parallel test tests the processing functionality
of the alternate site, whereas the full-interruption test actually replicates a disaster by halting production.
*Answer “Functional business unit representatives meet to review the plan to ensure it accurately reflects the organizations recovery strategy” is the definition of a checklist test type.

The preaction system combines both the dry and wet pipe systems, by first
releasing the water into the pipes when heat is detected (dry pipe), then releasing the water flow
when the link in the nozzle melts (wet pipe).
This allows manual intervention before a full discharge of water on the equipment occurs. This is
currently the most recommended water system for a computer room.
According to the ISC2 Official Study Guide:
All buildings should be equipped with an effective fire suppression system, providing the building
with around the clock protection. Traditionally, fire suppression systems employed arrays of water
sprinklers that would douse a fire and surrounding areas.
Sprinkler systems are classified into four different groups: wet, dry, preaction, and deluge.
Wet systems have a constant supply of water in them at all times; these sprinklers once activated
will not shut off until the water source is shut off.
Dry systems do not have water in them. The valve will not release until the electric valve is
stimulated by excess heat.
Pre-action systems incorporate a detection system, which can eliminate concerns of water
damage due to false activations. Water is held back until detectors in the area are activated.
Deluge systems operate in the same function as the pre-action system except all sprinkler heads
are in the open position. Water may be a sound solution for large physical areas such as
warehouses, but it is entirely inappropriate for computer equipment. A water spray can irreparably
damage hardware more quickly than encroaching smoke or heat. Gas suppression systems
operate to starve the fire of oxygen. In the past, Halon was the choice for gas suppression
systems; however, Halon leaves residue, depletes the ozone layer, and can injure nearby
personnel.
Shon Harris in her latest study guide says:
Four main types of water sprinkler systems are available: wet pipe, dry pipe, preaction, and
deluge.
Wet pipe Wet pipe systems always contain water in the pipes and are usually discharged by temperature control-level sensors. One disadvantage of wet pipe systems is that the water in the pipes may freeze in colder climates. Also, if there is a nozzle or pipe break, it can cause extensive water damage. These types of systems are also called closed head systems.
Dry pipe In dry pipe systems, the water is not actually held in the pipes. The water is contained in a “holding tank” until it is released. The pipes hold pressurized air, which is reduced when a fire or smoke alarm is activated, allowing the water valve to be opened by the water pressure. Water is not allowed into the pipes that feed the sprinklers until an actual fire is detected. First, a heat or smoke sensor is activated; then, the water fills the pipes leading to the sprinkler heads, the fire alarm sounds, the electric power supply is disconnected, and finally water is allowed to flow from the sprinklers. These pipes are best used in colder climates because the pipes will not freeze.
Preaction Preaction systems are similar to dry pipe systems in that the water is not held in the pipes, but is released when the pressurized air within the pipes is reduced. Once this happens, the pipes are filled with water, but it is not released right away. A thermal-fusible link on the sprinkler head has to melt before the water is released. The purpose of combining these two techniques is
to give people more time to respond to false alarms or to small fires that can be handled by other means. Putting out a small fire with a handheld extinguisher is better than losing a lot of electrical equipment to water damage. These systems are usually used only in data processing environments rather than the whole building, because of the higher cost of these types of systems.
Deluge A deluge system has its sprinkler heads wide open to allow a larger volume of water to be released in a shorter period. Because the water being released is in such large volumes, these systems are usually not used in data processing environments. Reference used for this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 10: Physical security (page 336). and Corporate; (Isc)2 (2010-04-20). Official (ISC)2 Guide to the CISSP CBK, Second Edition ((ISC)2 Press) (Kindle Locations 14379-14391). Taylor & Francis. Kindle Edition. and Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 1024510253). McGraw-Hill. Kindle Edition. and Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 1025610260). McGraw-Hill. Kindle Edition.

The Answer: People. The other choices can be strengthened and counted on
(For the most part) to remain consistent if properly protected. People are fallible and unpredictable. Most security intrusions are caused by employees. People get tired, careless, and greedy. They are not always reliable and may falter in following defined guidelines and best practices. Security professionals must install adequate prevention and detection controls and properly train all systems users Proper hiring and firing practices can eliminate certain risks. Security Awareness training is key to ensuring people are aware of risks and their responsibilities.
The following answers are incorrect:Software. Although software exploits are major threat and cause for concern, people are the weakest point in a security posture. Software can be removed, upgraded or patched to reduce risk.
Communications. Although many attacks from inside and outside an organization use communication methods such as the network infrastructure, this is not the weakest point in a security posture. Communications can be monitored, devices installed or upgraded to reduce risk and react to attack attempts.
Hardware. Hardware components can be a weakness in a security posture, but they are not the weakest link of the choices provided. Access to hardware can be minimized by such measures as installing locks and monitoring access in and out of certain areas.
The following reference(s) were/was used to create this question:
Shon Harris AIO v.3 P.19, 107-109
ISC2 OIG 2007, p.51-55

ESP does have a source authentication and integrity capability through the use of a hash algorithm and a secret key. It provides confidentiality by means of secret key cryptography.
DES and triple DES secret key block ciphers are supported by IPSEC and other algorithms will also be supported in the future. AH uses a hash algorithm in the packet header to authenticate the sender and validate the integrity of the transmitted data.

Information security metrics provide the greatest value to management when based on the value of information assets. The value of information assets is determined by the impact of their loss or compromise on the organization’s objectives, reputation, and operations. By measuring the value of information assets, security managers can prioritize the protection of the most critical assets, justify the investment in security controls, and communicate the value of security to the management and stakeholders. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 25. CISSP Practice Exam – FREE 20 Questions and Answers, Question 1.

This is a requirement starting as low as C1 within the TCSEC rating.
The Orange book requires the following for System Integrity Hardware and/or software features shall be provided that can be used to periodically validate the correct operation of the on-site hardware and firmware elements of the TCB.
NOTE FROM CLEMENT:
This is a question that confuses a lot of people because most people take for granted that the orange book with its associated Bell LaPadula model has nothing to do with integrity.
However you have to be careful about the context in which the word integrity is being used.
You can have Data Integrity and you can have System Integrity which are two completely different things.
Yes, the Orange Book does not specifically address the Integrity requirements, however it has to run on top of systems that must meet some integrity requirements.
This is part of what they call operational assurance which is defined as a level of confidence of a trusted system’s architecture and implementation that enforces the system’s security policy. It includes:
System architecture
Covert channel analysis
System integrity
Trusted recovery
DATA INTEGRITY
Data Integrity is very different from System Integrity. When you have integrity of the data, there are three goals:
1 . Prevent authorized users from making unauthorized modifications
2 . Preven unauthorized users from making modifications
3. Maintaining internal and external consistancy of the data
Bell LaPadula which is based on the Orange Book address does not address Integrity, it addresses only Confidentiality.
Biba address only the first goal of integrity.
Clark-Wilson addresses the three goals of integrity.
In the case of this question, there is a system integrity requirement within the TCB. As mentioned above here is an extract of the requirements: Hardware and/or software features shall be provided that can be used to periodically validate the correct operation of the on-site hardware and firmware elements of the TCB.
The following answers are incorrect:
Security Testing. Is incorrect because Security Testing has no set of requirements in the
Orange book.
Design Verification. Is incorrect because the Orange book’s requirements for Design
Verification include: A formal model of the security policy must be clearly identified and documented, including a mathematical proof that the model is consistent with its axioms and is sufficient to support the security policy.
System Architecture Specification. Is incorrect because there are no requirements for
System Architecture Specification in the Orange book.
The following reference(s) were used for this question:
Trusted Computer Security Evaluation Criteria (TCSEC), DoD 5200.28-STD, page 15, 18,
25, 31, 40, 50.
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition, Security
Architecture and Design, Page 392-397, for users with the Kindle Version see Kindle
Locations 28504-28505.
and
DOD TCSEC – http://www.cerberussystems.com/INFOSEC/stds/d520028.htm

The_answer: Magnetically striped cards are digitally encoded cards.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, page 342.

Explanation/Reference:
Explanation:
Employee sabotage can become an issue if an employee is knowledgeable enough about the IT infrastructure of an organization, has sufficient access.
Incorrect Answers:
B: Student hackers are a lesser threat as a disgruntled employee already has access to the system.
C: A disgruntled employee is a larger threat compared to a criminal hacker as the employee already has access to the system.
D: A disgruntled employee is a larger threat compared to a corporate spy as the employee already has access to the system.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 602

Explanation
Section: Security Operations

Baseline configuration information is the set of data that describes the state of a computer system at a specific point in time. It is used to monitor and control changes to the system, as well as to assess its compliance with security standards and policies. Baseline configuration information must include the operating system and version, patch level, applications running, and versions, because these are the essential components that define the functionality and security of the system. These components can also affect the compatibility and interoperability of the system with other systems and networks. Therefore, it is important to maintain accurate and up-to-date records of these components for each computer system123. References:
* Create configuration baselines – Configuration Manager, Section: Configuration baselines
* About Configuration Baselines – Configuration Manager, Section: Configuration Baseline Rules
* About Configuration Baselines and Items – Configuration Manager, Section: Configuration Baselines