ISC Updated CISSP Exam Questions and Answers by alexia

User and group entitlement reporting is a process of collecting and analyzing the access rights and permissions of users and groups across the network. It can help answer questions such as where does a particular user have access within the network, what resources are accessible by a particular group, and who has access to a particular resource. User and group entitlement reporting can also help identify and remediate excessive or inappropriate access rights, enforce the principle of least privilege, and comply with security policies and regulations.

• A. When a particular file was last accessed by a user is not a question that can be answered using user and group entitlement reporting, but rather a question that can be answered using file auditing or logging.
• B. Change control activities for a particular group of users is not a question that can be answered using user and group entitlement reporting, but rather a question that can be answered using change management or configuration management.
• C. The number of failed login attempts for a particular user is not a question that can be answered using user and group entitlement reporting, but rather a question that can be answered using authentication or account management.

References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3, page 138; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 3, page 114

Determining outage costs caused by a disaster can best be measured by the overall long-term impact of the outage, which includes both direct and indirect costs. Direct costs are the expenses incurred to restore the normal operations, such as the cost of repair, replacement, recovery, or relocation. Indirect costs are the losses or damages that result from the interruption of business activities, such as the loss of revenue, productivity, reputation, customer loyalty, market share, or competitive advantage. The overall long-term impact of the outage can be estimated by using methods such as business impact analysis (BIA), return on investment (ROI), or total cost of ownership (TCO). The cost of redundant systems and backups, the cost to recover from an outage, and the revenue lost during the outage are all examples of direct costs, but they do not capture the full extent of the outage costs caused by a disaster. 

Generic Routing Encapsulation (GRE) is a protocol that encapsulates a packet of one protocol type within another protocol type4. When using GRE tunneling over IPv4, the GRE header is inserted between the delivery header and the payload5. The delivery header contains the new source and destination IP addresses of the tunnel endpoints, while the payload contains the original IP packet4. The GRE header contains information such as protocol type, checksum, and key6.

Manual patch installation allows for thorough testing before deployment to ensure that the patch does not introduce new vulnerabilities or incompatibilities. Automated patch management can sometimes lead to unexpected issues if patches are not fully compatible with all systems and applications12 References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, p. 452; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 7: Security Operations, p. 863.