ISC Updated CISSP Exam Questions and Answers by livia

The preferred access control mechanism for an IT infrastructure project with high employee turnover is Role-Based Access Control (RBAC). RBAC is a type of access control model that assigns permissions to users based on their roles or functions within the organization, rather than on their individual identities or attributes. RBAC can be preferred for an IT infrastructure project with high employee turnover because it can simplify the management and the administration of the user accounts and access rights. RBAC can reduce the administrative overhead and ensure the consistency and accuracy of the user accounts and access rights, by using predefined roles or groups that have defined privileges. RBAC can also facilitate the identity lifecycle management activities, such as provisioning, review, or revocation, by adding or removing users from the roles or groups based on their current jobs. RBAC can also provide some benefits for security, such as enforcing the principle of least privilege, facilitating the separation of duties, and supporting the audit and compliance activities. Attribute Based Access Control (ABAC), Discretionary Access Control (DAC), and Mandatory Access Control (MAC) are not the preferred access control mechanisms for an IT infrastructure project with high employee turnover, although they may be related or useful access control models. ABAC is a type of access control model that assigns permissions to users with policies that combine attributes together. Attributes are characteristics or properties of the users, the objects, the environment, or the actions. ABAC can provide some benefits for access control, such as enhancing the flexibility and the granularity of the permissions, supporting the dynamic and complex scenarios, and enabling the interoperability and scalability of the systems or the network. However, ABAC is not preferred for an IT infrastructure project with high employee turnover, as it can be difficult and costly to implement and manage, due to the large number and variety of attributes and policies, and the lack of standardization and validation of the attributes and policies. DAC is a type of access control model that assigns permissions to users based on their identities or their ownership of the objects. DAC is enforced by the owner or the creator of the object, who can grant or revoke permissions to other users at their discretion. DAC can provide some benefits for access control, such as enhancing the flexibility and the usability of the permissions, supporting the user collaboration and sharing, and enabling the user autonomy and responsibility. However, DAC is not preferred for an IT infrastructure project with high employee turnover, as it can be insecure and inconsistent, due to the lack of centralized control and oversight of the permissions, and the potential for excessive or unauthorized permissions. MAC is a type of access control model that assigns permissions to users and objects based on their security labels, which indicate their level of sensitivity or trustworthiness. MAC is enforced by the system or the network, rather than by the owner or the creator of the object, and it cannot be modified or overridden by the users. MAC can provide some benefits for access control, such as enhancing the confidentiality and the integrity of the data, preventing unauthorized access or disclosure, and supporting the audit and compliance activities. However, MAC is not preferred for an IT infrastructure project with high employee turnover, as it can be rigid and complex, due to the strict and predefined rules and policies of the permissions, and the difficulty and overhead of assigning and maintaining the security labels. 

 Cookie manipulation is a technique that allows an attacker to intercept, modify, or forge a cookie, which is a piece of data that is used to maintain the state of a web session. By manipulating the cookie, the attacker can hijack the session and gain unauthorized access to the web application. Known-plaintext attack, DoS, and SQL injection are not directly related to session hijacking, although they can be used for other purposes, such as breaking encryption, disrupting availability, or executing malicious commands. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6: Communication and Network Security, page 729; Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 4: Communication and Network Security, page 522.

The most significant benefit of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers is non-repudiation. Non-repudiation is a security property that ensures that the parties involved in a communication or transaction cannot deny their participation or the validity of the data. Non-repudiation can provide some benefits for web security, such as enhancing the accountability and trustworthiness of the parties, preventing fraud or disputes, and enabling legal or forensic evidence. Certificate based encryption is a technique that uses digital certificates to encrypt and decrypt data. Digital certificates are issued by a trusted certificate authority (CA), and contain the public key and other information of the owner. Certificate based encryption can provide non-repudiation by using the public key and the private key of the parties to perform encryption and decryption, and by using digital signatures to verify the identity and the integrity of the data. Certificate based encryption can also provide confidentiality, integrity, and authentication for the communication. Session keys are temporary keys that are used to encrypt and decrypt data for a single session or communication. Session keys are usually randomly generated and exchanged between the parties using a key exchange protocol, such as Diffie-Hellman or RSA. Session keys can provide confidentiality and integrity for the communication, but they cannot provide non-repudiation, as the parties can deny their possession or usage of the session keys, or claim that the session keys were compromised or tampered with. Efficiency, confidentiality, and privacy are not the most significant benefits of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers, although they may be related or useful properties. Efficiency is a performance property that measures how well a system or a process uses the available resources, such as time, space, or energy. Efficiency can be affected by various factors, such as the design, the implementation, the optimization, or the maintenance of the system or the process. Efficiency may or may not be improved by an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers, depending on the trade-offs between the security and the performance of the encryption techniques. Confidentiality is a security property that ensures that the data is only accessible or disclosed to the authorized parties. Confidentiality can be provided by both session keys and certificate based encryption, as they both use encryption to protect the data from unauthorized access or disclosure. However, confidentiality is not the most significant benefit of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers, as it is not a new or enhanced property that is introduced by the upgrade. Privacy is a security property that ensures that the personal or sensitive information of the parties is protected from unauthorized collection, processing, or sharing. Privacy can be affected by various factors, such as the policies, the regulations, the technologies, or the behaviors of the parties involved in the communication or transaction. Privacy may or may not be improved by an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers, depending on the type and the amount of information that is encrypted and transmitted. However, privacy is not the most significant benefit of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers, as it is not a direct or specific property that is provided by the encryption techniques. 

The steps of a risk assessment are identification, analysis, and evaluation. Identification is the process of finding and listing the assets, threats, and vulnerabilities that are relevant to the risk assessment. Analysis is the process of estimating the likelihood and impact of each threat scenario and calculating the level of risk. Evaluation is the process of comparing the risk level with the risk criteria and determining whether the risk is acceptable or not. Mitigation is not part of the risk assessment, but it is part of the risk management, which is the process of applying controls to reduce or eliminate the risk. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 36; Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 1: Security and Risk Management, page 28.