CISSP Practice Questions of the Day from IT Dojo - #68 - Least Privilege & Risk Analysis

[@zieyob]

I provisionally passed my exam last Wednesday. I can’t thank you enough for your service. So indispensable material

[@ITDojo]

Congratulations to you!

[@shreez8560]

Great question choices and it just me adjust my thinking. When writing the exam this morning, I imagined you reasoning why the other options wouldn't work. I passed provisionally this morning. Thank you for all of the great work that you are doing and putting out into the world for free! Just one suggestion Colin - your videos have a volume normalization issue - one loud, the next one very soft... would be awesome if you could find a fix. I'm so happy I'm no longer a CISSP wannabe! Big thank you!

[@ITDojo]

Congratulations! Awesome news. We're aware of the audio issues but KZbin doesn't offer a way to fix it without taking the video down and posting it as new.

[@shelleygrove1034]

We have missed ya Colin. Been looking over all these questions for a while and I am now buckling down to get ready for this test. Hope you have more questions coming.

[@ITDojo]

@Shelley We are working on pushing out more for sure! Make sure you click to get notifications when they come out! Thanks for sticking around!!

[@preetishinh7269]

For question no. 2, my pick was reduce the scope of the risks- rationale is to consider the key risks for the areas which could have huge impact of those risks are materialised.

[@sp1480]

Hi Colin, for the 2nd question, I was thinking the 3rd or 4th answer and than chose the 4th answer in regards to the scope. On one hand, my gut was telling me answer 3 using an automated tool but then, I'm trying to think like a manager or advisory and had the thought of cost of the tool in my mind? Thats why I chose 4. In the exam, i know everyone says to think high level but should I be considering cost or am I getting into the weeds here? Thanks!!

[@sokroeurn5462]

Dear Colin, could you please do more videos ? they are really useful to help us. Thanks in advance !

[@ITDojo]

I will be returning soon; I get really busy at times and posting new content gets pushed to the back burner. Gotta’ pay that mortgage before I get to have fun. 👊

[@alexvijay9005]

as per sybex..ther r tools availble for quantitative analysis..how abt qualitative????

[@juliobarrientos3037]

You are awesome dude. Thank you for all these videos.

[@ITDojo]

Aw, shucks! 😊. Now I’m blushing.

[@Qronk]

Second question, first answer of increase team size should be best answer. We live in perfect cissp world where money is not an issue. If the team is overwhelming with the amount of work, increase the damn team size.

[@ITDojo]

You must work for Apple 😂.

[@Qronk]

@@ITDojo If that's the case, you are probably sponsored by a company that sells "automated risk analysis tools" :P Love the content. Thank you so much for it. I did not agree with that specific Question tho.

[@ITDojo]

Oh, If I had a sponsor... thanks for dreaming me so big, @Qronk. Much love for that. If I needed/wanted a sponsor I’d be singing ‘shark baby’ songs, videoing myself eating food up close or commenting on the political tripe of the hour. Instead, I just thought I’d share some IT love with like-minded people. But people don’t sponsor that, it’s too useful. KZbin celebrates the perpetuation of mindlessness; the rest of us are seat fillers.

[@gurulee73]

Great first question! Did your daughter help design the shirt? Very creative!

[@trisnguyen4625]

Sweet question. Second one got me, I was so sure that we should re-evaluate the scope which the team is working on even before the answer pops up. Didnt know we have tools for risk analysis, do you have some name ? Would love to take a look on those automation tools. Thanks again for great questions :)

[@010mi6]

Even I agree to this. How can someone trust an *Automated* risk analysis *Tool* ? As security professionals we are suppose to be paranoids and not trust or believe any tool so easily unless we have concrete artifacts. I think that would have been a more appropriate answer if it contained a statement like, it's a tool from a top vendor, or maybe it's proprietary tool.

[@Jvssvl]

@@010mi6 I agree, if I put my "manager" hat on, I would first go back to the scope before I spend money on an automated tool, also the question didn't say anything otherwise.

[@ITDojo]

You trust automated tools many times per day... why do you place risk analysis in a special "can't be automated" category?

[@Jvssvl]

IT Dojo I don’t have any argument against that. You can absolutely use automated tools but as a manager, am I not supposed to try something in house , that can save me costs before I spend on automated tools?

[@RockyRxx]

Even i had the same question... If i put my managers hat, I would want to re-evaluate if i have selected the right Risks to Assess... More over I have always read that in the CISSP exam you don’t fix problems, you fix the process. Though Automating the process will be my first choice being technical, but with my Managerial hat i am inclined towards the re-evaluation... Confused now.. But I trust you Colin for the correct answer 😊 BTW, you are awesome mate