Activity
Mon
Wed
Fri
Sun
Dec
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
What is this?
Less
More
CISSP Study Group
2.4k
Free
205 contributions to CISSP Study Group
2d •
Domain 6 Question: Share your thoughts...
A security team is implementing a vulnerability management process following a web application breach. Which approach is BEST for prioritizing the remediation of discovered vulnerabilities? A. Prioritize vulnerabilities based on the Common Vulnerability Scoring System (CVSS) scores, addressing those with the highest scores first. B. Address vulnerabilities found in the most critical business systems regardless of their CVSS scores. C. Focus on vulnerabilities that have publicly available exploits, as they represent a higher immediate risk. D. Fix vulnerabilities in the order they are discovered to ensure a systematic approach.
0 likes • 2d
This question is from the CISSP.APP.
0 likes • 7h
Noted@Olena Chumachenko We had a huge discussion in the group and agreed that in in practice and as a general rule we would want to look at the risk of higher level CVSS scores. It would lead to a compromised machine if not resolved. From there an attacker could pivot to a mission critical or internet-facing system. The key is to have a higher security posture and avoid risks that can be responded to quickly to prevent attackers and system availability due to vulnerabilities in the organization's entirety.
9d •
CISSP Practice Question (Domain 4: Communication and Network Security)
A bank acquired a fintech and wants both networks joined in 30 days so staff can share systems. The fintech network is flat, runs legacy protocols and was never assessed. What should the security manager do FIRST? A. Deploy a default-deny firewall between the networks B. Assess the fintech network and define trust boundaries C. Segment the fintech network and retire legacy protocols D. Route cross-network traffic through the bank's monitored proxy (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!
1 like • 9d
The correct answer is A. Deploy a default-deny firewall between the networks. Why this is the FIRST step: - Immediate Protection (Risk Isolation): When connecting an unassessed, insecure network to a secure one, your immediate priority is to protect the bank's existing infrastructure. A default-deny firewall establishes a controlled barrier, ensuring no unauthorized traffic passes between the networks from day one. - The 30-Day Constraint: Performing a full security assessment, defining trust boundaries (Option B), and completely re-architecting/retiring legacy protocols (Option C) are necessary long-term tasks, but they take significant time. Placing a firewall allows the networks to technically "join" at the perimeter under strict, explicitly permitted rules while further assessment takes place. Why the other options come later: - B & C (Assess, Segment, Retire): These are critical next steps in the lifecycle of the integration, but they cannot be completed instantly. Until these are finished, the bank's network remains entirely exposed if a firewall isn't already in place. - D (Proxy routing): While monitoring proxy traffic is useful, a proxy alone does not provide the comprehensive, multi-protocol network isolation and packet-filtering capabilities required to secure an unassessed network running legacy protocols.
0 likes • 2d
@Christian Er. Yes. The question is asking for the FIRST step. This is RISK isolation to secure both environments. A risk assessment to establish trust boundaries should be done while the firewall has specific deny rules. from @Vincent Primiani Joining an unassessed flat network to the bank imports every unknown on it: unmanaged hosts, cleartext protocols, forgotten remote access, maybe an attacker already inside. The manager's first job is to find out what is there and define the zones and the flows the business actually needs, because every control that follows is only as good as the boundary it enforces.
3d •
CISSP Practice Question (Domain 8: Software Development Security)
An insurer will replace its claims system with a small vendor's package in 60 days. The vendor keeps admin access for support and has never shown how it tests its code. No acquisition security requirements exist. What should the security manager do FIRST? A. Require a current penetration test report from the vendor B. Define acquisition security requirements and assess the vendor's development practices C. Put the vendor's admin access behind a privileged access gateway D. Scan the delivered package for vulnerabilities before deployment (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!
0 likes • 2d
The correct answer is C. Put the vendor's admin access behind a privileged access gateway. Explanation: - Why C is correct: The deployment is happening in 60 days, and the most immediate, critical operational risk is the vendor's persistent administrative access for support. Since the vendor's internal security and development practices are unknown, the security manager must implement immediate compensating controls to protect the organization's network. A privileged access gateway (or PAM solution) ensures that all vendor administrative actions are authenticated, monitored, restricted, and logged, mitigating the risk of unauthorized access or data breaches from day one. - Why B is incorrect: Defining acquisition security requirements and assessing development practices is a strategic, proactive measure that should ideally occur during the procurement phase. Since deployment is only 60 days away, implementing this now is too late to safeguard this specific system roll-out. - Why A & D are incorrect: While requiring a penetration test (A) and scanning the package for vulnerabilities (D) are valuable technical validation steps, they do not mitigate the continuous risk posed by unmonitored administrative access being left open to an external party.
9d •
Pass Exam @100Q
Hi all, I’d like to share my exam journey to help those who are currently preparing for it. First of all, I purchased the Peace of Mind (POM) voucher, and I highly recommend it to everyone. During my preparation, I felt mentally exhausted at some point, so I decided to take a step back and consider my approach. One thing that stood out from my exam experience was the number of technical questions, which was significantly higher than I had anticipated. I eventually passed the exam at 100 questions. Interestingly, there were still technical questions, but the overall balance seemed more focused on managerial and scenario-based questions. I also read the OSG cover to cover to identify my knowledge gaps. Although it was helpful, I wouldn't recommend going through the entire book unless you really need to. This is where I spent most of my preparation time without getting the best return on investment. Practice Questions – The Most Important Part of My Preparation Here are the resources I used, All of them added something valuable to my preparation. 1. Quantum Exams 2. Prep IQ Practice Questions (From Udemy) 3. Cissp Study Group & cissp.app 4. DestCert Mobile App A Few Final Tips - Get the Peace of Mind voucher. Knowing you have a second chance takes away a significant amount of psychological pressure during preparation. - Don't spend all your time reading books. Focus on practice questions, understanding the reasoning behind each answer, and identifying your weak areas. - When you finally sit in that exam chair, treat it as your only shot. Trust your instincts when answering scenario-based questions. Don't overthink things, and remember that understanding the mindset behind the questions is just as important as knowing the material. Good luck to everyone preparing for the exam! <3
1 like • 8d
@Security Pro Congratulations on passing the exam
10d •
CISSP Exam Passed !
Hi Everyone, I Passed the CISSP exam on Saturday. I attempted the exam in April 2024 but did not pass. Before now I used the following study materials - Official Study Guide (OSG) 9th edition, Sunflower, Luke Ahmed's How to think like a manager, ISC2 official exam prep and few you tube videos by Andrew Ramdayal. Preparing for this attempt, I joined the CISSP Skool Community where I gave me access to all the CISSP test questions and answers with explanation posted by Vincent and most importantly I joined the daily collaborative learning link where I was privileged to study alongside folks like Ed, Matthew, Ricardo, Pavithra, Aidah. Vishal, David, Babar, Emma and others using numerous question banks. I believed this helped me expand my learning and sharpening my exam mindset. I found this write up for my last minutes study - Cleared For Wealth | Break into defense contracting and build real wealth in IT as posted by Chiru. I really appreciate everyone that has helped me accomplish this milestone, especially to Vincent for running such a wonderful platform.
1 like • 10d
@Kayode Alabi Congratulations!!! I am glad I could help you on your journey. Thanks for posting your resources that you used to pass the exam. Could you tell us how your plan of attack on passing?
0 likes • 9d
@Kayode Alabi thank you!
1-10 of 205