught more than a thousand students in courses such as SANS Management 414: CISSP, Security 560: Network Penetration Testing and Ethical Hacking, Security 504: Hacker Techniques, and Exploits and Incident Handling. Eric graduated from the SANS Technology Institute with a Master of Science degree in Information Security Engineering.

Seth Misenar (CISSP, GPEN, GCIH, GCIA, GCFA, GWAPT, GCWN, GSEC, MCSE, MCDBA), is a certified instructor with the SANS Institute and serves as lead consultant for Context Security, which is based in Jackson, Mississippi. His background includes security research, network and Web application penetration testing, vulnerability assessment, regulatory compliance, security architecture design, and general security consulting. Seth previously served as a physical and network security consultant for Fortune 100 companies and as the HIPAA and information security officer for a state government agency. He teaches a variety of courses for the SANS Institute, including Security Essentials, Web Application Penetration Testing, Hacker Techniques, and the CISSP course.

Seth is pursuing a Master of Science degree in Information Security Engineering from the SANS Technology Institute and holds a Bachelor of Science degree from Millsaps College, Jackson, Mississippi.

Joshua Feldman (CISSP), is currently employed by SAIC, Inc. He has been involved in the Department of Defense Information Systems Agency (DISA) Information Assurance Education, Training, and Awareness program since 2002, where he has contributed to a variety of DoD-wide Information Assurance and Cyber Security policies, specifically the 8500.2 and 8570 series. Joshua has taught more than a thousand DoD students through his "DoD IA Boot Camp" course. He is a subject matter expert for the Web-based DoD Information Assurance Awareness-yearly training of every DoD user is required as part of his or her security awareness curriculum. Also, he is a regular presenter and panel member at the annual Information Assurance Symposium hosted jointly by DISA and NSA. Before joining the support team at DoD/DISA, Joshua spent time as an IT security engineer at the Department of State's Bureau of Diplomatic Security. He got his start in the IT security field with NFR Security Software, a company that manufactures Intrusion Detection Systems. There, he worked as both a trainer and an engineer, implementing IDS technologies and instructing customers how in properly configuring them.

Read an Excerpt

CISSP Study Guide

---

By Eric Conrad Seth Misenar Joshua Feldman

Syngress

Copyright © 2010 Elsevier, Inc.
All right reserved.
ISBN: 978-1-59749-564-6

---

Chapter One

Introduction

EXAM OBJECTIVES IN THIS CHAPTER

• How to Prepare for the Exam

• How to Take the Exam

• Good Luck!

This book is born out of real-world information security industry experience. The authors of this book have held the titles of systems administrator, systems programmer, network engineer/security engineer, security director, HIPAA security officer, ISSO, security consultant, instructor, and others.

This book is also born out of real-world instruction. We have logged countless road miles teaching information security classes to professionals around the world. We have taught thousands of students in hundreds of classes: both physically on most of the continents, as well as online. Classes include CISSP®, of course, but also penetration testing, security essentials, hacker techniques, information assurance boot camps, and others.

Good instructors know that students have spent time and money to be with them, and time can be the most precious. We respect our students and their time: we do not waste it. We teach our students what they need to know, and we do so as efficiently as possible.

This book is also a reaction to other books on the same subject. As the years have passed, other books' page counts have grown, often past 1000 pages. As Larry Wall once said, "There is more than one way to do it." Those are fine books, but our experience tells us that there is another way. If we can teach someone with the proper experience how to pass the CISSP® exam in a 6-day boot camp, is a 1000+ page CISSP® book plus really necessary?

We asked ourselves: what can we do that has not been done before? What can we do better or differently? Can we write a shorter book that gets to the point, respects our student's time, and allows them to pass the exam?

We believe the answer is yes: you are reading the result. We know what is important, and we will not waste your time. This book will teach you what you need to know, and do so as concisely as possible.

HOW TO PREPARE FOR THE EXAM

Read this book, and understand it: all of it. If we cover a subject in this book, we are doing so because it is testable (unless noted otherwise). The exam is designed to test your understanding of the Common Body of Knowledge, which may be thought of as the universal language of information security professionals. It is said to be "a mile wide and two inches deep." Formal terminology is critical: pay attention to it.

Learn the acronyms in this book and the words they represent, backwards and forwards. Both the glossary and index of this book are highly detailed, and map from acronym to name. We did this because it is logical for a technical book, and also to get you into the habit of understanding acronyms forwards and backwards.

Much of the exam question language can appear unclear at times: formal terms from the Common Body of Knowledge can act as a beacon to lead you through the more difficult questions, highlighting the words in the question that really matter.

The Notes Card Approach

As you are studying, keep a "notes card" file for highly specific information that does not lend itself to immediate retention. A notes card is simply a text file (you can create it with a simple editor like Wordpad) that contains a condensed list of detailed information.

Populate your notes card with any detailed information (which you do not already know from previous experience) which is important for the exam, like the five levels of the Software Capability Maturity Level (CMM; covered in Chapter 9, Domain 8: Application Development Security), or the ITSEC and Common Criteria Levels (covered in Chapter 6, Domain 5: Security Architecture and Design), for example.

The goal of the notes card is to avoid getting lost in the "weeds": drowning in specific information that is difficult to retain on first sight. Keep your studies focused on core concepts, and copy specific details to the notes card. When you are done, print the file. As your exam date nears, study your notes card more closely. In the days before your exam, really focus on those details.

Practice Tests

Quizzing can be the best way to gauge your understanding of this material, and of your readiness to take the exam. A wrong answer on a test question acts as a laser beam: showing you what you know, and more importantly, what you do not know. Each chapter in this book has 15 practice test questions at the end, ranging from easy to medium to hard. The Self Test Appendix includes explanations for all correct and incorrect answers; these explanations are designed to help you understand why the answers you chose were marked correct or incorrect. This book's companion Web site is located at http://booksite.syngress.com/companion/Conrad. It contains 500 questions written specifically for this book: two full practice exams. Use them. The companion site also contains 10 podcasts, each providing an overview of one of the 10 domains of knowledge.

You should aim for 80% plus correct answers on any practice test. The real exam requires 700 out of 1000 points, but achieving 80%+ on practice tests will give you some margin for error. Take these quizzes closed-book, just as you will take the real exam. Pay careful attention to any wrong answers, and be sure to reread the relevant section of this book. Identify any weaker domains (we all have them): domains where you consistently get more wrong answers than others. Then focus your studies on those weak areas.

Read the Glossary

As you wrap up your studies, quickly read through the glossary towards the back of this book. It has over 1000 entries, and is highly detailed by design. The glossary definitions should all be familiar concepts to you at this point.

If you see a glossary definition that is not clear or obvious to you, go back to the chapter it is based on, and reread that material. Ask yourself: do I understand this concept enough to answer a question about it?

Readiness Checklist

These steps will serve as a "readiness checklist" as you near the exam day. If you are consistently scoring over 80% on practice tests, understand all glossary terms, and perform a final thorough read through of your notes card, you are ready to go.

HOW TO TAKE THE EXAM

The CISSP® exam is an old-school paper-and-pencil exam. You take it with a #2 pencil, question booklet, and Scantron answer sheet. You will be carefully filling in circles with your pencil, flashing back to fond (or not-so-fond) memories of exams like the SAT exam in high school.

The exam has 250 questions, with a 6-hour time limit. Six hours sounds like a long time, until you do the math: 250 questions in 360 minutes leaves less than a minute and a half to answer each question. The exam is long and can be grueling; it is also a race against time. Preparation is the key to success.

Steps to Becoming a CISSP®

Becoming a CISSP® requires four steps:

• Proper professional information security experience

• Agreeing to the (ISC)² © code of ethics

• Passing the CISSP® exam

• Endorsement by another CISSP®

Additional details are available on the examination registration form available at www.isc2.org.

The exam currently requires 5 years of professional experience in 2 or more of the 10 domains of knowledge. Those domains are covered in Chapters 2-11 of this book. You may waive 1 year with a college degree or approved certification; see the examination registration form for more information.

You may pass the exam before you have enough professional experience and become an "Associate of (ISC)² ©." Once you meet the experience requirement, you can then complete the process and become a CISSP®.

The (ISC)² © code of ethics is discussed in both Chapter 2, Domain 1: Information Security Governance and Risk Management; and Chapter 11, Domain 10: Legal, Regulations, Investigations, and Compliance.

Passing the exam is discussed in section "How to Take the Exam," and we discuss endorsement in section "After the Exam" below.

Exam Logistics

The CISSP® exam schedule is posted at (ISC)² © Web site, http://www.isc2.org/, under the "Certification Programs" tab at "Register Now/View Schedules." Exams often sell out, so if there is a date and time that works well for you, consider locking that date in and booking the exam.

If the exam is being held at a hotel, consider staying in the hotel the night before. This will ensure you are already onsite the morning of the exam, and will help you be calm, cool, and collected. If you must drive to the exam the morning of the exam, leave plenty of time. Consider getting to the site over an hour early, or plan to grab breakfast nearby. This will build in a time buffer, in case something goes wrong. As information security professionals like to say: plan for the worst, and hope for the best.

Be sure to bring snacks and a beverage with you; your exam proctor will probably require you to keep these in a bag in the back of the room. Make sure you get up at least every hour or hour and a half, and walk around the room a bit, and grab a small bite or drink. The time you spend doing this is "wall time," but it is time well spent. You will not remain mentally sharp if you sit in a chair for 6 hour without eating, drinking, or moving. Your brain will be operating at high capacity, and will require plenty of oxygen. Keep your blood flowing by walking around the room now and again.

Also bring some #2 pencils, and a good eraser. "Good" means an eraser that erases (and does not smudge). Test your pencils and eraser. Ear plugs may also be handy: some hotels have "air" walls that do not muffle sound very well. Hotels can be loud places, especially on weekends (when most exams are held).

The exam is available in multiple languages; currently they are available in English, Japanese, Korean, German, French, and Spanish. If your native language is not available, you may take a translation-only dictionary with you and use it during the exam. Expect the proctor to inspect this closely. More details are available on the examination registration form available at www.isc2.org.

Remember that the exam is closed-book: it comes down to you, a #2 pencil, a question booklet, and answer key. Mentally prepare accordingly.

How to Take the Exam

The exam has 250 multiple-choice questions with four possible answers, lettered A, B, C, or D. Each question has one correct answer. A blank answer is a wrong answer: guessing does not hurt you. At the end of your exam, all 250 questions should have one answer chosen.

The questions will be mixed from the 10 domains; the questions do not (overtly) state the domain they are based on. There are 25 research questions (10% of the exam) that do not count towards your final score. These questions are not marked: you must answer all 250 questions as if they count.

Scan all questions for the key words, including formal Common Body of Knowledge terms. Acronyms are your friend: you can identify them quickly, and they are often important (if they are formal terms). Many words may be "junk" words, there to potentially confuse you: ignore them.

Highlight any keywords, and pay careful attention to small words that maybe important, such as "not." You may highlight these mentally, or circle them with your pencil. You may mark up your question booklet (your proctor will collect it after your exam).

The Two-Pass Method

There are two successful methods for taking the exam: the two-pass method and the three-pass method. Both begin the same way:

Pass One

Answer all questions which you can answer quickly (e.g., in less than 2 minutes). You do not need to watch the clock; your mind's internal clock will tell you roughly when you have been stuck on a question longer than that. If you are close to determining an answer, stick with it. If not, mark your question booklet, and move on. Since the exam is paper-and-pencil, you may skip questions (just be sure to keep your questions and answer key in synch). This helps manage time: you do not want to run out of time (e.g., miss the last 10 questions because you spent 20 minutes stuck on question 77).

Pass Two

You will hopefully have time left after pass one. Go back over any skipped questions and answer them all. When you complete pass two, all 250 questions will be answered.

Pass two provides a number of benefits, beyond time management. Anyone who has been stuck on a crossword puzzle, put it down for 20 minutes, and picked it up to have answers suddenly appear obvious understands the power of the human mind's "background processes." Our minds seem to chew on information, even as we are not consciously aware of this happening. Use this to your advantage.

A second benefit is the occasional "covert channel" that may exist between questions on the exam. Question 132 asks you what port SSH (Secure Shell) daemon listens on, for example. Assume you do not know the answer, and then question 204 describes a scenario that mentions SSH runs on TCP port 22. Question 132 is now answered. This signaling of information will not necessarily be that obvious, but you can often infer information about one answer based on a different question; also use this to your advantage.

The Three-Pass Method

There is an optional (and controversial) third pass: recheck all your answers, ensuring you understood and answered the question properly. This is to catch mistakes such as missing a keyword, for example, "Which of the following physical devices is not a recommended preventive control?" You read that question, and missed the word "not." You answered the question on the wrong premise, and gave a recommended device (like a lock), when you should have done the opposite, and recommended a detective device such as closed-circuit television (CCTV).

The third pass is designed to catch those mistakes. This method is controversial because people often second-guess themselves, and change answers to questions they properly understood. Your first instinct is usually your best: if you use the third-pass method, avoid changing these kinds of answers.

After the Exam

(ISC)² © will email you your results, usually 1-4 weeks after your exam. If you pass, you will not know your score; if you fail, you will receive your score, as well as a rating of domains from strongest to weakest. If you do fail, use that list to hone your studies, focusing on your weak domains. Then retake the exam. Do not let a setback like this prevent you from reaching your goal. We all suffer adversity in our lives: how we respond is what is really important.

Once you pass the exam, you will need to be endorsed by another CISSP® before earning the title "CISSP®"; (ISC)² © will explain this process to you in the email they send with your passing results.

GOOD LUCK!

We live in an increasingly certified world, and information security is growing into a full profession. Becoming a CISSP® can provide tremendous career benefits, as it has for the authors' team.

The exam is not easy, but worthwhile things rarely are. Investing in an appreciating asset is always a good idea: you are investing in yourself. Good luck; we look forward to welcoming you to the club!

(Continues...)

---

Excerpted from CISSP Study Guide by Eric Conrad Seth Misenar Joshua Feldman Copyright © 2010 by Elsevier, Inc.. Excerpted by permission of Syngress. All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.

---

Table of Contents

Introduction

How to Take the CISSP Exam

Domain 1: Information Security Governance and Risk Management

Domain 2: Access Control

Domain 3: Cryptography

Domain 4: Physical (Environmental) Security

Domain 5: Security Architecture and Design

Domain 6: Business Continuity and Disaster Recovery Planning

Domain 7: Telecommunications and Network Security

Domain 8: Application Development Security

Domain 9: Operations Security

Domain 10: Legal, Regulations, Investigations, and Compliance

Editorial Reviews

"Gives you everything you need and nothing you don't. One of the temptations you face as an author of a certification prep book or course is to include information that you feel is important, but not related to preparation for the certification. Eric Conrad has shown incredible discipline in keeping this book focused on preparing you to take the CISSP." —Stephen Northcutt, President, The SANS Technology Institute

From the Publisher