[2024年08月]更新のCISSP日本語ブレーン問題集でCISSP日本語問題で最高得点を目指すため今すぐ試そう [Q402-Q425]

Explanation
LAN 4

RAID-0 is the level of Redundant Array of Independent Disks (RAID) that is configured primarily for high-performance data reads and writes. RAID is a technology that combines multiple physical disks into a logical unit, and that distributes the data across the disks using different methods, such as striping, mirroring, or parity. RAID can provide benefits such as increased storage capacity, improved performance, or enhanced reliability, depending on the level of RAID that is used. RAID-0 is the level of RAID that uses striping as the method of data distribution, and that splits the data into equal-sized blocks and writes them sequentially across the disks. RAID-0 can provide benefits such as:
* High-performance data reads and writes, as the data can be accessed or stored simultaneously from or to multiple disks, and as the data transfer rate is increased by the number of disks in the array.
* Full utilization of the storage capacity, as the data is evenly distributed across the disks, and as there is no overhead or redundancy of the data. However, RAID-0 also has drawbacks such as:
* No fault tolerance or data protection, as the failure of any disk in the array will result in the loss of the entire data, and as there is no backup or recovery of the data.
* Increased risk of data corruption or inconsistency, as the data blocks may not be aligned or synchronized across the disks, and as there may be errors or delays in the data transmission or processing. The other options are not the levels of RAID that are configured primarily for high-performance data reads and writes, as they either do not use striping as the method of data distribution, or do not provide the same level of performance as RAID-0. References: CISSP – Certified Information Systems Security Professional, Domain 3. Security Architecture and Engineering, 3.3 Implement and manage engineering processes using secure design principles, 3.3.1 Understand the fundamental concepts of security models,
3.3.1.3 Data security models; CISSP Exam Outline, Domain 3. Security Architecture and Engineering,
3.3 Implement and manage engineering processes using secure design principles, 3.3.1 Understand the fundamental concepts of security models, 3.3.1.3 Data security models

Explanation
Section: Security Assessment and Testing

Integrity is the most critical aspect of computer-generated evidence. Integrity means that the evidence has not been altered, tampered, or corrupted in any way, and that it reflects the original state of the data or system.
Integrity can be ensured by using cryptographic techniques, such as hashing, digital signatures, and encryption, as well as by following proper chain of custody and documentation procedures. Integrity is essential for the admissibility and reliability of the evidence in a court of law or an investigation.
References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 13: Legal, Regulations, Investigations, and Compliance, page 685. CISSP Practice Exam – FREE 20 Questions and Answers, Question 16.

Explanation
Section: Security Assessment and Testing

The area of embedded devices that are most commonly attacked is firmware. Firmware is a type of software that is embedded in a hardware device and controls its basic functions, such as booting, loading, or updating.
Firmware is often stored in read-only memory (ROM) or flash memory, which makes it difficult to modify or erase. Firmware can be attacked by exploiting vulnerabilities in the firmware code, design, or configuration, or by injecting malicious code into the firmware update process. Firmware attacks can compromise the security, functionality, or performance of the embedded device, or even render it unusable or inaccessible. References:
CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3: Security Engineering, page 106; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 3: Security Engineering, page 168]

The thing that system and database administrators must be aware of and apply when configuring systems used for storing personal employee data is the organization’s security policies and standards. Security policies and standards are the documents that define the rules, guidelines, and procedures that govern the security of the organization’s information systems and data. Security policies and standards help to ensure the confidentiality, integrity, and availability of the information systems and data, and to comply with the legal or regulatory requirements. System and database administrators must be aware of and apply the organization’s security policies and standards when configuring systems used for storing personal employee data, as they are responsible for implementing and maintaining the security controls and measures that protect the personal employee data from unauthorized access, use, disclosure, or theft. Secondary use of the data by business users, the business purpose for which the data is to be used, and the overall protection of corporate resources and data are not the things that system and database administrators must be aware of and apply when configuring systems used for storing personal employee data, as they are related to the usage, purpose, or scope of the data, not the security of the data. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1, Security and Risk Management, page 35. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1, Security and Risk Management, page 48.

Assessment is a recognized audit type commonly used to evaluate and assess various aspects of an organization’s security practices and controls, making it the most appropriate choice for evaluating the effectiveness of a security program.

The most important goal of conducting security assessments is to discover unmitigated security vulnerabilities, and propose paths for mitigating them. A security assessment is a process that involves evaluating and testing the security posture and performance of a system or network, and identifying and reporting any security vulnerabilities or issues that may pose a security risk. A security assessment can help to discover unmitigated security vulnerabilities, which are the security flaws or weaknesses that have not been detected, reported, or resolved, and that can be exploited by the adversaries to compromise the security of the system or network. A security assessment can also help to propose paths for mitigating the security vulnerabilities, which are the actions or measures that can be taken to eliminate, reduce, or transfer the security risk associated with the security vulnerabilities. Discovering unmitigated security vulnerabilities, and proposing paths for mitigating them, is the most important goal of conducting security assessments, as it can help to improve the security level and quality of the system or network, and to prevent or minimize the potential damage or loss caused by the security incidents or breaches . References: [CISSP CBK, Fifth Edition, Chapter 6, page 540]; [CISSP Practice Exam – FREE 20 Questions and Answers, Question 12].

The primary security concern for an organization that publishes and periodically updates its employee policies in a file on their intranet is integrity. Integrity is the property that ensures that the data or the information is accurate, complete, consistent, and authentic, and that it has not been modified, altered, or corrupted by unauthorized or malicious parties. Integrity is a primary security concern for the employee policies file on the intranet, as it can affect the compliance, trust, and reputation of the organization, and the rights and responsibilities of the employees. The employee policies file must reflect the current and valid policies of the organization, and must not be changed or tampered with by anyone who is not authorized or qualified to do so.
Availability, confidentiality, and ownership are not the primary security concerns for the employee policies file on the intranet, as they are related to the accessibility, protection, or attribution of the data or the information, not the accuracy or the authenticity of the data or the information. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1, Security and Risk Management, page 20. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1, Security and Risk Management, page 33.

A penetration test is the best type of assessment to gain a comprehensive understanding of the startup’s security posture. A penetration test is a simulated attack on a system or a network, performed by authorized testers, to evaluate the security and vulnerability of the system or network. A penetration test can provide the following benefits for the IT consulting firm that is considering acquiring the startup:
* It can reveal the actual risks and impacts of the potential attacks or threats on the system or network, by exploiting the vulnerabilities or weaknesses in the system or network.
* It can measure the effectiveness and maturity of the security controls and policies implemented by the system or network, by testing the detection, prevention, and response capabilities of the system or network.
* It can provide the recommendations and solutions for improving the security and resilience of the system or network, by identifying and prioritizing the remediation actions for the system or network. A penetration test can provide more comprehensive and realistic information about the startup’s security posture than other types of assessments, such as a security audit, a tabletop exercise, or a security threat model, which are more theoretical, formal, or hypothetical in nature. References: CISSP All-in-One Exam Guide, Chapter 6: Security Assessment and Testing, Section: Penetration Testing, pp. 553-554.

A characteristic of an internal audit is that management is responsible for reading and acting upon the internal audit results. An internal audit is an independent and objective evaluation or assessment of the internal controls, processes, or activities of an organization, performed by a group of auditors or professionals who are part of the organization, such as the internal audit department or the audit committee. An internal audit can provide some benefits for security, such as enhancing the accuracy and the reliability of the operations, preventing or detecting fraud or errors, and supporting the audit and the compliance activities. An internal audit can involve various steps and roles, such as:
* Planning, which is the preparation or the design of the internal audit, by the internal auditor or the audit team, who are responsible for conducting or performing the internal audit. Planning includes defining the objectives, scope, criteria, and methodology of the internal audit, as well as identifying and analyzing the risks and the stakeholders of the internal audit.
* Execution, which is the implementation or the performance of the internal audit, by the internal auditor
* or the audit team, who are responsible for collecting and evaluating the evidence or the data related to the internal audit, using various tools and techniques, such as interviews, observations, tests, or surveys.
* Reporting, which is the communication or the presentation of the internal audit results, by the internal auditor or the audit team, who are responsible for preparing and delivering the internal audit report, which contains the findings, conclusions, and recommendations of the internal audit, to the management or the audit committee, who are the primary users or recipients of the internal audit report.
* Follow-up, which is the verification or the validation of the internal audit results, by the management or the audit committee, who are responsible for reading and acting upon the internal audit report, as well as by the internal auditor or the audit team, who are responsible for monitoring and reviewing the actions taken by the management or the audit committee, based on the internal audit report.
Management is responsible for reading and acting upon the internal audit results, as they are the primary users or recipients of the internal audit report, and they have the authority and the accountability to implement or execute the recommendations or the improvements suggested by the internal audit report, as well as to report or disclose the internal audit results to the external parties, such as the regulators, the shareholders, or the customers. An internal audit is typically shorter in duration than an external audit, the internal audit schedule is published to the organization well in advance, and the internal auditor reports to the audit committee are not characteristics of an internal audit, although they may be related or possible aspects of an internal audit. An internal audit is typically shorter in duration than an external audit, as it is performed by a group of auditors or professionals who are part of the organization, and who have more familiarity and access to the internal controls, processes, or activities of the organization, compared to a group of auditors or professionals who are outside the organization, and who have less familiarity and access to the internal controls, processes, or activities of the organization. However, an internal audit is typically shorter in duration than an external audit is not a characteristic of an internal audit, as it is not a defining or a distinguishing feature of an internal audit, and it may vary depending on the type or the nature of the internal audit, such as the objectives, scope, criteria, or methodology of the internal audit. The internal audit schedule is published to the organization well in advance, as it is a good practice or a technique that can help to ensure the transparency and the accountability of the internal audit, as well as to facilitate the coordination and the cooperation of the internal audit stakeholders, such as the management, the audit committee, the internal auditor, or the audit team.

Explanation