CISSP Exam Dumps and Practice Questions

The option that should be included in a good defense-in-depth strategy provided by object-oriented programming for software deployment is encapsulation. Encapsulation is a technique that provides the protection and the abstraction of the data or the information and the methods or the functions that are associated with an object or a class, by hiding or restricting the access or the visibility of the data or the information and the methods or the functions from the other objects or classes, and exposing or allowing only the relevant or necessary data or information and the methods or the functions to the other objects or classes. Encapsulation can provide a good defense-in-depth strategy for software deployment, because it can:

Prevent or reduce the unauthorized or unintended access or modification of the data or the information and the methods or the functions that are associated with an object or a class, and ensure the integrity and the confidentiality of the data or the information and the methods or the functions.

Simplify or modularize the design and the development of the software, by separating or isolating the data or the information and the methods or the functions that are associated with an object or a class, and reducing the complexity or the dependency of the data or the information and the methods or the functions.

Enhance or improve the maintainability and the reusability of the software, by facilitating the changes or the updates of the data or the information and the methods or the functions that are associated with an object or a class, and enabling the reuse or the sharing of the data or the information and the methods or the functions.

The other options are not the options that should be included in a good defense-in-depth strategy provided by object-oriented programming for software deployment. Polyinstantiation is not a technique that provides the protection and the abstraction of the data or the information and the methods or the functions that are associated with an object or a class, but rather a technique that allows multiple versions or instances of the same data or the information to exist in a database, at different levels of security or classification, and for different users or groups. Polyinstantiation can provide a good defense-in-depth strategy for database security, but not for software deployment. Polymorphism is not a technique that provides the protection and the abstraction of the data or the information and the methods or the functions that are associated with an object or a class, but rather a technique that allows an object or a class to have different forms or behaviors, depending on the context or the situation, and to respond differently to the same message or the same method. Polymorphism can provide a good defense-in-depth strategy for software flexibility, but not for software deployment. Inheritance is not a technique that provides the protection and the abstraction of the data or the information and the methods or the functions that are associated with an object or a class, but rather a technique that allows an object or a class to acquire or inherit the data or the information and the methods or the functions that are associated with another object or class, and to extend or override the data or the information and the methods or the functions. Inheritance can provide a good defense-in-depth strategy for software consistency, but not for software deployment.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Software Development Security, page 1025.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 8: Software Development Security, page 1026.

The reason why it is important for the initial security categorization to be done correctly is that it determines the security requirements. Security categorization is a process that assigns a security level or a classification to a system or an information asset, based on the potential impact or the risk of a loss of confidentiality, integrity, or availability. Security categorization is done early in the system life cycle, and it is reviewed periodically, as it helps to define the security objectives, requirements, and controls for the system or the information asset, and to ensure that they are aligned with the organizational mission, goals, or policies. Security categorization also helps to prioritize the security efforts and resources, and to balance the security needs and the costs. Security categorization does not affect other steps in the certification and accreditation process, determine the functional and operational requirements, or work with selected security controls, as these are not the reasons why it is important for the security categorization to be done correctly. Certification and accreditation is a process that evaluates and validates the security posture and compliance of a system or an information asset, and that authorizes its operation or use. Certification and accreditation is based on the security categorization, but it is not affected by it. Functional and operational requirements are the requirements that specify the functionality, performance, usability, or reliability of a system or an information asset, and that support the business or operational needs. Functional and operational requirements are not determined by the security categorization, but they may influence it. Security controls are the controls that implement or enforce the security requirements, and that protect the system or the information asset from threats or vulnerabilities. Security controls are not worked with by the security categorization, but they are derived from it.Reference:Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 3: Security Architecture and Engineering, page 145.

Defining the identity mapping scheme presents the primary concern to an organization when setting up a federated single sign-on (SSO) solution with another. A federated SSO solution is a system that allows users to authenticate once and access multiple resources across different domains or organizations. An identity mapping scheme is a method of translating the user identities and attributes between different identity providers and resource providers. Defining the identity mapping scheme is a critical step in setting up a federated SSO solution, because it determines how the user information is exchanged and verified across the federation. Sending assertions to an identity provider, requesting identity assertions from the partner's domain, and having the resource provider query the identity provider are not the primary concerns to an organization when setting up a federated SSO solution with another, although they are part of the federated SSO process. An assertion is a statement or claim about a user's identity or attributes that is digitally signed by an identity provider. A resource provider is a system that provides access to a resource or service based on the user's identity or attributes. A resource provider may request or receive assertions from an identity provider or another resource provider to verify the user's identity or attributes. Reference: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Identity and Access Management, page 570. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 5: Identity and Access Management, page 389.

A function of Security Assertion Markup Language (SAML) is policy enforcement. SAML is an XML-based standard for exchanging authentication and authorization information between different entities, such as service providers and identity providers. SAML enables policy enforcement by allowing the service provider to specify the security requirements and conditions for accessing its resources, and allowing the identity provider to assert the identity and attributes of the user who requests access. The other options are not functions of SAML, but rather different concepts or technologies. File allocation is the process of assigning disk space to files. Redundancy check is a method of detecting errors in data transmission or storage. Extended validation is a type of certificate that provides a higher level of assurance for the identity of the website owner.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5, p. 283;Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 6, p. 361.

A formal review of any Disaster Recovery Plan (DRP) should be conducted at a minimum annually, or more frequently if there are significant changes in the business environment, the IT infrastructure, the security threats, or the regulatory requirements. A formal review involves evaluating the DRP against the current business needs, objectives, and risks, and ensuring that the DRP is updated, accurate, complete, and consistent.A formal review also involves testing the DRP to verify its effectiveness and feasibility, and identifying any gaps or weaknesses that need to be addressed12.Reference:1: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 10, page 10352: CISSP For Dummies, 7th Edition, Chapter 10, page 351.