SET was developed by a consortium including Visa and MasterCard.
Source: Harris, Shon, CISSP All In One Exam Guide, pages 668-669.
Mondex is a smart card electronic cash system owned by MasterCard.
SSH-2 is a secure, efficient, and portable version of SSH (Secure Shell) which is a secure
replacement for telnet.
Secure HTTP is a secure message-oriented communications protocol designed for use in
conjunction with HTTP. It is designed to coexist with HTTP's messaging model and to be easily
integrated with HTTP applications.

Redundant array of inexpensive disks (RAID) are primarily used to implove speed, availability, and redundancy, not integrity. They provide fault tolerance and protection against file server hard disk crashes. NOTE: For the purpose of the exam you need to be familiar with RAID 1 to 5, RAID 10, and Raid
50.
PC Magazine had a great article on RAID that has great explanations, see below: Anyone who's ever looked into purchasing a NAS device or server, particularly for a business, has inevitably stumbled across the term "RAID." RAID stands for Redundant Array of Inexpensive or (the more marketing-friendly "Independent) Disks." In general, RAID uses two or more hard disk drives to improve the performance or provide some level of fault tolerance for a machine-typically a NAS or server. Fault tolerance is simply providing a "safety net" for failed hardware, usually a hard drive, by ensuring that the machine with the failed component can still operate. Fault tolerance lessens interruptions in productivity and the chance of data loss.
Hardware RAID There are two ways to configure RAID: with hardware or software. Hardware RAID is most traditionally implemented in businesses and organizations where disk fault tolerance and optimized performance are must-haves, not luxuries. There are some advantages and disadvantages with hardware-based RAID. It's more expensive, because configuring it requires an additional hardware component, a RAID controller which is a piece of hardware that controls the RAID array. RAID controllers can be internal, meaning they connect inside of a server to the motherboard or external (usually reserved for enterprise, high-level RAID solutions). Hardwarebased RAID is also considered a better performing, more efficient way to implement RAID than software RAID. Hardware-based RAID is used most in corporate servers and business-class NAS drives.
Software RAID Software RAID is arguably not as reliable as hardware RAID, but it's definitely more economical and can still deliver basic fault tolerance. You can't configure RAID arrays as complex with software as you can with hardware, but if you just want to implement mirroring (which is copying data from one drive to another, to keep that data accessible in case a drive fails) then software RAID is a cheaper, less complicated to set up option. Instead of using a bunch of disks and a controller to make an array, some software RAID solutions can use logical partitions on a single disk. That's what makes it both cheaper and less reliable-if that single disk fails completely, your data is gone.
Windows 7 (Pro and Ultimate editions) has inherent support for RAID; you can set up a single disk with two partitions, and have those partitions mirrored (RAID 1) or you can setup disk striping for performance (RAID 0). This type of RAID is available in other operating systems as well like Apple's Snow Leopard Server 10.6, Linux and Windows Server 2003 and 2008. Since this type of RAID already comes as a feature in the OS, the price can't be beat. Software RAID can also comprise of virtual RAID solutions offered by vendors such as Dot Hill to deliver powerful host-based virtual RAID adapters. This is a solution that is more tailored to enterprise networks.
Which RAID Is Right For Me? Once you've decided whether software or hardware RAID best suits your purposes, you need to pick a RAID level-this refers to how you are going to configure RAID on your device. There are several RAID levels, and the one you choose depends on whether you are using RAID for performance or fault tolerance (or both). It also matters whether you have hardware or software RAID, because software supports fewer levels than hardware-based RAID. In the case of hardware RAID, the type of controller you have matters, too. Different controllers support different levels of RAID and also dictate the kinds of disks you can use in an array: SAS, SATA or SSD).
Here's a rundown on each level of RAID: RAID 0 is used to boost a server's performance. It's also known as "disk striping." With RAID 0, data is written across multiple disks. This means the work that the computer is doing is handled by multiple disks rather than just one, increasing performance because multiple drives are reading and writing data, improving disk I/O. A minimum of two disks is required. Both software and hardware RAID support RAID 0 as do most controllers. The downside is that there is no fault tolerance. If one disk fails then that affects the entire array and the chances for data loss or corruption increases.
RAID 1 is a fault-tolerance configuration known as "disk mirroring." With RAID 1, data is copied seamlessly and simultaneously, from one disk to another, creating a replica, or mirror. If one disk gets fried, the other can keep working. It's the simplest relatively low-cost way to implement fault-tolerance. The downside is that RAID 1 causes a slight drag on performance. RAID 1 can be implemented through either software or hardware RAID. A minimum of two disks are required for RAID 1 hardware implementations. With software RAID 1, instead of two physical disks, data is mirrored between volumes on a single disk. One additional point to remember is that RAID 1 cuts total disk capacity in half: if a server with two 1 TB drives is configured with RAID 1, then total storage capacity will be 1 TB not 2 TB.
RAID 5 is by far the most common RAID configuration for business servers and enterprise NAS devices. This RAID level provides better performance than mirroring as well as fault-tolerance. With RAID 5, data and parity (which is additional data used for recovery) are striped across three or more disks. Disk drives typically fail in sectors, rather than the entire drive dying. When RAID 5 is configured, if a portion of a disk fails, that data gets recreated from the remaining data and parity, seamlessly and automatically. This is beneficial because RAID 5 allows many NAS and server drives to be "hot-swappable" meaning in case a drive in the array fails, that drive can be swapped with a new drive without shutting down the server or NAS and without having to interrupt users who may be accessing the server or NAS. It's a great solution for data redundancy, because as drives fail (and they eventually will), the data can be re-built to new disks as failing disks are replaced. RAID 5 can be implemented as a software or hardware solution. You'll get better performance with hardware RAID 5, because the work is done by the controller without taxing the system processor. The downside to RAID 5 is the performance hit to servers that perform a lot of write operations. For example, with RAID 5 on a server that has a database that many employees access in a workday, there could be noticeable lag. RAID 10 is a combination of RAID 1 and 0 and is often denoted as RAID 1+0. It combines the mirroring of RAID 1 with the striping of RAID 0. It's the RAID level that gives the best performance, but it is also costly, requiring two times as many disks of other RAID levels, for a minimum of four. This is the RAID level ideal for highly used database servers or any server that's performing many write operations. RAID 10 can be implemented as hardware or software but the general consensus is that many of the performance advantages are lost when you use software RAID 10. RAID 10 requires a minimum of four disks.
Other RAID Levels
There are other RAID levels: 2, 3, 4, 7, 0+1...but they are really variants of the main RAID configurations already mentioned and used for specific instances. Here are some short descriptions of each:
RAID 2 is similar to RAID 5, but instead of disk striping using parity, striping occurs at the bit-level. RAID 2 is seldom deployed because costs to implement are usually prohibitive (a typical setup requires 10 disks) and gives poor performance with some disk I/O operations.
RAID 3 is also similar to RAID 5, except this solution requires a dedicated parity drive. RAID 3 is seldom used but in the most specific types of database or processing environments that would benefit from it.
RAID 4 is similar to RAID except disk striping happens at the byte level, rather than the bit-level as in RAID 3.
RAID 7 is a proprietary level of RAID owned by the now-extinct Storage Computer Corporation.
RAID 0+1 is often interchanged for RAID 10 (which is RAID 1+0) but the two are not same. RAID 0+1 is a mirrored array with segments that are RAID 0 arrays. It's implemented in specific infrastructures requiring high performance but not a high level of scalability.
For most small to mid-size business purposes, RAID 0, 1, 5 and in some cases 10 suffice for good fault tolerance and or performance solutions. For most home users RAID 5 may be overkill, but software RAID 1 mirroring provides decent fault tolerance, and hardware mirroring with two physical drives is provides even better, if you can afford it.
One last thought: Remember, RAID is not backup, nor does it replace a backup strategy-preferably an automated one. RAID can be a great way to optimize NAS and server performance, but it's only part of an overall disaster recovery solution.
Reference:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 65).
and
PC MAGAZINE article at http://www.pcmag.com/article2/0,2817,2370235,00.asp

Explanation/Reference:
Explanation:
The salvage team must ensure the reliability of primary site. This is done by returning the least-mission- critical processes to the restored original site to stress - test the rebuilt network. As the restored site shows resiliency, more important processes are transferred.
Incorrect Answers:
A: The most critical operations should be to the primary site after, Before, the other less critical operations have been moved.
B: As many operations that the salvage team handles are the same as the operations carried out by the disaster recovery team, there can be very well be an overlap between the team members. A person can be a member of both teams.
D: The order in which the operations are restored should Be exactly the same order in which the operations where moved to the alternative site. You should transfer the least critical operations first.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 669

Explanation/Reference:
Explanation:
A demilitarized zone (DMZ) is a network segment located between the protected private network and unprotected public network (typically being the Internet).
Incorrect Answers:
A: A demilitarized zone is not safe from hackers as it connected to the Internet.
B: It is a demilitarized, not a militarized, zone.
C: A demilitarized zone is not a firewall. A demilitarized zone is shielded by two firewalls: one facing the Internet, and one facing the private network.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 628

A SYN attack occurs when an attacker exploits the use of the buffer space during a Transmission Control Protocol (TCP) session initialization handshake. The attacker floods the target system's small "in-process" queue with connection requests, but it does not respond when a target system replies to those requests. This causes the target system to time out while waiting for the proper response, which makes the system crash or become unusable. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 103
"In a SYN flood attack, hackers use special software that sends a large number of fake packets with the SYN flag set to the targeted system. The victim then reserves space in memory for the connection and attempts to send the standard SYN/ACK reply but never hears back from the originator. This process repeats hundreds or even thousands of times, and the targeted computer eventually becomes overwhelmed and runs out of available resources for the half-opened connections. At that time, it either crashes or simply ignores all inbound connection requests because it can't possibly handle any more half-open connections." Pg 266 Tittel: CISSP Study Guide.