ISC 2 Credentials CISSP Book

 The best example to minimize the attack surface for a customer’s private information is collection limitation. Collection limitation is a principle of data protection that states that the collection of personal data should be limited to the minimum necessary for the specified purpose, and that the data should be obtained by lawful and fair means, with the consent of the data subject. Collection limitation reduces the attack surface for a customer’s private information, as it reduces the amount and scope of the data that is exposed to potential threats, and ensures that the data is collected in a legitimate and transparent manner. Obfuscation, authentication, and data masking are not examples of minimizing the attack surface, but rather examples of protecting the data that is already collected. Obfuscation is a technique of obscuring or hiding the meaning or intent of the data, such as by using encryption, hashing, or encoding. Authentication is a process of verifying the identity or credentials of a user or a system that requests access to the data. Data masking is a technique of replacing or modifying the sensitive data with fictitious or anonymized data, such as by using pseudonymization, tokenization, or generalization. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 2: Asset Security, page 115.

A site-to-site VPN is a type of VPN that connects two or more remote networks securely over an untrustworthy network, such as the Internet. A site-to-site VPN uses a VPN gateway at each site to establish an encrypted tunnel between the networks, allowing the devices at each site to access the network resources at the other site. A site-to-site VPN is the best option to provide the functionality of connecting two remote offices securely over an untrustworthy MAN and allowing each office to access network shares at the other site. The other options are not types of VPN that can provide the same functionality, as they either do not connect networks, do not use VPN gateways, or do not separate the Internet and corporate traffic. References: CISSP - Certified Information Systems Security Professional, Domain 4. Communication and Network Security, 4.2 Secure network components, 4.2.1 Establish secure communication channels, 4.2.1.2 Transmission methods; CISSP Exam Outline, Domain 4. Communication and Network Security, 4.2 Secure network components, 4.2.1 Establish secure communication channels, 4.2.1.2 Transmission methods

Write blocking devices are used to prevent any modification of the forensic evidence when it is examined. This preserves the integrity of the evidence and ensures its admissibility in court. Write blocking devices do not affect the inventory, confidentiality, or availability of the evidence. References: 1, p. 1030; [4], p. 17

 Network Access Control (NAC) is a method of controlling and enforcing the security policies on the devices that connect to a network. NAC can prevent unauthorized or noncompliant devices from accessing the network resources, and can also monitor and remediate the devices that are already connected. The most secure method for NAC is 802.1X authentication, which is a standard for port-based network access control. 802.1X authentication uses the Extensible Authentication Protocol (EAP) to authenticate the devices (called supplicants) that request access to a network port (called an authenticator), such as a switch or a wireless access point. The authentication process involves a third party (called an authentication server), such as a RADIUS or a TACACS+ server, that verifies the credentials of the supplicant and grants or denies access to the network. 802.1X authentication provides strong security for NAC, as it prevents unauthorized devices from accessing the network, and can also enforce dynamic policies, such as VLAN assignment, encryption, or quarantine. Media Access Control (MAC) filtering is a less secure method for NAC, as it only checks the MAC address of the device, which can be easily spoofed or bypassed. Application layer filtering is a method of inspecting the content and the context of the network traffic at the application layer, but it does not provide NAC for the devices that connect to the network. Network Address Translation (NAT) is a method of modifying the IP addresses of the network packets, but it does not provide NAC for the devices that connect to the network. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 4: Communication and Network Security, page 157. CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Network and Internet Security, page 276.