Defense in depth is a security strategy that involves applying multiple layers of protection to a system or network to prevent or mitigate attacks. The use of strong authentication, the encryption of Personally Identifiable Information (PII) on database servers, application security reviews, and the encryption of data transmitted across networks are examples of defense in depth measures that can enhance the security of the system or network.
A, C, and D are incorrect because they are not the best terms to describe the security strategy. Data integrity is a property of data that ensures its accuracy, consistency, and validity. Data availability is a property of data that ensures its accessibility and usability. Non-repudiation is a property of data that ensures its authenticity and accountability. While these properties are important for security, they are not the same as defense in depth.

According to the NIST Cybersecurity Framework, the control categories that the company needs to improve when analyzing its processes individually are Asset Management, Business Environment, Governance and Risk Assessment. These control categories are part of the Identify function, which is one of the five core functions of the NIST Cybersecurity Framework. The Identify function is the function that provides the foundational understanding and awareness of the organization's systems, assets, data, capabilities, and risks, as well as the role and contribution of the organization to the critical infrastructure and the society. The Identify function helps the organization to prioritize and align its cybersecurity activities and resources with its business objectives and requirements, as well as to establish and maintain its cybersecurity policies and standards. The Identify function consists of six control categories, which are the specific outcomes or goals that the organization should achieve for each function. The control categories for the Identify function are:
* Asset Management: The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy.
* Business Environment: The organization's mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.
* Governance: The policies, procedures, and processes to manage and monitor the organization's regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.
* Risk Assessment: The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.
* Risk Management Strategy: The organization's priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.
* Supply Chain Risk Management: The organization's priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has established and implemented the processes to identify, assess and manage supply chain risks.
The company was ranked as high in the following NIST functions: Protect, Detect, Respond and Recover.
However, a low maturity grade was attributed to the Identify function. This means that the company has a good level of capability and performance in implementing and executing the cybersecurity activities and controls that are related to the other four functions, but it has a low level of capability and performance in implementing and executing the cybersecurity activities and controls that are related to the Identify function.
Therefore, the company needs to improve its processes and controls that are related to the Identify function, which are the Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy, and Supply Chain Risk Management control categories. By improving these control categories, the company can enhance its foundational understanding and awareness of its systems, assets, data, capabilities, and risks, as well as its role and contribution to the critical infrastructure and the society. The company can also better prioritize and align its cybersecurity activities and resources with its business objectives and requirements, as well as establish and maintain its cybersecurity policies and standards. Access Control, Awareness and Training, Data Security and Maintenance are not the control categories that the company needs to improve when analyzing its processes individually, as they are part of the Protect function, not the Identify function. The Protect function is the function that provides the appropriate safeguards and countermeasures to ensure the delivery of critical services and to limit or contain the impact of potential cybersecurity incidents.
The Protect function consists of eight control categories, which are:
* Access Control: Access to assets and associated facilities is limited to authorized users, processes, or
* devices, and to authorized activities and transactions.
* Awareness and Training: The organization's personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.
* Data Security: Information and records (data) are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information.
* Information Protection Processes and Procedures: Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.
* Maintenance: Maintenance and repairs of industrial control and information system components is performed consistent with policies and procedures.
* Protective Technology: Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.
The company was ranked as high in the Protect function, which means that it has a good level of capability and performance in implementing and executing the cybersecurity activities and controls that are related to the Protect function. Therefore, the company does not need to improve its processes and controls that are related to the Protect function, which are the Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, Maintenance, and Protective Technology control categories. Anomalies and Events, Security Continuous Monitoring and Detection Processes are not the control categories that the company needs to improve when analyzing its processes individually, as they are part of the Detect function, not the Identify function. The Detect function is the function that provides the appropriate activities and capabilities to identify the occurrence of a cybersecurity incident in a timely manner. The Detect function consists of three control categories, which are:
* Anomalies and Events: Anomalous activity is detected in a timely manner and the potential impact of events is understood.
* Security Continuous Monitoring: The information system and assets are monitored at discrete intervals to identify cybersecurity events and verify the effectiveness of protective measures.
* Detection Processes: Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.
The company was ranked as high in the Detect function, which means that it has a good level of capability and performance in implementing and executing the cybersecurity activities and controls that are related to the Detect function. Therefore, the company does not need to improve its processes and controls that are related to the Detect function, which are the Anomalies and Events, Security Continuous Monitoring, and Detection Processes control categories. Recovery Planning, Improvements and Communications are not the control categories that the company needs to improve when analyzing its processes individually, as they are part of the Recover function, not the Identify function. The Recover function is the function that provides the appropriate activities and capabilities to restore the normal operations and functions of the organization as quickly as possible after a cybersecurity incident, as well as to prevent or reduce the recurrence or impact of future incidents. The Recover function consists of three control categories, which are:
* Recovery Planning: Recovery processes and procedures are executed and maintained to ensure timely
* restoration of systems or assets affected by cybersecurity incidents.
* Improvements: Recovery planning and processes are improved by incorporating lessons learned into future activities.
* Communications: Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.
The company was ranked as high in the Recover function, which means that it has a good level of capability and performance in implementing and executing the cybersecurity activities and controls that are related to the Recover function. Therefore, the company does not need to improve its processes and controls that are related to the Recover function, which are the Recovery Planning, Improvements, and Communications control categories.

While integrated email encryption systems automatically encrypt the content of emails, an alternative approach to ensure the security of sensitive data in emails is to encrypt sensitive data separately in attachments. Here's why this is a good alternative:
Encryption of attachments ensures that sensitive data is protected even if the email itself is not encrypted. By encrypting the file separately, you can guarantee the confidentiality of the data, regardless of the email encryption system in use.
This method also allows the sender to control encryption keys independently of email services and recipients, as the attachment's encryption can be managed separately from the email system.

A gateway is used to connect two networks using dissimilar protocols at the lower
layers or it could also be at the highest level of the protocol stack.
Important Note:
For the purpose of the exam, you have to remember that a gateway is not synonymous to the term
firewall.
The second thing you must remembers is the fact that a gateway act as a translation device.
It could be used to translate from IPX to TCP/IP for example. It could be used to convert different
types of applications protocols and allow them to communicate together. A gateway could be at
any of the OSI layers but usually tend to be higher up in the stack.
For your exam you should know the information below:
Repeaters A repeater provides the simplest type of connectivity, because it only repeats electrical signals between cable segments, which enables it to extend a network. Repeaters work at the physical layer and are add-on devices for extending a network connection over a greater distance. The device amplifies signals because signals attenuate the farther they have to travel. Repeaters can also work as line conditioners by actually cleaning up the signals. This works much better when amplifying digital signals than when amplifying analog signals, because digital signals are discrete units, which makes extraction of background noise from them much easier for the amplifier. If the device is amplifying analog signals, any accompanying noise often is amplified as well, which may further distort the signal. A hub is a multi-port repeater. A hub is often referred to as a concentrator because it is the physical communication device that allows several computers and devices to communicate with each other. A hub does not understand or work with IP or MAC addresses. When one system sends a signal to go to another system connected to it, the signal is broadcast to all the ports, and thus to all the systems connected to the concentrator.
Repeater Image Reference- http://www.erg.abdn.ac.uk/~gorry/course/images/repeater.gif
Bridges A bridge is a LAN device used to connect LAN segments. It works at the data link layer and therefore works with MAC addresses. A repeater does not work with addresses; it just forwards all signals it receives. When a frame arrives at a bridge, the bridge determines whether or not the MAC address is on the local network segment. If the MAC address is not on the local network segment, the bridge forwards the frame to the necessary network segment.
Bridge Image Reference- http://www.oreillynet.com/network/2001/01/30/graphics/bridge.jpg
Routers Routers are layer 3, or network layer, devices that are used to connect similar or different networks. (For example, they can connect two Ethernet LANs or an Ethernet LAN to a Token Ring LAN.) A router is a device that has two or more interfaces and a routing table so it knows how to get packets to their destinations. It can filter traffic based on access control lists (ACLs), and it fragments packets when necessary. Because routers have more network-level knowledge, they can perform higher-level functions, such as calculating the shortest and most economical path between the sending and receiving hosts.
Router and Switch
Image Reference- http://www.computer-networking-success.com/images/router-switch.jpg
Switches
Switches combine the functionality of a repeater and the functionality of a bridge. A switch
amplifies the electrical signal, like a repeater, and has the built-in circuitry and intelligence of a
bridge. It is a multi-port connection device that provides connections for individual computers or
other hubs and switches.
Gateways
Gateway is a general term for software running on a device that connects two different
environments and that many times acts as a translator for them or somehow restricts their
interactions. Usually a gateway is needed when one environment speaks a different language,
meaning it uses a certain protocol that the other environment does not understand. The gateway
can translate Internetwork Packet Exchange (IPX) protocol
packets to IP packets, accept mail from one type of mail server and format it so another type of
mail server can accept and understand it, or connect and translate different data link technologies
such as FDDI to Ethernet.
Gateway Server
Image Reference-
http://static.howtoforge.com/images/screenshots/556af08d5e43aa768260f9e589dc547f-3024.jpg
The following answers are incorrect:
Repeater - A repeater provides the simplest type of connectivity, because it only repeats electrical
signals between cable segments, which enables it to extend a network. Repeaters work at the
physical layer and are add-on devices for extending a network connection over a greater distance.
The device amplifies signals because signals attenuate the farther they have to travel.
Bridges - A bridge is a LAN device used to connect LAN segments. It works at the data link layer
and therefore works with MAC addresses. A repeater does not work with addresses; it just
forwards all signals it receives. When a frame arrives at a bridge, the bridge determines whether
or not the MAC address is on the local network segment. If the MAC address is not on the local
network segment, the bridge forwards the frame to the necessary network segment.
Routers - Routers are layer 3, or network layer, devices that are used to connect similar or
different networks. (For example, they can connect two Ethernet LANs or an Ethernet LAN to a
Token Ring LAN.) A router is a device that has two or more interfaces and a routing table so it
knows how to get packets to their destinations. It can filter traffic based on access control lists
(ACLs), and it fragments packets when necessary.
Following reference(s) were/was used to create this question: CISA review manual 2014 Page number 263 Official ISC2 guide to CISSP CBK 3rd Edition Page number 229 and 230

The combination door lock or cipher lock uses a numeric key pad, push button, or dial to gain entry, it is often seen at airport gate entry doors and smaller server rooms. The combination should be changed at regular interval or whenever an employee with access is transferred, fired or subject to disciplinary action. This reduces risk of the combination being known by unauthorized people.
A cipher lock, is controlled by a mechanical key pad, typically 5 to 10 digits that when pushed in
the right combination the lock will releases and allows entry. The drawback is someone looking
over a shoulder can see the combination. However, an electric version of the cipher lock is in
production in which a display screen will automatically move the numbers around, so if someone is
trying to watch the movement on the screen they will not be able to identify the number indicated
unless they are standing directly behind the victim.
Remember locking devices are only as good as the wall or door that they are mounted in and if the
frame of the door or the door itself can be easily destroyed then the lock will not be effective. A
lock will eventually be defeated and its primary purpose is to delay the attacker.
For your exam you should know below types of lock
Bolting door lock - These locks required the traditional metal key to gain entry. The key should be
stamped "do not duplicate" and should be stored and issued under strict management control.
Biometric door lock - An individual's unique physical attribute such as voice, retina, fingerprint,
hand geometry or signature, activate these locks. This system is used in instances when sensitive
facilities must be protected such as in the military.
Electronic door lock - This system uses a magnetic or embedded chip based plastic card key or
token entered into a sensor reader to gain access. A special code internally stored in the card or
token is read by sensor device that then activates the door locking mechanism.
The following were incorrect answers:
Bolting door lock - These locks required the traditional metal key to gain entry. The key should be
stamped "do not duplicate" and should be stored and issued under strict management control.
Biometric door lock - An individual's unique body features such as voice, retina, fingerprint,, hand
geometry or signature, activate these locks. This system is used in instances when extremely
sensitive facilities must be protected such as in the military.
Electronic door lock - This system uses a magnetic or embedded chip based plastic card key or
token entered into a sensor reader to gain access. A special code internally stored in the card or
token is read by sensor device that then activates the door locking mechanism.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 376
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 25144-25150). Auerbach Publications. Kindle Edition.