[2022】有効な新しいCISSP試験ノート＆CISSP有効な試験ガイド【Q346-Q370】を使用する。

Answer “Objects never change their security level in a way that would violate the system security policy” is known as the weak tranquility property. The two other answers are distracters.

Because the Reference Monitor is responsible for access control to the objects by the subjects it compares the security labels of a subject and an object.
According to the OIG: The reference monitor is an access control concept referring to an abstract machine that mediates all accesses to objects by subjects based on information in an access control database. The reference monitor must mediate all access, be protected from modification, be verifiable as correct, and must always be invoked. The reference monitor, in accordance with the security policy, controls the checks that are made in the access control database.
The following are incorrect:
Validation Module. A Validation Module is typically found in application source code and is used to validate data being inputted. Clearance Check. Is a distractor, there is no such thing other than what someone would do when
checking if someone is authorized to access a secure facility.
Security Module. Is typically a general purpose module that prerforms a variety of security related
functions.
参考文献
OIG CBK, Security Architecture and Design (page 324)
AIO, 4th Edition, Security Architecture and Design, pp 328-328.
Wikipedia – http://en.wikipedia.org/wiki/Reference_monitor

Data mining is used to reveal hidden relationships, patterns and trends by running
queries on large data stores.
Data mining is the act of collecting and analyzing large quantities of information to determine
patterns of use or behavior and use those patterns to form conclusions about past, current, or
future behavior. Data mining is typically used by large organizations with large databases of
customer or consumer behavior. Retail and credit companies will use data mining to identify
buying patterns or trends in geographies, age groups, products, or services. Data mining is
essentially the statistical analysis of general information in the absence of specific data.
The following are incorrect answers:
They are incorrect as they all apply to Protecting Objects and the data within them. Layering,
abstraction and data hiding are related concepts that can work together to produce modular
software that implements an organizations security policies and is more reliable in operation.
Layering is incorrect. Layering assigns specific functions to each layer and communication
between layers is only possible through well-defined interfaces. This helps preclude tampering in
violation of security policy. In computer programming, layering is the organization of programming
into separate functional components that interact in some sequential and hierarchical way, with
each layer usually having an interface only to the layer above it and the layer below it.
Abstraction is incorrect. Abstraction “hides” the particulars of how an object functions or stores
information and requires the object to be manipulated through well-defined interfaces that can be
designed to enforce security policy. Abstraction involves the removal of characteristics from an
entity in order to easily represent its essential properties.
Data hiding is incorrect. Data hiding conceals the details of information storage and manipulation
within an object by only exposing well defined interfaces to the information rather than the
information itslef. For example, the details of how passwords are stored could be hidden inside a
password object with exposed interfaces such as check_password, set_password, etc. When a
password needs to be verified, the test password is passed to the check_password method and a
boolean (true/false) result is returned to indicate if the password is correct without revealing any
details of how/where the real passwords are stored. Data hiding maintains activities at different
security levels to separate these levels from each other.
The following reference(s) were used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 27535-27540). Auerbach Publications. Kindle Edition.
そして
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 4269-4273). Auerbach Publications. Kindle Edition.

Aggregation is the act of obtaining information of a higher sensitivity by combining information from lower levels of sensitivity.
The incorrect answers are:
Polyinstantiation is the development of a detailed version of an object from another object using different values in the new object.
Inference is the ability of users to infer or deduce information about data at sensitivity levels for which they do not have access privilege.
Data mining refers to searching through a data warehouse for data correlations.
Sources:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 7: Applications and
Systems Development (page 261).
KRUTZ, Ronald & VINES, Russel, The CISSP Prep Guide: Gold Edition, Wiley Publishing
Inc., 2003, Chapter 7: Database Security Issues (page 358).

The correct answer is “Have a higher strength per bit than an RSA”. It is more difficult to compute Elliptic Curve discreet logarithms than conventional discreet logarithms or factoring. Smaller key sizes in the elliptic curve implementation can yield higher levels of security. Therefore, answer “Have a lower strength per bit than an RSA” is incorrect. Answers “Cannot be used to implement digital signatures” and “Cannot be used to implement encryption” are incorrect because elliptic curve cryptosystems
can be used for digital signatures and encryption.

説明／参照
説明する：
The U.S. Department of Defense developed the Trusted Computer System Evaluation Criteria (TCSEC), which was used to evaluate operating systems, applications, and different products. These evaluation criteria are published in a book known as the Orange Book.
TCSEC provides a classification system that is divided into hierarchical divisions of assurance levels:
A. Verified protection
B. Mandatory protection
C. Discretionary protection
D. Minimal protection
Classification A represents the highest level of assurance, and D represents the lowest level of assurance.
Division D: Minimal Protection: There is only one class in Division D. It is reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.
Incorrect Answers:
B: Level C is defined as discretionary protection, not minimal protection.
C: Level B is defined as mandatory protection, not minimal protection.
D: Level A is defined as verified protection, not mandatory minimal.
参考文献
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 392, 395

The Diffie-Hellman key agreement protocol (also called exponential key agreement) was developed by Diffie and Hellman [DH76] in 1976 and published in the ground-breaking paper “New Directions in Cryptography.” The protocol allows two users to exchange a secret key over an insecure medium without any prior secrets.
The protocol has two system parameters p and g. They are both public and may be used by all the users in a system. Parameter p is a prime number and parameter g (usually called a generator) is an integer less than p, with the following property: for every number n between 1 and p-1 inclusive, there is a power k of g such that n = gk mod p.
Suppose Alice and Bob want to agree on a shared secret key using the Diffie-Hellman key agreement protocol. They proceed as follows: First, Alice generates a random private value a and Bob generates a random private value b. Both a and b are drawn from the set of integers . Then they derive their public values using parameters p and g and their private values. Alice’s public value is ga mod p and Bob’s public value is gb mod p. They then exchange their public values. Finally, Alice computes gab = (gb)a mod p, and Bob computes gba = (ga)b mod p. Since gab = gba = k, Alice and Bob now have a shared secret key k.
The protocol depends on the discrete logarithm problem for its security. It assumes that it is
computationally infeasible to calculate the shared secret key k = gab mod p given the two public
values ga mod p and gb mod p when the prime p is sufficiently large. Maurer [Mau94] has shown
that breaking the Diffie-Hellman protocol is equivalent to computing discrete logarithms under
certain assumptions.
The Diffie-Hellman key exchange is vulnerable to a man-in-the-middle attack. In this attack, an
opponent Carol intercepts Alice’s public value and sends her own public value to Bob. When Bob
transmits his public value, Carol substitutes it with her own and sends it to Alice. Carol and Alice
thus agree on one shared key and Carol and Bob agree on another shared key. After this
exchange, Carol simply decrypts any messages sent out by Alice or Bob, and then reads and
possibly modifies them before re-encrypting with the appropriate key and transmitting them to the
other party. This vulnerability is present because Diffie-Hellman key exchange does not
authenticate the participants. Possible solutions include the use of digital signatures and other
protocol variants.
The authenticated Diffie-Hellman key agreement protocol, or Station-to-Station (STS) protocol,
was developed by Diffie, van Oorschot, and Wiener in 1992 [DVW92] to defeat the man-in-the-
middle attack on the Diffie-Hellman key agreement protocol. The immunity is achieved by allowing
the two parties to authenticate themselves to each other by the use of digital signatures (see
Question 2
.2.2) and public-key certificates (see Question 4.1.3.10).
Roughly speaking, the basic idea is as follows. Prior to execution of the protocol, the two parties
Alice and Bob each obtain a public/private key pair and a certificate for the public key. During the
protocol, Alice computes a signature on certain messages, covering the public value ga mod p.
Bob proceeds in a similar way. Even though Carol is still able to intercept messages between Alice
and Bob, she cannot forge signatures without Alice’s private key and Bob’s private key. Hence, the
enhanced protocol defeats the man-in-the-middle attack.
In recent years, the original Diffie-Hellman protocol has been understood to be an example of a
much more general cryptographic technique, the common element being the derivation of a
shared secret value (that is, key) from one party’s public key and another party’s private key. The
parties’ key pairs may be generated anew at each run of the protocol, as in the original Diffie-
Hellman protocol. The public keys may be certified, so that the parties can be authenticated and
there may be a combination of these attributes. The draft ANSI X9.42 (see
Question 5
.3.1)
illustrates some of these combinations, and a recent paper by Blake-Wilson, Johnson, and
Menezes provides some relevant security proofs.
参考文献
TIPTON, et. al., Official (ISC)2 Guide to the CISSP CBK 2007 edition, page 257.
And
RSA laboratoires web site: http://www.rsa.com/rsalabs/node.asp?id=2248 :

説明／参照
説明する：
Lattice-based access control is a mathematical model that allows a system to easily represent the different security levels and control access attempts based on those levels. Every pair of elements has a highest lower bound and a lowest upper bound of access rights.
Incorrect Answers:
A: Role-based access control (RBAC) provides access to resources according to the role the user holds within the company or the tasks that the user has been assigned.
C: Biba is a security model, rather than an access control model. It centers on preventing information from flowing from a low integrity level to a high integrity level
D: Content-dependent access control is when the access decisions depend upon the value of an attribute of the object itself.
参考文献
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 224, 377, G-9
http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.41.5365

The correct answer is “Prolonged low voltage”. Answer “prolonged power loss” is a blackout. Answer “momentary low voltage” is a sag. Answer “momentary high voltage” is a spike.

説明／参照
説明する：
Competitive intelligence is the action of defining, gathering, analyzing, and distributing intelligence about a business including intelligence on products, customers, competitors, and any aspect of the environment needed to support executives and managers making strategic decisions for an organization. A competitive intelligence attack is therefore best classified as a business attack.
Incorrect Answers:
B: A competitive intelligence attack concerns intelligence about a business, not just intelligence in general.
C: A competitive intelligence attack concerns intelligence about a business as a whole, not just the financial dimension.
D: A competitive intelligence is not a grudge attack. It is an attack against a business.
参考文献
https://en.wikipedia.org/wiki/Competitive_intelligence

Role-based access control (RBAC) gives the security officers the ability to specify and enforce enterprise-specific security policies in a way that maps naturally to an organization’s structure. Each user is assigned one or more roles, and each role is assigned one or more privileges that are given to users in that role. An access control list
(ACL) is a table that tells a system which access rights each user has to a particular system object. With discretionary access control, administration is decentralized and owners of resources control other users’ access. Non-mandatory access control is not a defined access control technique.
Source: ANDRESS, Mandy, Exam Cram CISSP, Coriolis, 2001, Chapter 2: Access Control
Systems and Methodology (page 9).

説明／参照
説明する：
The question states that you are looking at recorded events on closed-circuit TV camera. This is a detective control. The purpose of a detective control is to identify an incident’s activities after it took place.
Examples or detective controls are cameras, logs, investigations and IDS.
Incorrect Answers:
A: Preventative controls are intended to avoid an incident from occurring. In this question, the event has occurred. Therefore, this answer is incorrect.
C: Compensating control are controls that provide an alternative measure of control. This is not what is described in the question. Therefore, this answer is incorrect.
D: Corrective controls fix components or systems after an incident has occurred. Watching camera footage does not fix anything. Therefore, this answer is incorrect.
参考文献
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 30

TLS is discussed in the answer to
question 5
. WTLS has to incorporate functionality that is provided for in TLS by TCP in the TCP/IP Protocol suite in that WTLS can operate over UDP. WTLS supports data privacy, authentication and integrity. Because WTLS has to incorporate a large number of handshakes when security is implemented, significant delays may occur. During a WTLS handshake session, WTLS can set up the following security classes: Class 1. No certificates Class 2. The client does not have a certificate; the server has a certificate Class 3. The client and server have certificates

説明／参照
説明する：
An Intrusion Detection System (IDS) is a system that is used to monitor network traffic or to monitor host audit logs in order to determine if any violations of an organization’s security policy have taken place. An IDS can detect intrusions that have circumvented or passed through a firewall or are occurring within the local area network behind the firewall.
A network-based IDS usually provides reliable, real-time information without consuming network or host resources. A network-based IDS is passive while it acquires data. Because a network-based IDS reviews packets and headers, denial of service attacks can also be detected. Furthermore, because this IDS is monitoring an attack in realtime, it can also respond to an attack in progress to limit damage.
Incorrect Answers:
B: A network-based IDS does not detect viruses.
C: A network-based IDS does not detect data corruption.
D: A network-based IDS does not detect all password guessing attacks.
参考文献
Krutz, Ronald L. and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p. 71

Pipelining is a natural concept in everyday life, e.g. on an assembly line.
Consider the assembly of a car: assume that certain steps in the assembly line are to install the engine, install the hood, and install the wheels (in that order, with arbitrary interstitial steps). A car on the assembly line can have only one of the three steps done at once. After the car has its engine installed, it moves on to having its hood installed, leaving the engine installation facilities available for the next car. The first car then moves on to wheel installation, the second car to hood installation, and a third car begins to have its engine installed. If engine installation takes 20 minutes, hood installation takes 5 minutes, and wheel installation takes 10 minutes, then finishing all three cars when only one car can be assembled at once would take 105 minutes. On the other hand, using the assembly line, the total time to complete all three is 75 minutes. At this point, additional cars will come off the assembly line at 20 minute increments.
In computing, a pipeline is a set of data processing elements connected in series, so that the output of one element is the input of the next one. The elements of a pipeline are often executed in parallel or in time-sliced fashion; in that case, some amount of buffer storage is often inserted between elements. Pipelining is used in processors to allow overlapping execution of multiple instructions within the same circuitry. The circuitry is usually divided into stages, including instruction decoding, arithmetic, and register fetching stages, wherein each stage processes one instruction at a time.
The following were not correct answers:
CISC: is a CPU design where single instructions execute several low-level operations
(such as a load from memory, an arithmetic operation, and a memory store) within a single instruction.
RISC: is a CPU design based on simplified instructions that can provide higher performance as the simplicity enables much faster execution of each instruction.
Multitasking: is a method where multiple tasks share common processing resources, such as a CPU, through a method of fast scheduling that gives the appearance of parallelism, but in reality only one task is being performed at any one time.
参考までに：
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, pages 188-189.
Also see
http://en.wikipedia.org/wiki/Pipeline_(computing)

The correct answer is “Enrollment time”.
Answers Set-up time and Log-in time are distracters.
Answer throughput, refers to the rate at which individuals once enrolled can be processed and identified or authenticated by a biometric system.