ISC CISSP Based on Real Exam Environment

 Retaining system logs for six months or longer can be valuable for forensics and incident response activities. System logs are records of events that occur on a system, such as user actions, system errors, security alerts, network traffic, etc. System logs can provide useful evidence and information for investigating and analyzing security incidents, such as the source, scope, impact, and timeline of the incident, as well as the potential vulnerabilities, threats, and attackers involved. System logs can also help with incident recovery and remediation, as well as with improving security controls and policies12 References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, p. 437; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 7: Security Operations, p. 849.

 Frequency analysis is a technique of cryptanalysis that exploits the statistical patterns of letters or symbols in an encrypted message. Frequency analysis assumes that the frequency distribution of the plaintext is preserved in the ciphertext, and that the frequency distribution of the plaintext is known or can be estimated. Knowing the language in which an encrypted message was originally produced might help a cryptanalyst to perform frequency analysis, as different languages have different letter frequencies, digraphs, and word lengths. For example, in English, the letter “e” is the most common, while in French, it is the letter “a”. By comparing the frequency distribution of the ciphertext with the expected frequency distribution of the plaintext language, a cryptanalyst can make educated guesses about the encryption key or algorithm23. References:

• Breaking the Vigenère Cipher Flashcards | Quizlet, Section: Terms in this set (6)
• Frequency Analysis: Breaking the Code - Crypto Corner, Section: The Method
• Cipher Identifier (online tool) | Boxentriq, Section: Frequency Analysis

 Regarding asset security and appropriate retention, the initial top three areas that are important to focus on are security control baselines, access controls, employee awareness and training. Asset security and appropriate retention are the processes of identifying, classifying, protecting, and disposing of the assets of an organization, such as data, systems, devices, or facilities. Asset security and appropriate retention can help prevent or reduce the loss, theft, damage, or misuse of the assets, as well as comply with the legal and regulatory requirements. The initial top three areas that can help achieve asset security and appropriate retention are:

• Security control baselines: These are the minimum set of security controls or measures that are applied to the assets based on their classification, value, and risk level. Security control baselines can help ensure the consistency, effectiveness, and efficiency of the security protection for the assets, as well as facilitate the monitoring and auditing of the security compliance. Security control baselines can include technical, administrative, or physical controls, such as encryption, authentication, policies, procedures, locks, alarms, etc34
• Access controls: These are the mechanisms that regulate who or what can access, use, modify, or delete the assets. Access controls can help prevent or limit the unauthorized or malicious access to the assets, as well as enforce the principle of least privilege and the separation of duties. Access controls can include identification, authentication, authorization, and accountability (IAAA) processes, as well as access control models, such as discretionary, mandatory, or role-based access control56
• Employee awareness and training: These are the activities that educate and inform the employees about the security policies, procedures, and best practices of the organization, as well as the roles and responsibilities of the employees regarding the asset security and appropriate retention. Employee awareness and training can help increase the knowledge, skills, and attitude of the employees towards security, as well as reduce the human errors, negligence, or violations that may compromise the asset security and appropriate retention. Employee awareness and training can include seminars, workshops, newsletters, posters, quizzes, etc.

References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 2: Asset Security, pp. 61-62; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 2: Asset Security, pp. 163-164.

 A Denial of Service (DoS) attack is a type of wireless network attack that aims to prevent legitimate users from accessing or using a wireless network or service. An Electromagnetic Pulse (EMP) attack is a specific form of DoS attack that involves generating a powerful burst of electromagnetic energy that can damage or disrupt electronic devices and systems, including wireless networks. An EMP attack can cause permanent or temporary loss of wireless network availability, functionality, or performance. A Radio Frequency (RF) attack is a type of wireless network attack that involves interfering with or jamming the radio signals used by wireless devices and networks, but it does not necessarily involve an EMP. A data modification attack is a type of wireless network attack that involves altering or tampering with the data transmitted or received over a wireless network, but it does not necessarily cause a DoS. An application-layer attack is a type of wireless network attack that targets the applications or services running on a wireless network, such as web servers or email servers, but it does not necessarily involve an EMP.