A security program should use a top-down approach, meaning that the initiation,
support, and direction come from top management; work their way through middle management;
and then reach staff members.
In contrast, a bottom-up approach refers to a situation in which staff members (usually IT ) try to
develop a security program without getting proper management support and direction. A bottom-
up approach is commonly less effective, not broad enough to address all security risks, and
doomed to fail.
A top-down approach makes sure the people actually responsible for protecting the company's
assets (senior management) are driving the program.
The following are incorrect answers:
The Delphi approach is incorrect as this is for a brainstorming technique.
The bottom-up approach is also incorrect as this approach would be if the IT department tried to
develop a security program without proper support from upper management.
The technology approach is also incorrect as it does not fit into the category of best answer.
Reference(s) used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 63). McGraw-Hill. Kindle
Edition.

The correct answer is "The ability to recover from a reset with the permissions set to cllow all". Permissions should be set to deny all during reset.

Explanation/Reference:
Explanation:
In a Smurf Attack the attacker sends an ICMP ECHO REQUEST packet with a spoofed source address to a victim's network broadcast address. This means that each system on the victim's subnet receives an ICMP ECHO REQUEST packet. Each system then replies to that request with an ICMP ECHO REPLY packet to the spoof address provided in the packets-which is the victim's address. All of these response packets go to the victim system and overwhelm it because it is being bombarded with packets it does not necessarily know how to process. The victim system may freeze, crash, or reboot.
Incorrect Answers:
B: A fraggle attack is a variation of a Smurf attack where an attacker sends a large amount of UDP traffic to ports 7 (echo) and 19 (chargen) to an IP Broadcast Address, with the intended victim's spoofed source IP address.
C: A LAND attack involves sending a spoofed TCP SYN packet (connection initiation) with the target host's IP address to an open port as both source and destination. This causes the machine to reply to itself continuously.
D: A replay attack (also known as playback attack) is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 587

The SDN is composed entirely of client-server pairs is the building block for software-defined networks (SDN) that is required. SDN is a network architecture that decouples the network control plane from the data plane, and that enables the network to be programmatically configured and managed by a centralized software controller. The control plane is the part of the network that makes the decisions about how to route and forward the network traffic, and that communicates with the network devices, such as the switches and routers.
The data plane is the part of the network that carries the network traffic, and that executes the instructions from the control plane, such as the forwarding tables and rules. The client-server pair is the basic unit of the SDN, and it consists of a client device that requests a network service or resource, and a server device that provides the network service or resource. The client-server pair communicates with each other through the data plane, and with the software controller through the control plane. The software controller acts as the intermediary between the client-server pairs, and it dynamically configures and optimizes the network according to the policies and requirements of the client-server pairs. The other options are not the building blocks for SDN that are required, as they either do not relate to the SDN architecture, or do not enable the network to be programmatically configured and managed by a centralized software controller.
References: CISSP - Certified Information Systems Security Professional, Domain 4. Communication and Network Security, 4.1 Implement secure design principles in network architectures, 4.1.1 Apply secure design principles to network architecture, 4.1.1.2 Software-defined networks; CISSP Exam Outline, Domain 4.
Communication and Network Security, 4.1 Implement secure design principles in network architectures, 4.1.1 Apply secure design principles to network architecture, 4.1.1.2 Software-defined networks

Negative Testing is a software testing type used to check the software application for unexpected input data and conditions. Unexpected data or conditions can be anything from wrong data type to strong hacking attack.