Auto-generated transcript. Minor transcription errors may remain.

Welcome And Today’s Focus

[0:00]

Welcome to the CISSP Cybertraining Podcast, where we provide you the training and tools you need to pass the CISSP exam first time. Hi, my name is Shon Gerber. I'm your host of the Action Active Forward Podcast. Join me each week as I provide the information you need to pass the CISSP exam and grow your cyber security knowledge. Alright, let's get started.

[0:25]

Good morning, everybody. It's Shon Gerber with CISSP Cyber Training and hope you all are having a beautifully blessed day today. Today's Monday. And Monday we deal with various aspects related to the CISSP exam. And we also deal with things that are topical related to CISSP and cybersecurity in general. So today we're going to get into our article that we typically do is we go into an article, then we roll into some training, and we're going to get into an article that is related to viral AI. Viral AI actress hotline faces scans. Every caller watches their mood. Now, what exactly does this mean? Am I dealing with another AI issue? No. Well, there's lots of AI issues, but we're not dealing with an AI issue this time. We're dealing with something a little bit different. But I wanted to call out this specific article completely, and we're going to be doing some training based around it. And this falls into the line of domains 4.3. So here's going to be, we're going to kind of play this up a little bit, and we're going to do a little bit of an analogy or an example so you can kind of see how this all goes together. So you sit down at a restaurant. So we're using a little bit of a food analogy. You sit down at a restaurant, a waiter takes your order. As far as you're concerned, that is the whole transaction, you and the waiter. But there's a plate that comes back passed through a line cook, a prep cook, a supplier, a delivery driver, and a dishwasher. Six people you never saw behind a door you never looked through. So again, you didn't agree to these six people. You agreed to the waiter, right? That's it, right? Right now, as I record this, a company has a video hotline running on the internet. You call it and a character talks back and talks to you on a screen. So again, that's number one. One company, as far as you can tell, that is it. However, there are seven companies on that call. So we're going to get into a little bit of details around it. And so this is kind of just to set it up so that you're ready

The Restaurant Analogy For Supply Chains

[2:10]

and prepared to know what exactly this means. Because with seven different moving parts, you're going to go, wait a minute, this is a little confusing. So that is the initial hack at this. So let's get started in the rest of it. So the situation comes into this product that we're going to talk about here is simple. It's simple to describe. A company in the UK built a promotional hotline for a fictional character. You call it, that's it. The character sees you, it hears you, and it answers, right? You don't even need a person there to do this before. So before you're connected, you point your camera at your own face. A separate company estimates your age based on whether you should meet this threshold that they have set. If it cannot tell, it asks you for a government ID. So that's the bouncer at the door. That's the person that's limiting you on going into the restaurant to begin with, checking you before the waiter ever even sees you. Now I want to be careful here because this part gets reported kind of incorrectly, kind of badly. The company says that no face print is created and that your selfie is not kept after the check. What they did that they keep is the approximate age band and the reference number tied to it. So I have no reason to dispute that, right? Take the claim at face value, that's what it is. Okay, so as we got to the waiter, we're now going to roll into the kitchen aspects. Here is what is actually behind that door that we mentioned earlier. The company you dialed runs this service. A second company does an age check. So we got multiple people involved here, multiple companies. A third provides a conversational video platform. A fourth provides a real-time video plumbing that carries the stream. A fifth turns your speech into text. And a sixth generates the character replies. And the seventh, the final one, provides the cloud infrastructure that all of this runs on. So seven companies, one phone call. So, and that difference I flagged at the top of this one is real, not a technicality. One is the party you contact with about the contact, the other is a party you contract with about the decision. Different relationships, different controls. Every one of them is a legitimate, contracted, disclosed supplier supplier. Nobody sneaked in. There is no man in the middle kind of activity going on here. This is just supply chain. This is not a supply chain attack. It's just a supply chain working as it's supposed to be working. So as you get started with this and you're calling in, your thought process and your mental model is that I'm talking to a character on a website, right? I'm talking to this, well, it's an IAI generator, but it looks like a person. Well, there's one more thing here. Throughout the call, the system watches your camera and listens to the tone to infer what mood you're in. So the character can respond to it, right? With me, it would probably look at me and go, yeah, that, yeah, you're not happy. Why are you not happy? Oh, wait, oh, why are you happy? It's good, it would just have a problem with me because my face is like all over the place. But you can't switch that call off on a call at all. The terms say so plainly that the only control is there is not to dial. So if you don't want that looking at you, don't dial in. Now, the part I actually want you to carry out of this section, there's three different things get kept for three different lengths of time. The recording of your call is deleted after 24 hours, which we see this a lot in all different aspects around this in any space of data retention. The transcript, the text of what you said, is kept for up to eight weeks and may be reviewed by staff and by outside partners. Again, part of their terms of service. And the session metadata, not what you said, just the record of what the call happened and its shape is kept up to potentially 18 months. So let's go back to this restaurant analogy, right? So the player, the plate is cleared in an hour. The order ticket sits there in a drawer for a while, and the reservation book, your name, your time, and how many in your party, how often you come. That all stuff sits on a shelf for about a year, year and a half. So the plate is the one everybody worries about, right? The reservation book is the one that outlives everything. So was there a security failure? No, there isn't one. And this is the uncomfortable part, and this is why I'm teaching this case rather than a potential news story. Here's the reframe, and it's the sentence that in this episode is built on. You cannot secure a channel you have not mapped. And we've talked about this over and over again at CISP Cyber Training. You need to understand what is connecting into your environment. It's not you should

Seven Vendors Inside One Call

[6:20]

not, you cannot. This is not a discipline problem. Every control you would reach for, encryption, logging, retention, access review, a contract, has to be applied to a specific party at a specific point. If your picture of the channel has one company in it and the real one has seven, you're not applying weak controls. You're applying correct controls, but to the wrong diagram. And that is not a fictional character problem. That is your video conferencing bridge. Your contact center, your telehealth platform, your interpreter service, every one of them is a channel with parties in that the people using it you most likely could not name. All right, so before we get go on here, if you're studying hard and not retaining it, that is a method problem, not a discipline problem. And that's what happened to me the first time, and this is why I failed the CISSP. The accelerator program is $19 a month, and the question bank with domain walkthroughs, it's amazing. Pro is only $39 a month, and then as in live office calls, which we have one as of the recording of this, it'll be on Monday, so it'll be today, and the CPE insider sheet with every episode. And the Sprint cohort is for people with a test date who need to be ready by it. I'm throwing this shameless plug out there because again, CISSP cyber training is where you need to go to get the information you need to help you pass the CISSP exam the first time. So, as we brought up this article related to the viral AI actress hotline who face scans every caller and watches their mood, let's roll into some training on how this is important and what you need to take away from this as a CISSP candidate and in cybersecurity as a whole. Okay, so we are getting into 4.3 secure communication channels. We're dealing with voice, video, collaboration, and third-party connectivity. The key factor in all this that we're gonna be chatting about is if you cannot secure a channel, you have not mapped and you do not understand. So it's an important part. So let's roll into each of these aspects that we're gonna get into related to the various trainings. So 4.1 and 4.2, because I'm just gonna say that there's a lot of little nuances in this when you're dealing with domain four. So 4.1 and 4.2 deals with architecture and components, routers, switches, segmentation, transmission media, all of those things. How does the traffic actually get there? 4.3 deals with secure communication channels. This is voice, video, collaboration, remote access, data communications, and then third-party connectivity. So all of those are an important part. So and this one's down, it basically comes and asks who is on the call. So think of it this way: 4.1 asks how the traffic is going to get there, 4.3 asks who's on the call. Most domain four scenario questions are a 4.3, but they kind of, it's easy to understand. And we all deal with the 4.1 and 2, which is your switches or routers of segmentation. So what do we kind of try to move towards? Well, yeah, we go towards those and we're studying it. But you need to understand 4.3 because that's a part that is one of the more questions are asked in this space. So the four pieces of 4.3. You have voice and video collaboration. This is conferencing, telephony, uh, chat, anything with participants, right? A piece, this is the piece that cannabis skip because it feels very soft, feels squishy. Uh, but this is a part that carries a lot of video or a lot of questions do pop up in here from things that I've read on Reddit and then people have chatted with me about. Remote access. This is another one of the pieces. This is VPNs, remote desktops, remote sessions, and so forth. Data communications, this is system to system exchange, traffic that has no human watching it at either end. And then four is third-party connectivity, which we've talked to in length in different ways around third-party risk management. But this is what it carries, who's accountable and how does it end, right? So one video call can sit in three of these at one time, and you need to know which one of them you're in before you read the option. So as you're looking at a test, at the questions, understand which one you potentially could be in. So now we look at this article that we talked about and related to the different companies that are involved. So you have different, you have the caller, the person who's going and calling in. And each of these people that are involved in this, they're reading this from beginning to end. They're carrying it through potentially, if they're just the infrastructure piece of it, but all of them have connectivity into it. Now, the important part of this is that no one was hacked. There was no problem here. This is an expectation. But I wanted to just use this article to kind of show the third-party risk management aspects that you're going to be dealing with that are tied to domain one, or I should say,

Retention Clocks And Mood Tracking

[10:45]

domain four, and also the fact is that there's there's third parties that are involved that you may not be aware of. So the first one is Zixolia. I can never say these names. So please forgive me. It's like reading prescriptions. You know, medical prescriptions, yeah, yeah, you can never say them. But the UK operates this and it's a hotline. And this is where you start having, you interact with this at the beginning. Then you do DidIt. Did it is a face-based age check, and this is out of Spain. Tavas is a controversial video platform or conversational video platform. And then Daily is the real-time video infrastructure that runs those aspects. Deepgram is transcription, and then Google, this is where it uses Gemini and generates the replies, and then it's all sitting, and also Google is involved, and the GCP is involved a little bit with Google. And then seventh is Amazon and its underlying infrastructure. So as you look at the slide, and if you're looking at this from on the website or on YouTube, you'll see the slide and how it's broken out. If you're listening to the podcast, well, we'll go through each of these. But one, two, and three, Zagola, did it, and Tavas, they all read the information. Daily carries it, Deep Grand reads it, and Google reads it, and then Amazon carries it. So that's how the content is being moving. But every one of the seven is legitimate. It's contracted and it's disclosed. Everybody knows. There's nothing here to attack. There's a their supply chain is working exactly as it's expected, which is precisely why domain four teaching case is not a news story. It's not something that we're kind of going, well, this ended the world. No, that's not it. That didn't end the world. But the goal of this is to teach you as a CISSP is to understand all the connectivity around this. So a party that carries your data and a party that reads your data are different relationships and they take different controls. They will look identical in the answer list, but you need to understand which one it is. So what the exam is looking for on voice and video, who can join? Again, we're looking at authentication. Can an uninvited party obtain a join path? Can they get in some way? Uh conferencing questions routinely hide an access control failure that is potentially in plain sight. Is it recorded? Whether recording exists, who is notified? Was content obtained? Anytime I do uh video recordings on CISP cyber training for my cohort, I tell people video recording is occurring. If you don't like it, you can leave. Also, it says it on Zoom. It says, hey, video recording is on session. Tells you all those things. What else is attached? Transcription, translation, summarization, analytics. Each is another party with content access, and none of them appear on the screen. This is one of those things where if you're in an actual Zoom call, you actually know who's there. And so you think, aha, I know who this is, I'm able to deal with that. What survives a call? Recordings, transcripts, metadata, each of them have their own clock, and we're gonna kind of get into those clocks. And this is a big deal when you're dealing with six different, different or seven different entities. So in a video channel, the participants can see each other, which is exactly why they assume they can see the whole channel. But in the case of this, you can't. So encryption in transit. This is we're gonna get into this because people you'll see questions go, well, encryption in transit is most important.

Mapping Channels Before Any Controls

[13:55]

This is what you must do. You need to think about that. So who can intercept it? Does it protect the content from the parties who are not supposed to see it? Does it defeat passive capture on the wire? Does it defeat an active man in the middle with certific uh certificate validation? Is there any sort of cryptography involved? So that's the intercept piece. Then what it does not answer in most cases when you're dealing with adding encryption is who can process it? It says nothing about the parties who are supposed to see it. The transcription service holds a valid key because they're part of the deal, right? It must. You cannot contrab transcribe ciphertext without it. The model provider receives content because retrieving the content is the product. That's what they're supposed to do. And again, that the process around this is contract and architecture. So you have cryptography and you have contracts and architecture. So when an option says the channel is encrypted, end to end, count the ends. What end? What end are they talking about? In a multi-party channel, there are more than two, and in every one of them holds content. Is it in the clear? This is where I part talk about the fact that your SaaS providers are important for you to know. I talk about this with my AI governance program. You are throwing stuff out to AI. Who are all these people involved? And are you able to manage who they are? How do they tell who they are? Do you know? And I would be willing to bet that they all of this is we've talked about in this situation. They're all well documented. But have you gone out and looked at the documentation to ensure that the people that are getting your data are people you want to be getting your data? So again, these are really important concepts that you but because everything is now, it used to be where you had one person you would go to. Now you go to that one person or that one company and they got seven different SaaS providers behind them. So there's three clocks, one channel, call recording. We talk about as it relates to this article, 24 hours. Transcript, it's up to eight weeks, and the session made metadata is 18 months. So you go from 24

CISSP Domain 4.3 Explained Clearly

[15:50]

hours up to 18 months. So the most intimate artifacts goes within 24 hours. Has the shortest life, it's good. The one that is not the most intimate, right? Your session metadata, this got a year and a half. So if you kind of put this in the restaurant perspective, which we talked about at the beginning, the plate, 24 hours, the order ticket is about eight weeks, and the reservation book is up to 18 months, which makes total sense, right? If you have a if you're going to a restaurant, you don't know what the person ate yesterday, but you may have a ticket that's good for about maybe a month. And then the reservation book, yeah, but if there's odds are high if it's online, you probably have a reservation book for at least a year, possibly two. So that's out there. So where the control ends and where accountability begins. There are two boundaries. They're very rarely in the same place. Where your control ends, the last point you operate, your edge, right? Your network edge, your tenancy, or your tenants, your tenant, yeah, your building, your opera, your organization, your your tenant, your tenant, that area, your managed endpoints. Past it, you can require things contractually, but you cannot enforce them technically. Where accountability ends is the point at which you no longer are answerable for what happens. For a service operating facing customers and regulators, this is almost always further out than the network boundary. And in many cases, it can go all the way to the seventh person in this situation. If you were to end up having something nasty happen to you and come to find out that the person on number seven didn't do what they were supposed to do, who's going to be held accountable? I'd be willing to bet everybody in that line, including you, will be held accountable in some form or fashion. So in this incidence, the operator's network boundary stopped at its own infrastructure. Its accountability, however, did not. To the caller and the regulator, that one's where the company answers the entire call. You don't have a choice. So again, knowing this is extremely important. Now the crossover candidates get wrong. So we got we talk about this, right? Transborder data flows as you're getting data from companies. Like we have the UK, it comes to the United States. Well, that's a trans border data flow. That's a domain one problem. Well, okay, that's true. It is a domain one problem. It's not domain four. But the channel that it's using is a domain three, or say domain four. So that's an important part. So the domain four asks who how is the channel built? Who is in its path? What does the party receive and where did the traffic go? Domain one will ask you, what does the law permit? What makes the transfer lawful? Who is accountable for it, and who accepted the residual risk? Those are domain one aspects. But all of those you can tell will blend together. Why do people get this wrong? The exam offers you a network control, a technical control, a regional routing, geofencing, keeping the traffic in region as an answer to a air quotes legal question. It is seductive because the real thing engineers will build out, it does not discharge the legal obligation. So again, these are distractors to move you away from what is important. Okay, the basic nuts and bolts of this episode is this there's three things to think about. 4.1 focuses on the plumbing, but you need to understand 4.3 because it asks in this situation who's on the call. Point two, transport and processing. They are very different relationships and take different controls. The third point, encryption in transit answers interception of the data, right? Not the processing. Again, you gotta understand the ends. You gotta understand trust boundaries. Those are all important when you're dealing with overall domain 4.3. Okay, so let's roll into some questions for the CISSB over domain 4.3. You have just taken over a security manager of a company operating a public video hotline. The service was assembled quickly from a third-party component, and the published terms described the downstream suppliers only in general categories. Our processing are air quotes as our processing partners. Nobody currently holds a list of them, and your team brings forth four proposals and wants a decision. So which should be performed first? A commission an independent penetration test of the hotline platform. B. Enumerate every party in the call path and establish what content each one has access to. C. Publish a transparency notice telling callers how their data is being handled, and D. Execute the data processing agreements with suppliers named in the published terms. Okay, so what they're trying to figure out here, right, is what your team needs has a bringing forward with some proposals and they need a decision on if you want to go forward with and do this. So you need to do an activity and what will you do first? So this falls in line with what we talked about today. So the answer is B, right? Enumerate every party on the call and establish what the content on each one can access. Again, mapping the overall what's in going on in your environment. How do you know? You know, what are all these places? Who is connectivity to them? The problem is many people avoid these because of the fact it takes time. It does. It takes a lot of time. Now there is a trap in here, and that is D. Execute the agreements with the suppliers named in the terms. So this is a right control, right? It is a managerial answer rather than a technical one, and it is where the mature program does end up. But it's also step three, and we're looking at step one. So it's a it's it's moving it down the path. So they gave you an idea. They said it was a good one, it's not a bad one, but which one is the first? That's the key factor here. So let's look at C though. You cannot describe how the flow has until you have it has been established. So transparency notice and telling people about it, that's great and wonderful. But if you don't even know where the data's going, you're writing a transparency control for what? For nothing. And then A, a penetration

Encryption Limits Trust Boundaries Accountability

[21:20]

test looks awesome, right? But that doesn't really help you in this situation because it doesn't involve unauthorized access. Every path in this is legitimate. It comes down to do you actually know where the data is going? Next question. Continuing the review, your platform vendor confirms that every hop on the path uses a current TLS with validated certificates. That media is encrypted in transit and that no unencrypted traffic traverses the public internet at any point. This includes a hop to the transcription provider, which converts the caller's speech to text and returns it back to the platform. Assuming all of this is accurate, right? They're not fibbing and they're not telling you something that is inaccurate. A board member asks whether the caller So, okay, how is that data protected from the transcription provider doing something with it? And what is your correct response in that regard? Yes, once a perfect A is once a perfect forward security is enabled, no session captured today cannot be decrypted after a future key compromise. B, yes, the channel is encrypted end to end, so intermediaries receive only ciphertext. C, yes, provided that the negotiated cipher suites and key links continue to meet current guidance. Or D. No. The provider must decrypt the content to do its job, so access to a contractual question rather than a cryptographic one is what's going on. So, what do you all think? And the answer is D. Yes. No, the provider must decrypt the content to do its job, which we kind of talked about. If you're gonna be doing a transcription, you gotta be able to read it. It can't be encrypted. So these are key questions. I will tell you, as a CISO, I have been asked something very, very similar to this. And you just sit there and go, uh yeah. I don't know the answer to that question. Let me go find out. Um, so you need to think ahead of that, right? You need to understand that. So transport encryption protects the data from parties who are not supposed to see it. It has nothing to say about parties who are supposed to see it. So the trap, there's one of the traps that's in here is B, end-to-end. So intermediaries receive only ciphertexts. So this is the strongest distractor on this side, right? And it catches a prepared candidate specifically because they don't know what end-to-end encryption actually means, right? That's a great word that's thrown out there. It's like encryption, ciphertext, end-to-end. You're like, okay, sure, sounds great. Okay, that's not that's not it. So then let's think about which one. Let's go to C. The it talks about stimulates or stipulates that the TLS is valid with valid certificates and it must be done. Improving cipher suites hardens the mechanism and it's working correctly, right? But this doesn't talk about any of the processing exposure moves. All it talks about is the technical aspects. And A, perfect forward security. That is great. That is great for past stuff, right? Uh any unlocking any recorded sessions, those are amazing. That's that's what pro the forward security will help. However, that does not help with the concurrent access that's currently being going on. Next question. Review establishes three retention periods running simultaneously in the same channel. A call recordings are deleted after 24 hours, transcripts are retained for up to eight weeks and may be reviewed by staff and outside parties. Session metadata, uh, the record that a call occurred and its characteristics is retained for up to 18 months. Which artifact sets the outer edge of the period during which your organization can still be asked to account for this channel? A the session metadata in 18 months is at the last artifact still in existence. B, the call recording because it's the most sensitive artifact and therefore carries the heaviest obligation. C, all three equally because the period runs from the date of the call, regardless of which the artifact was involved, or D, none of them. Accountability passes downstream, each processor knows and the uh once the data reaches it. Okay, so let's go here. Which one is it? And the answer is And the answer is A. The session of metadata, eighteen months is the last artifact still in existence. So each artifact carries its own retention requirement. None of them governs the others. They're all individual. So what the longest clock tells you is how long this channel keeps you in scope at all, right? So 18 months after the calls recorded are gone, the metadata is still there, still discoverable, still subject to access requests, and it's still yours to produce. So there was an 18-month tale on this situation. We talk about spotting the trap, the recording, because it's the most sensitive, right? The instinct for someone with good security judgment is to rank by impact, protect the crown jewels. But this question is asking how long and not and how serious. The recording is gone in a day. Ranking by sensitivity answers a question that was not actually asked. So you need to truly understand what they are looking for. D, accountability is not something you can delegate. Processing moves to the supplier. Answerability is not, right? This is a trust boundary point from the training that we talked about. C contradicts the facts that the question just gave you. It states that three different periods explicitly. The option assessing, you are equivalent to arguing with the scenario. So you know that one's wrong and you can just throw that on out. Okay, last question. Legal raises a finding. Callers located in the UK and the EU have their call content processed by providers established in the United States. Hmm. And no transfer mechanism has been documented for that export. You are the security manager and you must respond to the legal finding actually raised. Which action addresses it? A. Notify the affected callers and their content was processed in the United States. B. Send each provider a questionnaire confirming they comply with all applicable data protection laws and a file, the responses for the vendor record. C. Establish a document and appropriate transfer mechanism for the UK, EU and have residual risk formally accepted by the authorized owner.

Practice Questions And Exam Traps

[26:55]

Or D. Reconfigure the platform to route UK and EU sessions to an in-region infrastructure. Okay. So again, legal raises a finding. Callers in the UK use basically GDPR aspects. What are you going to deal with it? So you're the manager and you must respond to the finding legally has legal has raised. And the answer is C. Establish a document and appropriate transfer mechanism for the UK and EU data and have the residual risk formally accepted by the authorized owner. So again, you're dealing with a domain one aspect, and this is a domain four scenario, but you must have some level of authorization to do this. And if you don't have it in place now, you need to figure out how to do it. So again, they're one of the traps though is keep the session in region. Now, this is a good distractor because it's generally competent. It's actually something that you could definitely do. It's a real control, but it does not close the finding and what's actually going on. That's not something that you would deal with legal saying, well, we're just going to re-architect it and put it in a different location. So when it comes to something that deals with legal, you need to have some level of controls that are tied to a legal or regulatory function. So why are the other ones else's, the other ones wrong, right? The attestation is not a mechanism. So collecting confirmation shifts the appearance of responsibility onto the supplier without establishing anything. And we talk about accountability, it goes all the way down the chain. Transparency is a situation we're telling them that happened. Okay, that may not be required. And at the end of the day, uh you still got to fix the problem. So just telling, hey, we screwed up, but without fixing the problem is you're just going to continue to screw up. So you need to truly have all this down. Think about it this way: if it's a legal question, then you're going to have to have some way from a legal slash compliance aspect to deal with the problem.

Programs Resources And Closing Requests

[28:35]

Okay, so that's all I've got for you today. Hey, if you head on over to CISSP Cyber Training, you can gain access to my accelerator program, my pro program, or my sprint cohort. They're all available there for you, and they are amazing. I will tell you that folks that have been pass or taking my cohort, they have been passing their exam. I've got many people that are in my accelerator and pro programs that are enjoying those and getting a lot of value out of them as well, and that are passing the CISSP. So it's it's incredible. And also just a little note if you guys join my CISSP and you pass the exam, I do have I have a challenge coin that will be sent to you specifically once you show me you've passed the exam and you've been part of my cohort. Again, that's an important part. You've been a part of the cohort or part of one of my other programs, I will send it to you because you deserve it. You have worked for it, you've done what you needed to do, and I will send you out that coin. Again, it's pretty awesome. You can go check it out at CISSP Cyber Training. It's just a great thing for you and give you just a little added bonus for passing the CISSP exam. Okay, so thank you so much for everything, guys, and I hope you have a wonderful, beautiful day, and we'll catch you on the flip side. See ya. Thanks so much for joining me today on my podcast. If you like what you heard, please leave a review on iTunes as I would greatly appreciate your feedback. Also, check out my videos that are on YouTube and just head to my channel at CISSP Cyber Training, and you will find a plethora or a conocopia of content to help you pass the CISSP exam the first time. Lastly, head to CISSP Cyber Training and sign up for 360 free CISSP questions to help you in your CISSP journey. Thanks again for listening.