- (Topic 6)
The standard server port number for HTTP is which of the following?

1. A. 81
2. B. 80
3. C. 8080
4. D. 8180

Correct Answer: B
HTTP is Port 80.
Reference: MAIWALD, Eric, Network Security: A Beginner's Guide, McGraw-Hill/Osborne Media, 2001, page 135.

- (Topic 2)
Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of a software product?

1. A. Estimating the cost of the changes requested
2. B. Recreating and analyzing the problem
3. C. Determining the interface that is presented to the user
4. D. Establishing the priorities of requests

Correct Answer: D
Change control sub-phase includes Recreating and analyzing the problem, Determining the interface that is presented to the user, and Establishing the priorities of requests.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 7: Applications and Systems Development (page 252).

- (Topic 1)
Password management falls into which control category?

1. A. Compensating
2. B. Detective
3. C. Preventive
4. D. Technical

Correct Answer: C
Password management is an example of preventive control. Proper passwords prevent unauthorized users from accessing a system.
There are literally hundreds of different access approaches, control methods, and technologies, both in the physical world and in the virtual electronic world. Each method addresses a different type of access control or a specific access need.
For example, access control solutions may incorporate identification and authentication mechanisms, filters, rules, rights, logging and monitoring, policy, and a plethora of other
controls. However, despite the diversity of access control methods, all access control systems can be categorized into seven primary categories.
The seven main categories of access control are:
* 1. Directive: Controls designed to specify acceptable rules of behavior within an organization
* 2. Deterrent: Controls designed to discourage people from violating security directives
* 3. Preventive: Controls implemented to prevent a security incident or information breach
* 4. Compensating: Controls implemented to substitute for the loss of primary controls and mitigate risk down to an acceptable level
* 5. Detective: Controls designed to signal a warning when a security control has been breached
* 6. Corrective: Controls implemented to remedy circumstance, mitigate damage, or restore controls
* 7. Recovery: Controls implemented to restore conditions to normal after a security incident Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 1156-1176). Auerbach Publications. Kindle Edition.

- (Topic 2)
Memory management in TCSEC levels B3 and A1 operating systems may utilize "data hiding". What does this mean?

1. A. System functions are layered, and none of the functions in a given layer can access data outside that layer.
2. B. Auditing processes and their memory addresses cannot be accessed by user processes.
3. C. Only security processes are allowed to write to ring zero memory.
4. D. It is a form of strong encryption cipher.

Correct Answer: A
Data Hiding is protecting data so that it is only available to higher levels this is done and is also performed by layering, when the software in each layer maintains its own global data and does not directly reference data outside its layers.
The following answers are incorrect:
Auditing processes and their memory addresses cannot be accessed by user processes. Is incorrect because this does not offer data hiding.
Only security processes are allowed to write to ring zero memory. This is incorrect, the security kernel would be responsible for this.
It is a form of strong encryption cipher. Is incorrect because this does not conform to the definition of data hiding.

- (Topic 2)
Which of the following is a CHARACTERISTIC of a decision support system (DSS) in regards to Threats and Risks Analysis?

1. A. DSS is aimed at solving highly structured problems.
2. B. DSS emphasizes flexibility in the decision making approach of users.
3. C. DSS supports only structured decision-making tasks.
4. D. DSS combines the use of models with non-traditional data access and retrieval functions.

Correct Answer: B
DSS emphasizes flexibility in the decision-making approach of users. It is
aimed at solving less structured problems, combines the use of models and analytic techniques with traditional data access and retrieval functions and supports semi-structured decision-making tasks.
DSS is sometimes referred to as the Delphi Method or Delphi Technique:
The Delphi technique is a group decision method used to ensure that each member gives an honest opinion of what he or she thinks the result of a particular threat will be. This avoids a group of individuals feeling pressured to go along with others’ thought processes and enables them to participate in an independent and anonymous way. Each member of the group provides his or her opinion of a certain threat and turns it in to the team that is performing the analysis. The results are compiled and distributed to the group members, who then write down their comments anonymously and return them to the analysis group. The comments are compiled and redistributed for more comments until a consensus is formed. This method is used to obtain an agreement on cost, loss values, and probabilities of occurrence without individuals having to agree verbally.
Here is the ISC2 book coverage of the subject:
One of the methods that uses consensus relative to valuation of information is the consensus/modified Delphi method. Participants in the valuation exercise are asked to comment anonymously on the task being discussed. This information is collected and disseminated to a participant other than the original author. This participant comments upon the observations of the original author. The information gathered is discussed in a public forum and the best course is agreed upon by the group (consensus).
EXAM TIP:
The DSS is what some of the books are referring to as the Delphi Method or Delphi Technique. Be familiar with both terms for the purpose of the exam.
The other answers are incorrect:
'DSS is aimed at solving highly structured problems' is incorrect because it is aimed at solving less structured problems.
'DSS supports only structured decision-making tasks' is also incorrect as it supports semi- structured decision-making tasks.
'DSS combines the use of models with non-traditional data access and retrieval functions' is also incorrect as it combines the use of models and analytic techniques with traditional data access and retrieval functions.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 91). McGraw-Hill. Kindle Edition.
and
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Information Security Governance and Risk Management ((ISC)2 Press) (Kindle Locations 1424-1426). Auerbach Publications. Kindle Edition.