ISC CISSP Exam Prep
Certified Information Systems Security Professional (CISSP) (Page 35 )

• A — VARIANT "null" values are not the same as SQL NULL: Correct.

• B — Frequent, single-row DMLs: Incorrect.

• C — Validate data before loading into the target table: Correct.

• D — Use staging tables to manage MERGE statements: Correct.

• Detect risky sign-ins from unfamiliar or unidentified IP addresses
• Evaluate user or sign-in risk
• Automatically require a password change because of a risky sign-in

• User risk policy: Can require a user to securely change their password when the account may be compromised.
• Sign-in risk policy: Can require MFA or block access based on the risk of a particular sign-in.

text 
ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 global 
ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 global 
ip route 192.168.1.0 255.255.255.0 Vlan10 
ip route 172.16.1.0 255.255.255.0 Vlan20

• The route in Customer1 VRF provides a path back to the Customer2 subnet, 172.16.1.0/24.
• The route in Customer2 VRF provides a path to the FTP server, 192.168.1.200.
• The keyword global tells the router to resolve the next hop using the global routing table, enabling controlled route leaking between the VRF and global table.
• The global routes identify the VLAN interfaces used to reach each customer network.

• B. Data loss prevention (DLP): Helps prevent sensitive data from being copied, emailed, or exfiltrated. It is not the primary control for protecting a stolen laptop’s stored data.
• C. Operating system hardening: Reduces vulnerabilities by disabling unnecessary services and applying secure settings, but it does not necessarily protect the files if the disk is accessed directly.
• D. Boot security: Helps ensure the device starts only through trusted software or approved processes. It supports platform integrity but does not itself encrypt stored files.

• Issuer: Identifies the party issuing a SAML message—usually the identity provider in the assertion. It is not the Salesforce-specific identifier the architect should provide for differentiating Salesforce.
• Identity Provider Login URL: The endpoint where users are sent to authenticate.
• SAML identity location: Determines where the user identity is found in the SAML assertion, such as the subject or an attribute.

• Azure Resource Manager (ARM) templates
• Or, in newer Azure terminology, Bicep files

• Virtual machine disks
• Databases
• Storage accounts
• File systems

• Site-to-site VPN: protects data moving between networks
• HTTPS: protects data moving between a client and website
• Encrypted email: generally protects the message while being transmitted

• At rest = stored data
• In transit = moving data
• In use = data currently being processed by a system

• The requirement explicitly says the organization wants to use SAML to secure Salesforce API access.
• The SAML Bearer Assertion Flow exchanges a SAML assertion for a Salesforce OAuth access token.
• It is intended for server-to-server or other noninteractive integrations where the application has already been authenticated by an identity provider.
• The connected app can be configured so administrators authorize or preauthorize applications that consume the APIs.

• B — JWT Bearer Flow: Uses a signed JWT, not a SAML assertion. It would be appropriate if the requirement specified JWT-based authentication.
• C — SAML Assertion Flow: This is not the standard Salesforce OAuth flow name; the relevant name is OAuth 2.0 SAML Bearer Assertion Flow.
• D — User-Agent Flow: Designed for interactive browser-based authorization, not a SAML-based server-to-server integration.

• s3:GetObject for the relevant objects
• s3:ListBucket if listing is required
• Appropriate bucket and object resource permissions

• B: Making the bucket public is insecure and unnecessary.
• C: Prompt engineering cannot override AWS IAM or encryption permissions.
• D: Data sensitivity does not determine whether the role can access it.

• Periodic vulnerability assessments: Identify technical weaknesses but do not establish governance or ensure risks are managed.
• Established information security metrics: Help measure performance and report status, but measurement alone does not make governance effective.
• Advanced security technologies: Support security operations, but governance is primarily about direction, accountability, decision-making, and alignment with business objectives.

• Secret scope: A named container that groups related secrets and defines access permissions. Example: finance-prod.
• Secret key: The name of an individual secret stored inside that scope. Example: db-password.

text 
Scope: finance-prod 
  Key: db-username 
  Key: db-password

python 
dbutils.secrets.get( 
    scope="finance-prod", 
    key="db-password" 
)

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects scripts into web pages viewed by other users.
• Sideloading: Installing an application from outside the official app store. It may install unauthorized apps, but it does not generally unlock the operating system or enable restricted system features.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• Planning and designing products and services
• Developing and delivering them
• Managing risks, suppliers, and resources
• Measuring performance
• Continually improving value delivery

• Value stream steps describe activities used to create and deliver value; they do not themselves provide the broader capabilities.
• Vision and operating model provide direction and structure, but they are not the practical management capabilities that enable the work.
• Value chain is the operating model showing how activities combine to create value; it is enabled by practices and resources.

• 25 — Traditional SMTP server-to-server delivery; often restricted for client submission and not inherently encrypted.
• 110 — POP3 for retrieving email; unencrypted by default.
• 143 — IMAP for retrieving and synchronizing email; unencrypted by default.
• 587 — Authenticated SMTP submission, commonly secured with STARTTLS.

• Authentication: Verifies a user’s identity, such as username and password.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records connection and usage details, such as login time or session duration.

• CIA: Confidentiality, integrity, and availability are broad security objectives, not a specific RADIUS function.
• ACL: An access control list contains permit/deny rules on systems or network devices. RADIUS can support access decisions but is not itself an ACL.
• PEM: Privacy-Enhanced Mail is also associated with certificate and key encoding formats; it is unrelated to RADIUS’s primary purpose.

• Restarting the device: May fix software glitches, but would not usually make cable orientation matter.
• Swollen battery: A safety concern, but it would not typically cause recognition only in one cable orientation.
• Failing cable: Possible, but less likely because the problem occurs with this particular device and not other devices of the same type.

• Custom domain: miami.weyland.com requires a paid App Service tier; Free and Shared are unsuitable.
• Two instances: Standard supports scaling to multiple instances.
• SSL: Standard includes SSL support.
• 12 GB storage: Basic provides only about 10 GB, so it does not meet the requirement. Standard provides substantially more storage.
• Cost minimization: Standard is the lowest tier among the choices that satisfies all requirements.

• The Subscribe to Reports user permission.
• At least Viewer access to the report’s folder.
• Access to the report itself.

• Subscribe to Reports: Run Reports is not the relevant Salesforce permission.
• Chatter Subscribe to Reports is not a Salesforce permission.
• Set Running User relates to configuring the user whose permissions determine report results—not subscribing to a report.

• Each Azure VM must have at least one network interface (NIC).
• A single NIC can have:

• Therefore, each of the five VMs needs only one NIC:

• Encryption to preserve confidentiality
• Integrity protection to detect alteration
• Authentication of the server through certificates

• SHA-256: A hashing algorithm; it does not encrypt data for transmission.
• SSL 3.0: Obsolete and insecure. It should not be used.
• AES-256: A strong encryption algorithm, but by itself it does not provide the complete secure communication protocol needed for data in transit.

• An Anypoint VPC provides private network connectivity for CloudHub applications.
• An IPsec VPN tunnel or AWS Direct Connect connects that VPC to the customer’s on-premises network without exposing the database to the public internet.
• The VPC and on-premises firewalls must allow the required traffic, routes, and ports.

• Static IP addresses only identify the application’s outbound traffic; they do not create a private network path to the database.
• A Dedicated Load Balancer does not replace the required network connection to the on-premises environment. It is also unnecessary merely to reach individual databases.
• Moving sensitive databases to a DMZ is not the intended architecture and could reduce their protection.

• Unfamiliar locations or IP addresses
• Anonymous or malicious IP addresses
• Leaked credentials
• Unusual sign-in behavior

• SAML: Enables federated authentication and single sign-on between the IdP and SaaS providers.
• OAuth tokens: Allow delegated application access; OAuth is not primarily the first step for employee SSO.
• Password vaulting: Stores or autofills multiple passwords but does not eliminate the separate credentials or provide true federation.

1. You try to access a cloud application, such as accounting software.
2. The application redirects you to the company’s IdP.
3. You authenticate with the IdP.
4. The IdP sends a digitally signed SAML assertion to the application.
5. The application validates the assertion and grants access.

• The user’s identity
• Whether authentication succeeded
• Roles or group membership
• Access-related attributes

• Data loss prevention (DLP): Helps detect or prevent unauthorized data transfers, but does not directly protect data on a stolen, powered-off laptop.
• Operating system hardening: Reduces vulnerabilities and attack surface, but does not adequately protect stored data if the device is stolen.
• Boot security: Helps prevent unauthorized operating systems or boot media from loading. It supports device security but is not the primary solution for protecting the data itself.

• An active relationship is used automatically when filters are evaluated. An inactive relationship does not propagate filters unless explicitly activated in DAX, so it would not reliably enforce the required security behavior.
• Apply security filter in both directions allows RLS filters to propagate across the relationship in both directions. This ensures that bidirectional filtering respects the RLS rules applied to both tables.
• Assume referential integrity is unrelated to RLS. It is mainly a DirectQuery optimization that allows Power BI to use an inner join when matching keys are guaranteed to exist.
• The relationship must therefore be active, with security filtering enabled in both directions.

• Árvores de decisão: usam regras sequenciais, como “se característica X > valor, siga para este ramo”. São fáceis de visualizar e explicar. Atendem bem a problemas de classificação e regressão com alta interpretabilidade.

• Regressão linear: prevê um valor numérico contínuo, como preço, custo ou temperatura. Não é a escolha principal para classificar genes em categorias.

• Regressão logística: calcula a probabilidade de uma categoria. Pode atender à classificação, inclusive multiclasses, mas sua explicação costuma ser menos intuitiva que uma árvore para documentar decisões.

• Redes neurais: atendem a tarefas complexas, como imagens, texto e padrões não lineares. Porém, são menos interpretáveis, funcionando mais como uma “caixa-preta”.

• Career enhancement — A mentor can provide guidance, advice, networking support and help the mentee identify career opportunities.
• Support with new challenges — A mentor can help the mentee think through unfamiliar situations and develop confidence and practical solutions.
• Personal development — Mentoring can improve skills such as communication, leadership, decision-making and self-awareness.

• Solving all problems — The mentor supports and guides the mentee but should not take responsibility for solving every problem.
• Discipline would be dispensed if they make a mistake — Mentoring does not remove normal accountability or workplace consequences. Mistakes should instead become learning opportunities.

• Supervised learning requires labeled examples to learn how to classify customers.
• Reinforcement learning learns through actions, rewards, and penalties, which is not the main task here.
• RLHF uses human feedback to improve model behavior, typically for generative AI, not customer segmentation.

• Error correction (ECC): Improves data reliability but does not maximize bandwidth.
• RAM voltage: Increasing voltage may affect stability or speed, but it is not the primary method for increasing module bandwidth.
• Physical module size: Refers to the capacity or form factor of the RAM, not its data-transfer bandwidth.

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• Azure creates a corresponding service principal in Microsoft Entra ID.
• The identity’s lifecycle is tied to the Azure resource.
• If the resource is deleted, Azure automatically deletes the identity.
• Only the associated resource can use that identity to request tokens.
• You can grant the identity permissions to access services such as Key Vault or Storage without storing credentials in code.

json 
"Resource": "arn:aws:s3:::bucket-name/*"

• A: Revoking or changing an instance profile does not reliably invalidate temporary credentials that have already been issued and may still be valid.
• B: Changing the EC2 security group does not necessarily stop the attacker from using the stolen credentials from elsewhere.
• C: Amazon Macie helps discover sensitive data; Object Lock prevents modification/deletion, not reads or downloads.

• Separate accounts/domains create a strong administrative boundary between non-production and production.
• Separate projects provide distinct IAM boundaries, billing, quotas, service accounts, and resources.
• Developers can receive permissions in the development project without automatically gaining access to production.
• Production administrators can be restricted from development resources, supporting separation of duties and least privilege.

• A: Creates excessive project fragmentation without being required by the stated requirement.
• C: Keeps development and production under one account and does not clearly separate administrative duties.
• D: Uses one account and only two projects; it provides some project isolation but weaker organizational separation.

• Subject: The entity that initiates an action—here, Derrick/user account.
• Object: The resource being accessed— the file.
• Action: Reading the file.

• Conserve public IPv4 addresses: IPv4 addresses are limited, so many internal devices share a smaller number of public addresses through NAT.
• Reduce direct exposure: Private addresses are not directly routable from the public Internet, which helps reduce unsolicited access to internal devices.

sql 
GRANT ALTER ON SCHEMA::schemaA TO User1;

• TRUNCATE TABLE is a DDL operation, not a normal DELETE.
• Having DELETE permission on a table is not sufficient to truncate it.
• The minimum relevant permission is ALTER on the table.
• Granting ALTER on SCHEMA::schemaA allows the user to truncate tables within schemaA.
• It does not grant equivalent permissions on schemaB or schemaC, satisfying least privilege.

• Writing with Apache Spark, typically as Delta tables.
• Reading with Apache Spark for processing and analysis.
• Reading with T-SQL through the lakehouse’s automatically generated SQL analytics endpoint.
• Reading with KQL through Fabric’s query capabilities that can access lakehouse data.

• Eventhouse: Optimized for real-time and KQL workloads, but it is not the natural destination for Spark-based writes or general lakehouse storage.
• Datamart: Intended mainly for relational analytics and Power BI; it is not designed for Spark-based data ingestion.
• Warehouse: Primarily T-SQL-based and structured. It does not provide the same native Spark write experience or flexibility for semi-structured data.

• netstat: Shows local network connections and listening ports, but not which WAN path carries the traffic.
• nslookup: Resolves domain names to IP addresses.
• ping: Tests reachability and latency but does not show the route.

• VM CPU, memory, disk, and network usage
• Storage transactions and latency
• App Service response time
• Database DTU or CPU utilization

• Azure Traffic Analytics analyzes network traffic flows and security patterns; it is not the general infrastructure metrics tool.
• Azure Activity Log records subscription-level control-plane operations, such as resource creation, deletion, or configuration changes.
• Azure Advisor provides recommendations about cost, security, reliability, performance, and operational excellence, but it is not the primary tool for investigating live metrics.

• The VM keeps its configuration, disks, IP settings, and associated resources.
• The operation may cause downtime.
• You cannot guarantee that it will move specifically to Host2; Azure selects the new host.
• Update management is for update configuration, not host relocation.
• Moving to another subscription does not move the VM to a different physical host.
• Usage location is unrelated to VM placement.

• A static IP gives the surveillance system a predictable local address, so users can reliably reach it on the LAN.
• However, a static IP does not block internet-based login attempts. If the router exposes the device through port forwarding, attackers could still reach it.
• Port mapping normally exposes an internal service externally, so A is a poor choice as written.
• Subnetting alone also does not block traffic; it would require routing/firewall rules.

• Default network device credentials: More associated with external attackers or poor device configuration.
• Spear phishing emails: Commonly used to compromise users, but less characteristic of an insider who already has access.
• Typosquatting and impersonation: Primarily social-engineering techniques aimed at deceiving users.
• Unidentified removable devices: Provide a direct way to transfer data outside the organization and may bypass network monitoring.

• Online payment fraud
• Account takeover
• Fake account creation
• Suspicious transactions

• Digitally signing the software: Verifies authenticity and integrity. It does not hide how the software works.
• Limiting third-party libraries: May reduce dependencies and attack surface, but does not directly prevent reverse engineering.
• Using compile flags: Some compiler options can remove debugging information or optimize code, which may provide limited protection, but this is not the primary technique identified for preventing reverse engineering.

• Entradas grandes, de até aproximadamente 1 GB.
• Processamentos demorados, que podem levar até cerca de 1 hora.
• O cliente envia a solicitação e consulta o resultado depois, sem precisar manter uma conexão aberta durante todo o processamento.

• Real-time inference: indicada para respostas imediatas, com entradas menores e processamento rápido.
• Serverless inference: adequada para cargas variáveis e solicitações menores; não é ideal para processamento longo e arquivos grandes.
• Batch transform: processa grandes volumes em lote, mas não atende à necessidade de respostas próximas do tempo real.

• Application management: Controls which apps can be installed or used; it does not remove existing data after theft.
• Full-disk encryption: Protects data when the device is powered off or locked, but it may not help if the attacker has already unlocked the device.
• Containerization: Separates corporate data from personal data, but the attacker may still access the corporate container using the stolen credentials.

1. Selling price per unit: $750
2. Required annual return:

1. Required profit per unit:

1. Target cost per unit:

• Hardware and infrastructure
• System software
• Networks and communications
• Technology platforms and services

• Business Architecture: Defines business strategy, organization, functions, and processes.
• Data Architecture: Defines the structure and management of enterprise data.
• Application Architecture: Describes application systems and how they interact to support business and data processing.