Reduce Cyber Risk Podcast - Cyber Security Made Simple

Latest Episodes:

RCR 074: CISSP Practice Exam Questions - CISSP Training and Study! Feb 24, 2020

Show notes

Shon Gerber from ShonGerber.com provides you the information and knowledge you need to prepare and pass the CISSP Exam while providing the tools you need to enhance your cybersecurity career. Shon utilizes his expansive knowledge while providing superior training from his years of training people in cybersecurity.

In this episode, Shon will provide CISSP training for Domain 6 (Security Assessment and Testing) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

CISSP Article – RAYGUN - SDLC: 7 phases, popular models, benefits, and more
CISSP Training – Integrate Security in the Software Development Life Cycle (SDLC)
CISSP Exam Questions

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 105

What tool is commonly used as scan engine to find vulnerabilities within an environment

Nessus
NMAP
Ping
DNS

Explanation: [a] Nessus is commonly used to look for vulnerabilities within an network to determine if an exploit can be used against the system.

------------------------------------

Question: 106

What are the typical components that security assessments are typically used within an organization?

Tests, Assessments, and Audits
Tests, Audits, and Reviews
Assessments, Access Reviews, Tests
None of the above

Explanation: [a] Tests, Assessments, and Audits are the main components of a security assessment for an organization.

------------------------------------

Question: 107

Which one items below is not normally added as part of a security assessment?

Risk assessments
Vulnerability mitigation strategies
Threat assessments
Vulnerability scan

Explanation: [c] Vulnerability mitigation strategies are not typically added as a part of the overall security assessment as the mitigation and/or acceptance of risk is highly dependent on the organization.

------------------------------------

Want to find Shon elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide
- https://www.isc2.org/Training/Self-Study-Resources

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 073: Practice CISSP Exam Questions - CISSP Training and Study! Feb 22, 2020

Show notes

In this episode, Shon will provide CISSP training for Domain 5 (Identity and Access Management) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 102

If you want to restrict access into or out of a facility, which would you choose?

A) Gate
B) Turnstile
C) Fence
D) Mantrap

Turnstile

A turnstile is a form of gate that prevents more than one person from gaining entry at a time and often restricts movement to one direction. It is used to gain entry but not exit, or vice versa.

From <https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328>

------------------------------------

Question: 103

Which of the following is not a disadvantage of using security guards?

A) Security guards are usually unaware of the scope of the operations within a facility.
B) Not all environments and facilities support security guards.
C) Not all security guards are themselves reliable.
D) Prescreening, bonding, and training does not guarantee effective and reliable security guards.

Security guards are usually unaware of the scope of the operations within a facility.

Security guards are usually unaware of the scope of the operations within a facility, which supports confidentiality of those operations and thus helps reduce the possibility that a security guard will be involved in the disclosure of confidential information.

From <https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328>

------------------------------------

Question: 104

What type of motion detector senses changes in the electrical or magnetic field surrounding a monitored object?

A) Wave
B) Photoelectric
C) Heat
D) Capacitance

Capacitance

A capacitance motion detector senses changes in the electrical or magnetic field surrounding a monitored object.

From <https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328>

------------------------------------

Want to find Shon elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide
- https://www.isc2.org/Training/Self-Study-Resources

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 072: Practice CISSP Exam Questions - CISSP Training and Study! Feb 19, 2020

Show notes

In this episode, Shon will provide CISSP training for Domain 5 (Identity and Access Management) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 099

What is the ideal humidity range for a computer room?

A) 20-40 percent
B) 40-60 percent
C) 60-75 percent
D) 80-95 percent

40-60 percent

The humidity in a computer room should ideally be from 40 to 60 percent.

From <https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328>

------------------------------------

Question: 100

A Type B fire extinguisher may use all except which of the following suppression mediums?

A) Water
B) CO2
C) Halon or an acceptable halon substitute
D) Soda acid

Water

Water is never the suppression medium in Type B fire extinguishers because they are used on liquid fires.

From <https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328>

------------------------------------

Question: 101

Which of the following is not a disadvantage of using security guards?

A) Security guards are usually unaware of the scope of the operations within a facility.
B) Not all environments and facilities support security guards.
C) Not all security guards are themselves reliable.
D) Prescreening, bonding, and training does not guarantee effective and reliable security guards.

Security guards are usually unaware of the scope of the operations within a facility.

From <https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328>

------------------------------------

Want to find Shon elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide
- https://www.isc2.org/Training/Self-Study-Resources

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 071: Understanding Multi-factor Authentication to Pass the CISSP - CISSP Training and Study Feb 17, 2020

Show notes

In this episode, Shon will provide CISSP training for Domain 5 (Identity and Access Management) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 096

At what voltage level can static electricity cause destruction of data stored on hard drives?

A) 4,000
B) 17,000
C) 40
D) 1,500

1,500

Destruction of data stored on hard drives can be caused by 1,500 volts of static electricity.

From https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328

------------------------------------

Question: 097

What type of physical security controls focus on facility construction and selection, site management, personnel controls, awareness training, and emergency response and procedures?

A) Technical
B) Physical
C) Administrative
D) Logical

Administrative

Administrative physical security controls include facility construction and selection, site management, personnel controls, awareness training, and emergency response and procedures.

From https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328

------------------------------------

Question: 098

Which of the following is typically not a culprit in causing damage to computer equipment in the event of a fire and a triggered suppression?

A) Heat
B) Suppression medium
C) Smoke
D) Light

Light

Light is usually not damaging to most computer equipment, but fire, smoke, and the suppression medium (typically water) are very destructive.

From https://www.brainscape.com/flashcards/physical-environmental-security-1004067/packs/1774328

------------------------------------

Want to find Shon elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide
- https://www.isc2.org/Training/Self-Study-Resources
Online Article
- https://www.hidglobal.com/blog/multi-factor-authentication-and-single-sign-explained

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 070: CISSP Sample Exam Questions - CISSP Training and Study! Feb 15, 2020

Show notes

Subscribe: iTunes | Goggle Play | Stitcher Radio | RSS

Description:

In this episode, Shon will provide CISSP training for Domain 4 (Communication and Network Security) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 093

________ is a standards-based mechanism for providing encryption for point-to-point TCP/IP traffic.

A) UDP
B) IDEA
C) IPSec
D) SDLC

IPSec

IPSec, or IP Security, is a standards-based mechanism for providing encryption for point-to-point TCP/IP traffic.

From https://www.brainscape.com/flashcards/telecommunications-and-network-security-971259/packs/1774328

------------------------------------

Question: 094

What is both a benefit and a potentially harmful implication of multilayer protocols?

A) Throughput
B) Encapsulation
C) Hash integrity checking
D) Logical addressing

Encapsulation

Encapsulation is both a benefit and a potentially harmful implication of multilayer protocols.

From https://www.brainscape.com/flashcards/telecommunications-and-network-security-971259/packs/1774328

------------------------------------

Question: 095

Which of the following is not true regarding firewalls?

A) They are able to log traffic information.
B) They are able to block viruses.
C) They are able to issue alarms based on suspected attacks.
D) They are unable to prevent internal attacks.

They are able to block viruses.

Most firewalls offer extensive logging, auditing, and monitoring capabilities as well as alarms and even basic IDS functions. Firewalls are unable to block viruses or malicious code transmitted through otherwise authorized communication channels, prevent unauthorized but accidental or intended disclosure of information by users, prevent attacks by malicious users already behind the firewall, or protect data after it passed out of or into the private network.

From https://www.brainscape.com/flashcards/telecommunications-and-network-security-971259/packs/1774328

------------------------------------

Want to find Shon elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

Facebook -

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 069: CISSP Sample Exam Questions - CISSP Training and Study! Feb 12, 2020

Show notes

Subscribe: iTunes | Goggle Play | Stitcher Radio | RSS

Description:

In this episode, Shon will provide CISSP training for Domain 4 (Communication and Network Security) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 090

Which type of firewall automatically adjusts its filtering rules based on the content of the traffic of existing sessions?

A) Static packet filtering
B) Application-level gateway
C) Stateful inspection
D) Dynamic packet filtering

Dynamic packet filtering

Dynamic packet-filtering firewalls enable the real-time modification of the filtering rules based on traffic content.

From https://www.brainscape.com/flashcards/telecommunications-and-network-security-971259/packs/1774328

------------------------------------

Question: 091

By examining the source and destination addresses, the application usage, the source of origin, and the relationship between current packets with the previous packets of the same session, firewalls are able to grant a broader range of access for authorized users and activities and actively watch for and block unauthorized users and activities.

A) Static packet-filtering
B) Application-level gateway
C) Stateful inspection
D) Circuit-level gateway

Stateful inspection

Stateful inspection firewalls are able to grant a broader range of access for authorized users and activities and actively watch for and block unauthorized users and activities.

From https://www.brainscape.com/flashcards/telecommunications-and-network-security-971259/packs/1774328

------------------------------------

Question: 092

Which of the following can be used to bypass even the best physical and logical security mechanisms to gain access to a system?

A) Brute-force attacks
B) Denial of service
C) Social engineering
D) Port scanning

Social engineering

Social engineering can often be used to bypass even the most effective physical and logical controls. Whatever activity the attacker convinces the victim to perform, it is usually directed toward opening a back door that the attacker can use to gain access to the network.

From https://www.brainscape.com/flashcards/telecommunications-and-networ

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 068: OSI Model vs TCP-IP Model - CISSP Training Feb 10, 2020

Show notes

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 067: CISSP Sample Exam Questions - CISSP Training and Study! Feb 08, 2020

Show notes

In this episode, Shon will provide CISSP training for Domain 3 (Engineering Secure Design) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 084

What is the most commonly used technique to protect against virus attacks?

A) Signature detection
B) Heuristic detection
C) Data integrity assurance
D) Automated reconstruction

Signature detection

Signature detection mechanisms use known descriptions of viruses to identify malicious code resident on a system.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Question: 085

In which of the following security modes can you be assured that all users have access permissions for all information processed by the system but will not necessarily need to know of all that information?

A) Dedicated
B) System high
C) Compartmented
D) Multilevel

System high

In system high mode, all users have appropriate clearances and access permissions for all information processed by the system but need to know only some of the information processed by that system.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Question: 086

What is a trusted computing base (TCB)?

A) Hosts on your network that support secure transmissions
B) The operating system kernel and device drivers
C) The combination of hardware, software, and controls that work together to enforce a security policy
D) The software and controls that certify a security policy

The combination of hardware, software, and controls that work together to enforce a security policy

The TCB is the combination of hardware, software, and controls that work together to enforce a security policy.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Want to find Shon elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide
- https://www.isc2.org/Training/Self-Study-Resources

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 066: CISSP Sample Exam Questions - CISSP Training and Study! Feb 05, 2020

Show notes

In this episode, Shon will provide CISSP training for Domain 3 (Engineering Secure Design) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 081

Which one of the following storage devices is most likely to require encryption technology in order to maintain data security in a networked environment?

A) Hard disk
B) Backup tape
C) Removable drives
D) RAM

Removable drives

Removable drives are easily taken out of their authorized physical location, and it is often not possible to apply operating system access controls to them. Therefore, encryption is often the only security measure short of physical security that can be afforded to them. Backup tapes are most often well controlled through physical security measures. Hard disks and RAM chips are often secured through operating system access controls.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Question: 082

What advanced virus technique modifies the malicious code of a virus on each system it infects?

A) Polymorphism
B) Stealth
C) Encryption
D) Multipartitism

Polymorphism

In an attempt to avoid detection by signature-based antivirus software packages, polymorphic viruses modify their own code each time they infect a system.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Question: 083

Which one of the following types of memory might retain information after being removed from a computer and, therefore, represent a security risk?

A) Static RAM
B) Dynamic RAM
C) Secondary memory
D) Real memory

Secondary memory

Secondary memory is a term used to describe magnetic and optical media. These devices will retain their contents after being removed from the computer and may later be read by another user.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Want to find Shon elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide
- https://www.isc2.org/Training/Self-Study-Res

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 065: How to Pass the CISSP Exam - CISSP Training and Study Feb 03, 2020

Show notes

Shon Gerber from ShonGerber.com provides you the information and knowledge you need to prepare and pass the CISSP Exam while providing the tools you need to enhance your cybersecurity career. Shon utilizes his expansive knowledge while providing superior training from his years of training people in cybersecurity.

In this episode, Shon will provide CISSP training for Domain 3 (Engineering Secure Design) of the CISSP Exam. His extensive training will cover all of the CISSP domains.

BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/

CISSP Exam Questions

Question: 078

Which database security risk occurs when data from a higher classification level is mixed with data from a lower classification level?

A) Aggregation
B) Inference
C) Contamination
D) Polyinstantiation

Contamination

Contamination is the mixing of data from a higher classification level and/or need-to-know requirement with data from a lower classification level and/or need-to-know requirement.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Question: 079

How many major categories do the TCSEC criteria define?

A) Two
B) Three
C) Four
D) Five

Four

TCSEC defines four major categories: category A is verified protection, category B is mandatory protection, category C is discretionary protection, and category D is minimal protection.

Source: https://www.brainscape.com/flashcards/security-architecture-and-design-983876/packs/1774328>

------------------------------------

Question: 080

Which Bell-LaPadula property keeps lower-level subjects from accessing objects with a higher security level?