Free ISC2 CISSP Actual Exam Questions - Question 8 Discussion

Maybe C since integrity checks like TCP operate at transport layer, not network or session.

Option C makes sense since integrity checking can happen at transport or session layers, like TCP checksums. CRC (D) is definitely lower down, mostly data link, so it’s less likely here.

Good points on CRC being data link layer only. Another angle: configuration management (B) is more of an administrative task, not a protocol or function at those OSI layers. Data at rest encryption (A) is about the storage layer, not involved in session, transport, or network communication processes. So that leaves C, integrity checking software, which aligns with ensuring data integrity during transmission—something you'd expect at session or transport layers. Definitely feels like C matches the question’s focus on those specific OSI layers better than the others.

I’m ruling out A and B because data at rest encryption doesn’t really operate at those layers—it’s more about storage security. For D, CRC is definitely tied to the data link layer, so that probably disqualifies it here. That leaves C, since integrity checking software can work across session and transport layers to verify data hasn’t been tampered with during communication. Anyone else think the question might be testing where these functions typically run rather than just where they’re most famous?

It’s C. Integrity checking software often works at the transport or session layer to ensure data isn’t altered during transfer, which fits better than CRC that mainly deals with physical or data link layers.

It’s D. CRC works at the network layer for error checking, so it fits the OSI model layers mentioned better than the others. Seen questions like this testing basic layer functions before.