PDF CISSP Study Guide

A privileged identity lifecycle management is a process of managing the access rights and activities of users who have elevated permissions to access sensitive data or resources in an organization2. An essential element of a privileged identity lifecycle management is to regularly perform account re-validation and approval, which means verifying that the privileged users still need their access rights and have them approved by the appropriate authority. This can help prevent unauthorized or excessive access, reduce the risk of insider threats, and ensure compliance with policies and regulations. Account provisioning based on multi-factor authentication, frequently review performed activities and request justification, and account information to be provided by supervisor or line manager are also important aspects of a privileged identity lifecycle management, but they are not as essential as account re-validation and approval. References: 2: Official (ISC)2 CISSP CBK Reference, 5th Edition, Chapter 5, page 283.

The most relevant reading material for researching an organization’s legal obligations to protect privacy-related information is the privacy-related regulations enforced by governing bodies applicable to the organization. These regulations define the legal requirements, standards, and penalties for collecting, processing, storing, and disclosing personal or sensitive information of individuals or entities. The organization must comply with these regulations to avoid legal liabilities, fines, or sanctions. The other options are not as relevant as privacy-related regulations, as they either do not reflect the legal obligations of the organization (A and C), or do not apply to all types of privacy-related information (D). References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1, page 22; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1, page 31.

The primary device that should be used to define the physical perimeter of an organization if the organization’s perimeter must cost-efficiently deter casual trespassers is fences six to seven feet high with a painted gate. Physical perimeter is the boundary that separates the internal and external areas of an organization, where physical security devices, such as fences, gates, locks, or cameras, are used to control and monitor the access and movement of people, vehicles, or objects. Physical perimeter is an important part of the physical security, which is the protection of the physical assets and resources of an organization from unauthorized or malicious access, damage, or theft. Physical perimeter can be defined by using different types of devices, depending on the level of security, cost, and aesthetics required by the organization. Fences are one of the most common and effective devices for defining the physical perimeter, as they can provide the following benefits:

• They can deter or prevent the unauthorized or unwanted entry or exit of people, vehicles, or objects, by creating a physical barrier or obstacle.
• They can delay or slow down the authorized or wanted entry or exit of people, vehicles, or objects, by requiring the use of a gate, lock, or key.
• They can detect or alert the unauthorized or unwanted entry or exit of people, vehicles, or objects, by using sensors, alarms, or cameras.
• They can display or communicate the boundary or ownership of the organization, by using signs, symbols, or colors. Fences six to seven feet high with a painted gate can be a cost-efficient and effective device for defining the physical perimeter of an organization that wants to deter casual trespassers, which are the people who enter or exit the organization’s premises without permission or authorization, but without any malicious or criminal intent. Fences six to seven feet high can provide enough height to prevent most people from climbing over or jumping over the fence, while also allowing enough visibility to see what is happening on the other side of the fence. Fences with a painted gate can provide a clear and attractive indication of the entrance or exit point of the organization, as well as the identity or image of the organization. Fences six to seven feet high with a painted gate can also be relatively easy and inexpensive to install and maintain, compared to other types of devices, such as walls, barbed wires, or electric fences. References: CISSP All-in-One Exam Guide, Chapter 9: Physical Security Requirements, Section: Physical Security Perimeter, pp. 1096-1097.

The best approach to anonymizing personally identifiable information (PII) in a test environment is randomizing data. Randomizing data is a technique that replaces the original PII with fictitious but realistic data that preserves the format, structure, and statistical properties of the original data. Randomizing data can effectively protect the privacy and confidentiality of the individuals whose PII is used in the test environment, while maintaining the functionality and quality of the test results. The other options are not as effective as randomizing data, as they either do not change the original PII, do not preserve the data quality, or do not prevent unauthorized access or disclosure. References: CISSP - Certified Information Systems Security Professional, Domain 1. Security and Risk Management, 1.5 Understand and apply security governance principles, 1.5.2 Align security function to strategy, goals, mission, and objectives, 1.5.2.1 Data anonymization; CISSP Exam Outline, Domain 1. Security and Risk Management, 1.5 Understand and apply security governance principles, 1.5.2 Align security function to strategy, goals, mission, and objectives, 1.5.2.1 Data anonymization