ISC 2 Credentials CISSP Passing Score

According to the CISSP For Dummies1, the Maximum Tolerable Downtime (MTD) determines the estimated period of time a business can remain interrupted beyond which it risks never recovering. This means that the MTD is the maximum acceptable duration of a disruption that the organization can tolerate before it suffers unacceptable consequences, such as loss of revenue, reputation, or customers. The MTD is an important input for the business continuity planning and disaster recovery planning processes, as it helps to define the recovery objectives and strategies for each business process and function. The MTD is not the same as the estimated period of time a business critical database can remain down before customers are affected, the fixed length of time a company can endure a disaster without any DR planning, or the fixed length of time in a DR process before redundant systems are engaged, as these are different concepts that may or may not be related to the MTD. References: 1

The correct matches are:

• Security Risk Treatment: The method used to identify feasible security risk mitigation options and plans.
• Threat Assessment: A measure of the extent to which an entity is threatened by a potential circumstance or event, the adverse impacts that would arise if the circumstance or event occurs, and the likelihood of occurrence.
• Protection Needs: The method used to identify and characterize the dangers anticipated throughout the life cycle of the system.
• Risk: The method used to identify the confidentiality, integrity, and availability requirements for organizational and system assets and to characterize the adverse impact or consequences should the asset be lost, modified, degraded, disrupted, compromised, or become unavailable.

Comprehensive Explanation: These terms and definitions are based on the glossary of the Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 3: Security Engineering, pp. 293-2941

References: Official (ISC)2 CISSP CBK Reference, Fifth Edition

The entity that is ultimately accountable for data remanence vulnerabilities with data replicated by a cloud service provider is the data owner. A data owner is a person or an entity that has the authority or the responsibility for the data or the information within an organization, and that determines or defines the classification, the usage, the protection, or the retention of the data or the information. A data owner has the obligation to ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization, as the data owner is ultimately accountable or liable for the security or the quality of the data or the information, regardless of who processes or handles the data or the information. A data owner can ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization, by performing the tasks or the functions such as conducting due diligence, establishing service level agreements, defining security requirements, monitoring performance, or auditing compliance. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 2, page 61; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 2, page 67

SSL and TLS provide a generic channel security mechanism on top of TCP. This means that SSL and TLS are protocols that enable secure communication between two parties over a network, such as the internet, by using encryption, authentication, and integrity mechanisms. SSL and TLS operate at the transport layer of the OSI model, above the TCP protocol, which provides reliable and ordered delivery of data. SSL and TLS can be used to secure various application layer protocols, such as HTTP, SMTP, FTP, and so on. SSL and TLS do not provide nonrepudiation by default, as this is a service that requires digital signatures and certificates to prove the origin and content of a message. SSL and TLS do provide security for most routed protocols, as they can encrypt and authenticate any data that is transmitted over TCP. SSL and TLS do not provide header encapsulation over HTTP, as this is a function of the HTTPS protocol, which is a combination of HTTP and SSL/TLS.