Security metrics are measurements that are used to evaluate and improve the effectiveness and efficiency of security processes, controls, and outcomes. The best characteristics of security metrics are that they are consistently measured and quantitatively expressed, as this ensures that the metrics are objective, reliable, comparable, and verifiable. Security metrics should not be generalized or provide a broad overview, as this may reduce their accuracy, relevance, and usefulness. Security metrics should not use acronyms and abbreviations to be concise, as this may cause confusion, ambiguity, or misunderstanding. Security metrics may use bar charts and Venn diagrams, or other graphical or visual representations, to illustrate or communicate the results, but this is not a characteristic of the metrics themselves, but rather a presentation technique.
CISSP-KR 문제 447
보안 전문가가 다층 건물 내 새로운 데이터 센터 위치 선정에 대한 여러 가지 방안을 평가해 달라는 요청을 받았습니다. 데이터 센터와 관련하여 우려되는 사항은 전자기파 방출 및 물리적 접근 제어입니다. 다음 중 가장 적합한 위치는 어디일까요?
정답: C
The best location for a new data center within a multifloor building is in the core of the building. This location can minimize the emanations and enhance the physical access controls. Emanations are the electromagnetic signals or radiation that are emitted by electronic devices, such as computers, servers, or network equipment. Emanations can be intercepted or captured by attackers to obtain sensitive or confidential information. Physical access controls are the measures that prevent or restrict unauthorized or malicious access to physical assets, such as data centers, servers, or network devices. Physical access controls can include locks, doors, gates, fences, guards, cameras, alarms, etc. The core of the building is the central part of the building that is usually surrounded by other rooms or walls. This location can reduce the emanations by creating a shielding effect and increasing the distance from the potential attackers. The core of the building can also improve the physical access controls by limiting the entry points and visibility of the data center
CISSP-KR 문제 448
다음 중 재해 복구 계획에서 "웜 사이트"의 목적을 가장 잘 설명하는 것은 무엇입니까?
정답: B
A warm site is a partially configured alternate facility that has some hardware, network connectivity, and infrastructure in place but requires additional steps-such as installing remaining equipment and restoring data from backups-before it can support operations, offering a middle ground between the cost of a hot site and the slower recovery of a cold site.
CISSP-KR 문제 449
다음 문서 중 재해 복구(DR) 패키지에 포함되어야 하는 문서는 무엇입니까?
정답: C
A Disaster Recovery (DR) package is a set of documents, tools, and resources that are needed to restore the normal operations of a system or network after a disaster. A DR package should include the following documentation: hardware configuration instructions, hardware configuration software, an operating system image, a data restoration option, media retrieval instructions, backup and recovery procedures, contact lists, and emergency response plans. These documents can help to rebuild the system or network from scratch, restore the data from backups, and resume the business functions as quickly as possible. Source code, compiled code, firmware updates, operational log book and manuals are not essential for a DR package, as they are more related to development, maintenance, or operation of the system or network. Data encrypted in original format, auditable transaction data, and recovery instructions for future extraction on demand are not part of a DR package, as they are more related to data security, audit, or compliance. System configuration including hardware, software, hardware, interfaces, software Application Programming Interface (API) configuration, data structure, ... are not sufficient for a DR package, as they do not include the instructions, software, or procedures to restore the system or network.
CISSP-KR 문제 450
사용자는 중요하지 않은 파일에 대한 읽기 전용 액세스를 요청하는 전자 메일 요청을 보냅니다. DAC (임의 액세스 제어) 방법이 있습니다. 관리자가 취해야 할 가장 적합한 방법은 무엇입니까?
정답: A
According to the CISSP Official (ISC)2 Practice Tests3, the most suitable approach that the administrator should take when a user requests read-only access to files that are not considered sensitive in a Discretionary Access Control (DAC) methodology is to request data owner approval to the user access. DAC is a type of access control that grants or denies access to an object based on the identity and permissions of the subject, and the discretion of the owner of the object. The owner of the object has the authority and responsibility to determine who can access the object and what level of access they can have, such as read, write, execute, or delete. The owner can also delegate the access rights to other subjects or groups, or revoke them as needed. The administrator is the person who manages and maintains the system and the access control mechanisms, but does not have the authority to grant or deny access to the objects without the owner's consent. Therefore, the administrator should request data owner approval to the user access, regardless of the sensitivity of the files, to ensure that the access is authorized and compliant with the DAC methodology. Requesting manager approval for the user access is not the most suitable approach, as the manager may not be the owner of the files, and may not have the authority or knowledge to grant or deny access to the files. Directly granting the access to the non-sensitive files is not the most suitable approach, as it may violate the DAC methodology and the owner's discretion, and may introduce unauthorized or excessive access to the files. Assessing the user access need and either granting or denying the access is not the most suitable approach, as it may violate the DAC methodology and the owner's discretion, and may introduce unauthorized or excessive access to the files.
