Complete CISSP ISC Materials

The method that provides the most protection for user credentials is digest authentication. Digest authentication is a type of authentication that verifies the identity of a user or a device by using a cryptographic hash function to transform the user credentials, such as username and password, into a digest or a hash value, before sending them over a network, such as the internet. Digest authentication can provide more protection for user credentials than basic authentication, which sends the user credentials in plain text, or forms-based authentication, which relies on the security of the web server or the web application. Digest authentication can prevent the interception, disclosure, or modification of the user credentials by third parties, and can also prevent replay attacks by using a nonce or a random value. Self-registration is not a method of authentication, but a process of creating a user account or a profile by providing some personal information, such as name, email, or phone number. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5, Identity and Access Management, page 685. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 5, Identity and Access Management, page 701.

 The document that explains the proper use of the organization’s assets is the acceptable use policy. An acceptable use policy is a document that defines the rules and guidelines for the appropriate and responsible use of the organization’s information systems and resources, such as computers, networks, or devices. An acceptable use policy can help to prevent or reduce the misuse, abuse, or damage of the organization’s assets, and to protect the security, privacy, and reputation of the organization and its users. An acceptable use policy can also specify the consequences or penalties for violating the policy, such as disciplinary actions, termination, or legal actions. A human resources policy, a code of ethics, and an access control policy are not the documents that explain the proper use of the organization’s assets, as they are related to the management, values, or authorization of the organization’s employees or users, not the usage or responsibility of the organization’s information systems or resources. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1, Security and Risk Management, page 47. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1, Security and Risk Management, page 62.

 The most environmentally friendly and appropriate method of suppressing a fire in a data center is to use an inert gas fire suppression system. An inert gas fire suppression system is a type of gaseous fire suppression system that uses an inert gas, such as nitrogen, argon, or carbon dioxide, to extinguish a fire. An inert gas fire suppression system works by displacing the oxygen in the area and reducing the oxygen concentration below the level that supports combustion. An inert gas fire suppression system is environmentally friendly, as it does not produce any harmful or toxic by-products, and it does not deplete the ozone layer. An inert gas fire suppression system is also appropriate for a data center, as it does not damage or affect the electronic equipment, and it does not pose any health risks to the personnel, as long as the oxygen level is maintained above the minimum requirement for human survival. Halon gas fire suppression system, dry-pipe sprinklers, and wet-pipe sprinklers are not the most environmentally friendly and appropriate methods of suppressing a fire in a data center, although they may be effective or common fire suppression techniques. Halon gas fire suppression system is a type of gaseous fire suppression system that uses halon, a chemical compound that contains bromine, to extinguish a fire. Halon gas fire suppression system works by interrupting the chemical reaction of the fire and inhibiting the combustion process. Halon gas fire suppression system is not environmentally friendly, as it produces harmful or toxic by-products, and it depletes the ozone layer. Halon gas fire suppression system is also not appropriate for a data center, as it poses health risks to the personnel, and it is banned or restricted in many countries. Dry-pipe sprinklers are a type of water-based fire suppression system that uses pressurized air or nitrogen to fill the pipes, and water to spray from the sprinkler heads when a fire is detected. Dry-pipe sprinklers are not environmentally friendly, as they use water, which is a scarce and valuable resource, and they may cause water pollution or contamination. Dry-pipe sprinklers are also not appropriate for a data center, as they may damage or affect the electronic equipment, and they may trigger false alarms or accidental discharges. Wet-pipe sprinklers are a type of water-based fire suppression system that uses pressurized water to fill the pipes and spray from the sprinkler heads when a fire is detected. Wet-pipe sprinklers are not environmentally friendly, as they use water, which is a scarce and valuable resource, and they may cause water pollution or contamination. Wet-pipe sprinklers are also not appropriate for a data center, as they may damage or affect the electronic equipment, and they may trigger false alarms or accidental discharges. 

A compliance review is a process of checking whether the systems and processes meet the established standards, policies, and regulations. A compliance review can help to verify that the technical staff has correctly implemented the new firewall hardening standard, as well as to identify and correct any deviations or violations. A penetration test, a training session, or a survey are not as effective as a compliance review, as they may not cover all the aspects of the firewall hardening standard or provide sufficient evidence of compliance. References: CISSP Exam Outline