CISSP Section 1

Question 1

ISC2 Code of Ethics Cannons

Answer 1

1. Protect Society the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.

All are equally important. Think PAPA.

Question 2

Identify the cannon in practice.

Safeguard info and sys. that are essential for public safety and welfare. Consider societal impact. Always do your best, thoroughly analyze sec. needs of assets you are responsible for, finally provide or recommend the necessary sec. to protect all people and assets.

Answer 2

P for Protect everything you are responsible for.

Question 3

Identify the cannon in practice.

Maintain personal integrity, be clear and transparent, be ethical in approach to infosec, lead by example, hold yourself accountable.

Answer 3

A for Act with good intentions and honorably and if not, why?

Question 4

Identify the cannon in practice.

Maintain high level of professional competence aka be good at your job.
Stay current with trends
Deliver reliable services to clients; perform high value work, improve and grow sec. skillset, serve employer and clients

Answer 4

P for Provide your best efforts.

Question 5

Identify the cannon in practice.

Contribute to the growth and maturity of cyber practices, share knowledge mentor and participate in professional organizations, raise info sec awareness within organization.

Answer 5

A for Advance your knowledge and skills and for others too.

Question 6

Define Ethical Conduct.

Answer 6

Ethical conduct ensures professionals take responsibility for their actions and adhering to them protects the integrity of the professions.
Promote a culture of ethical behavior within organizations.
Regularly reflect on how decision align with CoE.

Question 7

Imagine a file window opened up from a C:\ and in this drive there is an excel file with account numbers a database file with customer account information, and a word document titled investment opportunity.

In the context of Confidentiality what questions should we ask ourselves?

Answer 7

Can all of the users see this data?
Can users with access to the network see this data?
Can this data be released?
How do the files need to be protected from unauthorized access?

Question 8

Imagine a file window opened up from a C:\ and in this drive there is an excel file with account numbers a database file with customer account information, and a word document titled investment opportunity.

In the context of Availability what questions should we ask ourselves?

Answer 8

Who can change this data?
How can the file be protected from unauthorized changes?
How important is the data to the company?

Question 9

Imagine a file window opened up from a C:\ and in this drive there is an excel file with account numbers a database file with customer account information, and a word document titled investment opportunity.

In the context of Integrity what questions should we ask ourselves?

Answer 9

Can this be stored in long-term or does is need to be accessed quickly?
How do we make sure data is available when needed?

Question 10

What two concepts make up authenticity? Define them.

Answer 10

Authentic: data or actions that come from a legitimate source.
Authenticated: subjects must prove to be authentic through identification and authentication.

Question 11

Non-repudiation

Answer 11

Undeniable proof: proof that data or actions originated from a subject and cannot be disputed. This is accomplished using cryptography.