CISSP Exam Cram 2

Preface

CISSP Exam Cram 2Introduction

Welcome to CISSP Exam Cram 2! This book covers the CISSP certification exam. Whether this is your first or your fifteenth Exam Cram 2, you'll find information here and in Chapter 1 that will ensure your success as you pursue knowledge, experience, and certification. This introduction explains the ISC2 certification programs in general and talks about how the Exam Cram 2 series can help you prepare for the CISSP exam.

This book is one of the Exam Cram 2 series of books and will help by getting you on you way to becoming an ISC2 Certified Information Systems Security Professional (CISSP).

This introduction discusses the basics of the CISSP exam. Included are sections covering preparation, how to take an exam, a description of this book's contents, how this book is organized, and, finally, author contact information.

Each chapter in this book contains practice questions. There are also two full-length practice exams at the end of the book. Practice exams in this book should provide an accurate assessment of the level of expertise you need to obtain to pass the test. Answers and explanations are included for all test questions. It is best to obtain a level of understanding equivalent to a consistent pass rate of at least 95% or more on the practice questions and exams in this book before you attempt the real exam.

Let's begin by looking at preparation for the exam.

Preparing for the CISSP exam requires that you obtain and study materials designed to provide comprehensive information about security. The following list of materialswill help you study and prepare:

• The ISC2 website, at http://www.isc2.org

• The study guide available at the ISC2 website

• The CISSP open study guide website, at http://www.cccure.org

Many people form study groups to help them study for and master the material needed to pass the CISSP exam.

You don't need to know much about practice tests, other than that they are a worthwhile expense for three reasons. First, they help you diagnose areas of weakness. Second, they are useful for getting used to the format of questions. Third, they help you to decide when you are ready to take the exam. This book contains questions at the end of each chapter and includes two full-length practice tests. However, if you still want more, a related Exam Cram 2 CISSP Practice Questions Exam book has more than 500 additional questions. The questions are in paper form so that you can practice in an environment similar to the real exam; they are also available electronically as a practice test CD in the back of the book. Many other companies provide CISSP certification practice tests as well.

When you have prepared for the exam, you must register with ISC2 to take the exam. The CISSP exam is given throughout the year at various locations. You can find the latest scheduleat http://www.isc2.org/cgi-bin/exam_schedule.cgi?displaycategory=1182.Many peopledecideto travelto theexam location;otherswait untilit isgivenat a locationcloserto them.ISC2 hasimplementedregionalpricing:As anexample,earlyregistrationis $499in theU.S.,comparedto standardregistrationof $599.Checkthe ISC2websiteat http://www.isc2.org/download/regional_pricing.pdf to get specific details.

You can register for an exam done online, by mail, or by fax. The online form is availableat http://www.isc2.org/cgi-bin/content.cgi?category=542. After you register, you will receive a confirmation notice.

As with any examination, arrive at the testing center early. Be prepared! You will need to bring the confirmation letter and identification such as a driver's license, green card, or passport. Any photo ID will suffice. Two forms of ID are usually required. The testing center staff requires proof that you are who you say you are and that someone else is not taking the test for you.

Caution - You'll be spending a lot of time in the exam room. The total test time is 6 hours, so eat a good breakfast and take a snack and bottle of water with you to the testing area.

You will not be allowed to take study materials or anything else into the examination room with you that could raise the suspicion that you're cheating.

Examination results are not available after the exam. You must wait up to 4–6 weeks to get your results by email or snail mail.

You must wait at least 90 days to retake a failed examination. If you fail, you should use that time to brush up on your areas of weakness. Additionally, invest in some practice tests if you have not already done so. There is much to be said for "getting used to" a testing format.

When you pass the exam, you still need to attest to the CISSP code of ethics and have an existing CISSP complete a endorsement form for you.

When you receive notice of your passing grade, a blank endorsement form will be sent with it. The endorsement form must be completed by someone who can attest to your professional experience and who is an active CISSP in good standing. If you don't know anyone who is CISSP certified, ISC2 allows endorsements from other professionals who are certified, licensed, or commissioned, and an officer of the corporation where you are employed. You can review complete information on the endorsement form at the ISC2 website.

The ideal reader for an Exam Cram 2 book is someone seeking certification. However, it should be noted that an Exam Cram 2 book is a very easily readable, rapid presentation of facts. Therefore, an Exam Cram 2 book is also extremely useful as a quick reference manual.

Most people seeking certification use multiple sources of information. Check out the links at the end of each chapter to get more information about subjects you're weak in. Practice tests can help indicate when you are ready. Various security books from retailers also describe the topics in this book in much greater detail. Don't forget that many have described the CISSP exam as being a "mile wide."

This book includes other helpful elements in addition to the actual logical, step-by-step learning progression of the chapters themselves. Exam Cram 2 books use elements such as exam alerts, tips, notes, and practice questions to make information easier to read and absorb.

Reading this book from start to finish is not necessary; this book is set up so you can quickly jump back and forth to find sections you need to study.

Use the Cram Sheet to remember last-minute facts immediately before the exam. Use the practice questions to test your knowledge. You can always brush up on specific topics in detail by referring to the table of contents and the index. Even after you achieve certification, you can use this book as a rapid-access reference manual.

Each Exam Cram 2 book has chapters that follow a predefined structure. This structure makes Exam Cram 2 books easy to read and provides a familiar format for all Exam Cram 2 books. These elements typically are used:

• Opening hotlists

• Chapter topics

• Exam Alerts

• Notes

• Tips

• Sidebars

• Cautions

• Exam-preparation practice questions and answers

• A "Need to Know More?" section at the end of each chapter

Bulleted lists, numbered lists, tables, and graphics are also used, where appropriate. A picture can paint a thousand words sometimes, and tables can help to associate different elements with each other visually.

Now let's take a look at each of the elements in detail.

• Opening hotlists—The start of every chapter contains a list of terms you should understand. A second hotlist identifies all the techniques and skills covered in the chapter.

• Chapter topics—Each chapter contains details of all subject matter listed in the table of contents for that particular chapter. The objective of an Exam Cram 2 book is to cover all the important facts without giving too much detail; it is an exam cram. When examples are required, they are included.

• Exam Alerts—Exam Alerts address exam-specific, exam-related information. An Exam Alert addresses content that is particularly important, tricky, or likely to appear on the exam. Exam Alerts look like this:

• Caution - Make sure you remember the different ways in which DES can be implemented and that ECB is considered the weakest form of DES.

• Notes—Notes typically contain useful information that is not directly related to the current topic under consideration. To avoid breaking up the flow of the text, they are set off from the regular text.

• Note - This is a note. You have already seen several notes.

• Tips—Tips often provide shortcuts or better ways to do things.

• Tip - A clipping level is the point at which you set a control to distinguish between activity that should be investigated and activity that should not be investigated.

• Sidebars—Sidebars are longer and run beside the text. They often describe real-world examples or situations.

• How Caller ID Can Be Hacked

  Sure, we all trust Caller ID, but some Voice over IP (VoIP) providers allow users to inject their own Call Party Number (CPN) into the call. Because VoIP is currently outside FCC regulation, these hacks are now possible.

• Cautions—Cautions apply directly to the use of the technology being discussed in the Exam Cram. For example, a Caution might point out that the CER is one of the most important items to examine when examining biometric devices.

• Caution - The Crossover Error Rate (CER) is the point at which Type 1 errors and Type 2 errors intersect. The lower the CER is, the more accurate the device is.

• Exam-preparation practice questions—At the end of every chapter is a list of 10–15 exam practice questions similar to those in the actual exam. Each chapter contains a list of questions relevant to that chapter, including answers and explanations. Test your skills as you read.

• "Need to Know More?" section—This section at the end of each chapter describes other relevant sources of information. With respect to this chapter, the best place to look for CISSP certification information is at the ISC2 website, http://www.ISC2.org.

Most of this Exam Cram 2 book on CISSP follows the consistent chapter structure already described. However, there are various, important elements that are not part of the standard chapter format. These elements apply to the entire book as a whole.

• Practice exams—In addition to exam-preparation questions at the end of each chapter, two full practice exams are included at the end of the book.

• Answers and explanations for practice exams—These follow each practice exam, providing answers and explanations to the questions in the exams.

• Glossary—The glossary contains a listing of important terms used in this book with explanations.

• Cram Sheet—The Cram Sheet is a quick-reference, tear-out cardboard sheet of important facts useful for last-minute preparation. Cram sheets often include a simple summary of facts that are most difficult to remember.

• CD—The CD contains the PrepLogic Practice Exams, Preview Edition exam-simulation software. The preview edition exhibits most of the full functionality of the Premium Edition, but it contains only one exam's worth of questions. To get the complete set of practice questions and full exam functionality, visit http://www.preplogic.com.

The following list provides an overview of the chapters.

• Chapter 1: "The CISSP Certification Exam"—This chapter introduces exam strategies and considerations.

• Chapter 2: "Physical Security"—This chapter details physical security and the threats and countermeasures available for protecting an organization's resources.

• Chapter 3: "Security-Management Practices"—This chapter discusses the organization's information assets and means of protection, including policies, procedures, guidelines, and assorted controls.

• Chapter 4: "Access-Control Systems and Methodology"—This chapter covers the basics of access control. Items such as identification, authentication, and authorization are discussed, as are biometric access-control systems.

• Chapter 5: "System Architecture and Models"—This chapter discusses the ways to design, monitor, implement, and lock down computer systems.

• Chapter 6: "Telecommunications and Network Security"—One of the longest chapters, this chapter discusses telecommunication technology. Items such as TCP/IP, the OSI model, routing protocols, and networking equipment are discussed.

• Chapter 7: "Applications and Systems-Development Security"—This chapter discusses databases, malicious code, knowledge-based systems, and application issues.

• Chapter 8: "Operations Security"—This chapter covers security concepts, operation controls, auditing, and resource protection.

• Chapter 9: "Business-Continuity Planning"—This chapter covers all the aspects of the BCP and DRP process. Its goal is to help the reader understand what is needed to prevent, minimize, and recover from disasters.

• Chapter 10: "Law, Investigations, and Ethics"—This chapter covers all things legal, from international law and incident response to forensics. It also covers the ethical standards that CISSP candidates must understand and abide by.

• Chapter 11: "Cryptography"—This chapter discusses the methods, means, and systems used to encrypt and protect data. Symmetric, asymmetric, and hashing algorithms are introduced, along with PKI and cryptographic methods of attack.

• Chapter 12: "Practice Exam 1"—This is a full-length practice exam.

• Chapter 13: "Answers to Practice Exam 1"—This element contains the answers and explanations for the first practice exam.

• Chapter 14: "Practice Exam 2"—This is a second full-length practice exam.

• Chapter 15: "Answers to Practice Exam 2"—This element contains the answers and explanations for the second practice exam.

Hopefully, this book provides you with the tools you need to pass the CISSP exam. Feedback is appreciated. The author can be contacted at info@thesolutionfirm.com.

Thank you for selecting my book; I hope you like it. Good luck!

© Copyright Pearson Education. All rights reserved.