CISSP CCSP Scenario Based Question 2023

[@batserke6006]

Based on my work experience, I would believe that the correct awnser to question 1 is Vulnerability Management. I already saw a lot that changes for patch management where set to "implemented" and "successfull", however some servers where not patched. Then this gets picked up by Vulnerability reports and we inform the engineers to patch urgently the servers that where missed. Or should we ignore work experience when taking the CISSP and assume that patch management also includes that the engineers actually check if all servers are patched?

[@PrabhNair1]

Vm including in pm

[@cjql6147]

Yes. Coffee shots are helpful and provoke our thinking. Please continue the efforts for all the students and hopefully your passion. Thank you for wonderful video.

[@RasheedSyd]

Great job sir Prabh.

[@atassisamer]

Excellent!

[@mbwell]

Thanks Prabh. I would welcome more scenario based coffee shots.

[@avtraveller]

Thanks prabh bhai. We need more of these .

[@sishugirma4898]

is not patch management a subset of vulnerability management ? Hence answer should be the latter.

[@hazivong6582]

Regarding SQL injection and cross site scripting attacks question, WAP can effectively prevent as it also provides input validation. It’s one of many reasons why we implement WAP, but your explanation addressed that WAP can’t do input validation and option C - Input Validation and Output encoding is the best for your choice. May you help explain more Probh ?

[@PrabhNair1]

Can u help me with questions nun

[@c4stielro]

11:43... @@PrabhNair1

[@c4stielro]

I have the same question, these types of attacks are literally the reason why WAFs are implemented, so trying to understand why you are saying that having a WAF in front of the application still allows you to do SQL injections for example? Need some valid explanation on why C option is better than A. Thanks

[@mhadlock78]

@@c4stielro Not only that but the "coding is done" doesn't that imply that we are past the stage where we CODE input validation and output encoding? If I saw this question on the test I also would pick WAF. Love these videos regardless.

[@GilBlumberg]

Thank you so much for taking your own time to do this. These are fantastic. Please do more

[@lolithvijayan9946]

Thanks a lot Prabh for these shots. Excellent. Regarding the question related to symmetric and asymmetric, the answer 'Both' is right only because the question says that they are considering using symmetric and asymmetric. If that was not mentioned, then it would have been just asymmetric, because out of three answer we cannot chose both. hope my understanding is correct.

[@VishuIshu]

Amazing content you bring up for the welfare of certification aspirants 👏👏👏

[@cdyz5]

Love you Prabh. You are star :) Thank you.

[@madz1131]

This is gold

[@501saso]

Thanks for your efforts this was great 👍

[@sharathkarpur8552]

Hi Prabh, Data Loss Prevention (DLP) and Mobile Device Management (MDM) are two distinct technologies that serve different purposes. DLP is a security solution that helps organizations prevent data leakage by monitoring, detecting, and blocking sensitive data from leaving the organization’s network. On the other hand, MDM is a device management solution that helps organizations manage and secure mobile devices such as smartphones, tablets, and laptops. MDM solutions include features such as device configuration, secure app distribution, and remote wipe, while DLP solutions include features such as data classification, encryption, and access controls 3. Therefore, DLP is not part of MDM solution. Please help to clarify.

[@PrabhNair1]

Can you help me with questions and timestamp

[@mhadlock78]

Intune, a MDM solution has many DLP features. Don't take my word for it, google intune DLP features.

[@m.henawy]

WAF can do input validation

[@jagatbahadursubedi3476]

Thank you very much sir..

[@thomasmurphy3369]

Thank You!

[@Rajeesh.Raveendran]

I believe Incident Management Plan should be enabled which will cover Patch management and vulnerability management...

[@akshaykrishna6044]

Yes please

[@Curious_Bob]

NAC check the status of device before allowing them to connect to network i.e check security policy/ malware status etc . Dont you think in last question NAC may be a better solution. Secondly i thought MDM was for mobile smartphone device. BYOD can be a laptop as well.. i might be wrong.. kindly explain if posssible

[@PrabhNair1]

Nac will work till enterprise not beyond

[@balav7326]

Yes I do agree that patch management is to be done urgently so that the breach may spread to other domains. Also. But I feel incident management has a key role to play. The same thing could appear with another customers portal also .Please clear my doubt.

[@PrabhNair1]

Patch management is a solution which is driven by changd and incident management

[@rupeshpavari]

you are gem ♦

[@ian230187]

The WAF question is a bit confusingmm

[@jithinjoseph4493]

Hi Prabh, How can we identify the vulnerability if there is no vulnerability management ? Patch management is something not done by security team, but IT team right. So can the answer be Vulnerability management ? That comes first I believe.

[@Africalearn]

As you can read they already know the breache occure due to '' a vulnerability they do not patched well'' so I'm thinking that if they've done this manually, it could lead to this very problem, hence the importance of a management patch.

[@madz1131]

Cant even finish to read this scenario much more in exam 🤠