Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > 5 - Security Architecture and Design > Flashcards

5 - Security Architecture and Design Flashcards

1
Q
  1. What is the principle of least privilege?a. All users are assigned a minimum standard level of access, then additional access is granted as neededb. A system is designed so there are the fewest number of different security access levels as possiblec. Users are assigned only enough access to accomplish their work tasksd. The least privileged users are assigned roles
A

C: The principle of least privilege is users are assigned only enough access to accomplish their work tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q
  1. What security model is a directed graph that indicates the rights or privileges that a subject can transfer to an object or that a subject can obtain from another subject?a. State machine modelb. Bell-LaPadula modelc. Clark-Wilson modeld. Take-grant model
A

D: The take-grant model is a directed graph that indicates the rights or privileges that a subject can transfer to an object or that a subject can obtain from another subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  1. If the operating system fails to establish boundaries for the size and type of data that can be inputted, what malicious event or activity can occur?a. Denial of serviceb. Logic bombc. Buffer overflowd. Virus infection
A

C: Failing to control input may result in a buffer overflow.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  1. Which operating state represents a process in normal execution?a. Ready stateb. Wait statec. Supervisory stated. Problem state
A

D: The problem state is the state of a process performing normal execution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  1. In order for an OS to remain stable, what must it be able to accomplish or perform?a. At least one calculation per secondb. Grant limited access to unauthorized usersc. Protect itself from users and softwared. Operate at Ring 3
A

C: An OS must protect itself from users and software to remain stable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  1. What mode of operation exists when all users have the authorization and need-to-know to access all resources?a. Dedicated security modeb. System-high security modec. Compartmentalized security moded. Multilevel security mode
A

A: Dedicated security mode exists when all users have the authorization and need-to-know to access all resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  1. At which Ring of protection do device drivers operate?a. Ring 0b. Ring 1c. Ring 2d. Ring 3
A

C: Ring 2 is for device drivers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  1. What mechanism is used for a lower protection ring entity to communicate with a higher protection ring entity?a. Hashingb. RPCc. Covert channeld. System call
A

D: A system call is needed for a lower protection ring entity to communicate with a higher protection ring entity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
  1. Of the four possible operating states of a system, which represents the state within which an application is being actively processed?a. Problem stateb. Ready statec. Wait stated. Supervisory state
A

A: The problem state is the execution of an application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  1. The orange book security classifications such as C2 and B1 are focused on what?a. The entire computerb. The trusted computer basec. The entire networkd. Just the CPU and primary storage
A

B: The orange book classifications are focused on the TCB.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  1. Secondary storage is?a. Nonvolatile storage, such as a hard driveb. The RAM in a computerc. Allocated memory for programsd. The combination of RAM and space from a paging file
A

A: This is secondary storage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  1. What is the most trusted component of a computer?a. Memoryb. CPUc. Hard drived. Network interface
A

B: The CPU is the most trusted component of a computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  1. A buffer overflow can cause all but which of the following?a. network throttlingb. system freezingc. system rebootingd. data corruption
A

A: Network throttling is usually not a function, symptom, or effect of a buffer overflow. Network throttling is a control feature to limit the bandwidth consumed by a specific application or service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  1. Once data has been processed by the CPU for a program, it is moved into memory areas known as?a. primary storageb. real storagec. secondary storaged. virtual storage
A

B: Once data has been processed by the CPU, it is moved into memory areas known as real storage. Real storage is the memory address space allocated for use by programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  1. What type of memory storage requires constant updates because the data it stores dissipates and decays?a. Static RAM or Random Access Memoryb. ROM or Read Only Memoryc. Dynamic RAM or Random Access Memoryd. EPROM or Erasable and Programmable Read Only Memory
A

C: Dynamic RAM or Random Access Memory requires constant updates because the data it stores dissipates and decays.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  1. Which of the following is the fastest form of memory?a. secondaryb. virtualc. reald. cache
A

D: Cache memory is a form of high-speed memory accessed directly by the CPU that operates at a higher rate than real memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  1. For security to be effective which of the following should not be true?a. security is added to a product after its initial developmentb. security is integrated into a product at the design stagec. security is engineered into the productd. security is implemented by default in the product
A

A: Adding security as an afterthought is not an effective means to provide adequate, functional, or even reliable security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q
  1. Once security is implemented into the design of a product, it should also be all but which of the following?a. testedb. disabledc. certifiedd. audited
A

B: Security should not be disabled once it has been integrated into a product.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
  1. If the operating system or an application fails to set boundaries on input data, what problem can occur?a. session hijackingb. access grabbingc. buffer overflowd. information disclosure
A

C: Failing to defined boundaries for input can result in a buffer overflow error.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q
  1. When a buffer overflow occurs, the extra data may flow into the CPU and cause what?a. loss of privilegesb. the system to drop the extra datac. an error event log is writtend. execution of malicious code in privileged mode
A

D: Buffer overflows often result in the execution of malicious code in privileged mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q
  1. The act of positioning data in one security division that is not accessibly by a subject of another security division is called what?a. Data hidingb. Layeringc. Data diddlingd. Abstraction
A

A: Data hiding is the placement of data in a different security level than a given subject in order to hide it from that subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q
  1. Which of the following security models is focused on protecting confidentiality?a. Biba modelb. Bell-LaPadula modelc. Take-Grant modeld. Clark-Wilson model
A

B: The Bell-LaPadula model is focused on protecting confidentiality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q
  1. Which of the books from the Rainbow series is concerned with the interactions of computers over a communication medium?a. Orangeb. Tanc. Redd. Purple
A

C: The red book is concerned with the interactions of computers over a communication medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q
  1. The ability for a single processor computer system to execute more than one process simultaneously is known as?a. multithreadingb. multitaskingc. multiprocessingd. multiplexing
A

B: Multitasking is when a computer system can execute more than one process simultaneously.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q
  1. The _______________ a security system, the _______________ it provides.a. less complex, less assurance b. greater complexity, greater assurance c. more complex, less assurance d. more complex, more assurance
A

C: The more complex a security system, the less assurance it provides.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q
  1. The collection of mechanisms within a computer system that work in harmony to enforce and support a security policy is known as?a. Ring 0b. an assurance packagec. white box systemd. trusted computing base
A

D: The collection of mechanisms within a computer system that work in harmony to enforce and support a security policy is known as the trusted computing base or TCB.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q
  1. Trusted computing base is important for all but which of the following reasons?a. TCB ensures that a properly designed system is fully secured. b. If the TCB meets specific requirements, it can be said to provide a specific level of trust.c. TCB can be built into a system, evaluated, and certified.d. TCB certification provides a standardized system to compare the security capabilities between different systems and to provide a standardized label of the level of security it provides.
A

A: No system is fully secure. TCB provides a means to measure and evaluate the level of security offered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q
  1. In a trusted computer that employs the concept of protection rings, in which ring are hardware drivers typically located?a. Ring 0b. Ring 1c. Ring 2d. Ring 3
A

C: Device drivers are typically located in Ring 2.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q
  1. If a process in a higher protection ring number needs to communicate with a process or resource in a lower protection ring number, what must occur?a. buffer overflowb. execution priority shiftc. the process must be moved to a lower ring numberd. system call
A

D: A system call is required for a a process in a higher ring number needs to communicate with a process or resource in a lower ring number.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q
  1. Which of the four possible operating states is exemplified by a processes that will resume execution as soon as its print job is fully sent to the print server?a. Wait stateb. Ready statec. Problem stated. Supervisory state.
A

A: The wait state is the state of a process waiting for a specific event to finish, such as a print job.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q
  1. What component of a computer system is the most trusted element?a. CPUb. memoryc. storage devicesd. network interface
A

A: The CPU is the most trusted component of a computer system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q
  1. Memory is controlled using a kernel level memory mapper and manager. This establishes an access control layer between software and memory, why?a. prevents buffer overflowsb. software is not trustedc. helps to minimize the use of secondary storaged. required by D1 TCSEC certification
A

B: Software is not trusted, therefore it is isolated from managing hardware (i.e. memory) directly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q
  1. The security model that defines the relationships that allow a subject to transfer rights to objects is known as?a. Bell-LaPadula modelb. Biba modelc. Clark-Wilson modeld. Take-Grant model
A

D: The Take-Grant model defines the relationships that allow a subject to transfer rights to objects. It also defines the rights that a subject can take from another subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q
  1. The Bell-LaPadula security model is primarily concerned with protecting?a. confidentialityb. integrityc. non-repudiationd. accountability
A

A: The Bell-LaPadula security model is primarily concerned with confidentiality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q
  1. The primary regulation of the Bell-LaPadula security model is?a. * (star) integrity axiomb. * (star) property rulec. No write upd. No read down
A

B: The * (star) property rule, no write down, is the primary regulation of the Bell-LaPadula security model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q
  1. The Bell-LaPadula’s simple security rule is what? a. no write upb. no write downc. no read upd. no read down
A

C: No read up, the simple security rule, is the secondary regulation of the Bell-LaPadula security model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q
  1. Resource isolation provides for all but which of the following?a. only auditing and tracking of major eventsb. subject and object are clearly identifiedc. enforced accountabilityd. independent assignment of permissions and rights
A

A: Resource isolation provides for auditing and tracking of all events, including minor ones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q
  1. The separation of memory physically instead of just logically is an example of and a requirement for what?a. trusted computing baseb. hardware segmentationc. a division between user mode and kernel moded. data classification levels
A

B: The separation of memory physically instead of just logically is an example of and a require for hardware segmentation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q
  1. _____________ means subjects are granted only the minimal amount of access required for them to complete their assigned work tasks.a. need to knowb. separation of dutiesc. least privileged. privilege elevation
A

C: Least privilege (or the principle of least privilege) means subjects are granted only the minimal amount of access required for them to complete their assigned work tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q
  1. The method used to restrict communications to detailed and controlled interfaces in order to maintain the security of a system is?a. data diddlingb. data hidingc. abstractiond. layering
A

D: Laying restricts communications to detailed and controlled interfaces in order to maintain the security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q
  1. The absence of a communication interface between security layers in order to prevent subjects from obtaining knowledge of a confidential resource is what?a. data hidingb. layeringc. data classificationd. abstraction
A

A: Data hiding is placing restricted data in a different security domain so a specific subject is unaware of its existence. Data hiding is also the absence of a communication interface between security layers in order to prevent subjects from obtaining knowledge of a confidential resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q
  1. Which of the following is not true of a state machine model?a. is secure in every instance of its existenceb. executes commands but not transactions securelyc. boots into a secure state, even after an error is encounteredd. restricts subjects to access resources
A

B: A state machine model executes commands and transactions securely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q
  1. The columns of an access control matrix are known as?a. capability listsb. tuplesc. access control listsd. ordinal sets
A

C: A column of an access control matrix is known as an access control list.

44
Q
  1. The orange book from the TCSEC rainbow series addresses what?a. auditingb. stand-alone systemsc. interactions of computers over a communication mediumd. development of production-quality formal verification systems
A

B: The orange book is concerned with stand-alone systems.

45
Q
  1. Which of the following is not true in regards to security domains?a. Interactions between a security domain and a TCB must be strictly regulated and controlled to maintain security.b. A security domain contains the objects and resources that a specific subject can access. c. The O/S when operating in user mode has access to a larger security domain than when operating in kernel mode.d. Security domains must be clearly identified, separated, and enforced.
A

C: The O/S when operating in kernel mode has access to a larger security domain than when operating in user mode.

46
Q
  1. Which of the following is not true in regards to an application executing in user mode?a. cannot access hardware directlyb. memory access is handled by a mediatorc. can access resources only within its own security domaind. It should be closely monitored since it is directly interacting with sensitive resources
A

D: Applications executing in user mode do not have direct access to sensitive resources. Only application in kernel mode have such access.

47
Q
  1. Which of the following is not an element of the Clark-Wilson security model?a. subjects can access resources only through authorized interfacesb. the classifications or levels of access are definedc. separation of duties is compulsoryd. auditing is mandatory
A

B: The Biba security model uses three levels of integrity axioms: high, medium, and low. Clark-Wilson does not.

48
Q
  1. The management of the movement of data between classification levels is the primary concern of which security model?a. Bibab. Clark-Wilsonc. Information Flowd. Noninterference
A

C: The Information Flow model controls how data is moved to and from approved levels.

49
Q
  1. What security model is concerned with preventing the actions of subjects at one security level from being noticed by or affecting subjects at a different security level.a. Bibab. Clark-Wilsonc. Information Flowd. Noninterference
A

D: The Noninterference model is concerned with preventing the actions of subjects at one security level from being noticed by or affecting subjects at a different security level.

50
Q
  1. Which of the following is not a weakness of the Bell-LaPadula security model?
A

D: Bell-LaPadula is based on a multilevel security policy.

51
Q
  1. The Biba security model is primarily concerned with protecting?a. integrityb. disclosurec. availabilityd. confidentiality
A

A: The Biba security model is primarily concerned with integrity.

52
Q
  1. The * (star) integrity axiom of the Biba security model is what?a. no write downb. no write upc. no read downd. no read up
A

B: No write up, the * (star) integrity axiom, is the primary regulation of the Biba security model.

53
Q
  1. Within what security mode does the system function at a single security level? a. system-high security modeb. multilevel security modec. dedicated security moded. compartmented security mode
A

C: A system within the dedicated security mode functions at a single security level.

54
Q
  1. A system is labeled as having __________ when all of the security protection mechanism work in concert to process and handle sensitive data without violating the trusted computer base or the applicable security policy.a. assuranceb. certificationc. accreditationd. trust
A

D: A system is labeled as trusted when all of the security protection mechanism work in concert to process and handle sensitive data without violating the trusted computer base or the applicable security policy.

55
Q
  1. The European standards for security evaluation criteria is known as?a. Information Technology Security Evaluation Criteria (ITSEC)b. Common Criteria (CC)c. European Union Trusted Computer System Evaluation Criteria (EU TCSEC)d. Trusted Computer System Evaluation Criteria (TCSEC)
A

A: Information Technology Security Evaluation Criteria (ITSEC) is the set of European standards.

56
Q
  1. What security model was developed as the integrity analog to the Bell-LaPadula security model?a. Take-Grantb. Clark-Wilsonc. Bibad. Information Flow
A

C: The Biba security model developed as the integrity analog to the Bell-LaPadula security model.

57
Q
  1. A security model that employs the boundary controls of least upper bound (LUB) and greatest lower bound (GLB) is commonly referred to as?a. the Biba modelb. the non-interference modelc. the integrity modeld. a lattice model
A

D: The lattice model uses the boundary controls of least upper bound (LUB) and greatest lower bound (GLB)

58
Q
  1. Which security model is focused on preventing authorized users from making unauthorized modifications to data?a. Clark-Wilsonb. Bell-LaPadulac. Bibad. Take-Grant
A

A: Clark-Wilson model is focused on preventing authorized users from making unauthorized modifications to data.

59
Q
  1. What security mode is represented by the state when all users have the clearance and need to know for all information stored on a system?a. dedicated security modeb. system-high security modec. compartmented security moded. multilevel security mode
A

A: Dedicated security mode is represented by the state when all users have the clearance or need to know for all information stored on a system.

60
Q
  1. What security mode is represented by the state when users are limited to resource access based on need to know and formal access approval?a. multilevel security modeb. compartmented security modec. system-high security moded. dedicated security mode
A

B: Compartmented security mode is represented by the state when users are limited to resource access based on need to know and formal access approval (i.e. real-time clearance for access by a superior).

61
Q
  1. What is the minimum Trusted Computer System Evaluation Criteria (TCSEC) security level that directly addresses covert channels?a. C2b. B1c. B2d. A1
A

C: B2 is the minimum Trusted Computer System Evaluation Criteria (TCSEC) security level that directly addresses covert channels.

62
Q
  1. Which of the following is not true in regards to Trusted Computer System Evaluation Criteria (TCSEC)?a. addresses confidentialityb. work with government data classificationsc. employs only a few specific ratingsd. addresses network connectivity
A

D: Trusted Computer System Evaluation Criteria (TCSEC) does not address network connectivity, rather is only addresses stand alone systems. Trusted Computer System Evaluation Criteria (TCSEC) is the orange book.

63
Q
  1. Which of the following is not true in regards to the Red book from the rainbow series?a. addresses centralized and distributed networks with one or more accreditation authoritiesb. addresses network connectivityc. rates confidentiality and integrityd. addresses denial of service protection
A

A: The Red book (Trusted Network Interpretation) only addresses centralized networks with a single accreditation authority.

64
Q
  1. Which Trusted Computer System Evaluation Criteria (TCSEC) security label requires mandatory protection mechanisms and controls?a. Ab. Bc. Cd. D
A

B: Trusted Computer System Evaluation Criteria (TCSEC) security label B requires mandatory protection mechanisms and controls.

65
Q
  1. Which of the following Trusted Computer System Evaluation Criteria (TCSEC) security labels represents those systems with the least degree of trust?a. A1b. B2c. B1d. B3
A

C: B1 is the Trusted Computer System Evaluation Criteria (TCSEC) security label that represents those systems with the least degree of trust (among those labels listed in this question).

66
Q
  1. Which of the following is not an evaluation criteria for establishing TCSEC security labels?a. continuous protectionb. identificationc. accountabilityd. mandatory access controls
A

D: Mandatory access controls is not an evaluation criteria, but the defining characteristic of systems with a level B rating. Other evaluation criteria not listed here include security policy, labels, documentation, and life cycle assurance.

67
Q
  1. What security label from the Trusted Computer System Evaluation Criteria (TCSEC) represents those systems with the most secure configurations?a. Ab. Bc. Cd. D
A

A: A is the highest Trusted Computer System Evaluation Criteria (TCSEC) label for security.

68
Q
  1. Which TCSEC security label represents systems that employ security domains?a. C1b. B3c. C2d. B2
A

B: B3 is the Trusted Computer System Evaluation Criteria (TCSEC) security label that represents systems that employ security domains.

69
Q
  1. Which is the least effective way to prevent the use of covert channels?a. firewallsb. vulnerability scannersc. anti-virus softwared. noise
A

D: Noise and traffic generation are the least effective means to protect against the use of covert channels.

70
Q
  1. Which of the following is not an effective countermeasure against buffer overflows?a. port blockingb. verifying input datac. verify data type for inputd. adherence to security procedures during life cycle phases
A

A: Port blocking is not an effective countermeasure against buffer overflows. Buffer overflows occur because too much invalid data is submitted over an otherwise legitimate communications session.

71
Q
  1. A means by which a hacker can gain access to an operating system by planting a piece of software or opening a hole in the security is known as?a. maintenance hookb. back doorc. Trojan horsed. covert channel
A

B: Back door is software or a break in a system’s security imposed by a hacker that allows them to reconnect to a system at a later date.

72
Q
  1. The B2 Trusted Computer System Evaluation Criteria (TCSEC) security label is roughly equivalent to which of the following Information Technology Security Evaluation Criteria (ITSCE) security labels?a. E3b. E4c. E5d. E6
A

B: The Information Technology Security Evaluation Criteria (ITSCE) E4 rating is roughly the equivalent of the Trusted Computer System Evaluation Criteria (TCSEC) B2 rating.

73
Q
  1. Which of the security evaluation methods employs protection profiles to specify security requirements?a. Trusted Computer System Evaluation Criteria (TCSEC)b. Information Technology Security Evaluation Criteria (ITSEC)c. Common Criteria (CC)d. European Union Trusted Computer System Evaluation Criteria (EU TCSEC)
A

C: The Common Criteria (CC) security evaluation method employs protection profiles to specify security requirements.

74
Q
  1. _________________ must be rechecked or re-verified after a specific period of time or after significant changes occur.a. Certificationb. Accreditationc. Neither Certification nor Accreditationd. Both Certification and Accreditation
A

D: Both Certification and Accreditation must be rechecked or re-verified after a specific period of time or after significant changes occur.

75
Q
  1. Which of the following is not an effective countermeasure against backdoors and maintenance hooks?a. adherence to security protocols during life cycle phasesb. network based intrusion detection systemsc. strong authenticationd. strong access controls
A

C: Strong authentication is not an effective countermeasure against backdoors and maintenance hooks since these subversive means to gain access to a system usually bypass the identification and authentication processes.

76
Q
  1. Which of the following is not an example of a covert channel being used to transmit data or a signal?a. a blinking light on a deviceb. a fraudulently marked bad sector on a hard drivec. a network packet sent repeatedly for a specific length of timed. a dedicated VPN link between the local LAN and a remote client
A

D: A dedicated VPN is not a covert channel.

77
Q
  1. Which of the following is not one of the three types of NIACAP (National Information Assurance Certification and Accreditation Process) accreditations? a. domainb. sitec. typed. system
A

A: NIACAP does not offer a domain accreditation.

78
Q
  1. The Information Technology Security Evaluation Criteria (ITSEC) evaluates what two attributes separately that Trusted Computer System Evaluation Criteria (TCSEC) evaluates together?a. confidentiality and integrityb. functionality and assurancec. availability and authenticationd. accountability and non-repudiation
A

B: ITSEC evaluates functionality and assurance separately while TCSEC evaluates them together.

79
Q
  1. The formalized certification and accreditation method employed by the department of defense is known as?a. Defense Information Technology Security Certification and Accreditation Process (DITSCAP)b. National Information Assurance Certification and Accreditation Process (NIACAP) c. Commercial Information Security Analysis Process (CIAP) d. Common Criteria (CC)
A

A: Defense Information Technology Security Certification and Accreditation Process (DITSCAP) is the certification and accreditation method employed by the department of defense.

80
Q
  1. Which of the following is not true in regards to closed systems? a. proprietaryb. published specifications for easy 3rd party component developmentc. offers some level of security through obscurityd. not exemplified by Microsoft, Apple, or UNIX operating systems
A

B: Open systems have published specifications for easy 3rd party component development, not closed systems.

81
Q
  1. An information path that is not normally used to communicate information and therefore unprotected by the system’s security mechanisms is known as?a. TEMPESTb. backdoorc. covert channeld. data remanence
A

C: A covert channel is an information path that is not normally used to communicate information and therefore unprotected by the system’s security mechanisms. Covert channels are a means by which data can be secretly disclosed to other systems or users. The two types of covert channels are storage and timing.

82
Q
  1. Which security model is designed to protect confidentiality?a. Biba modelb. Bell-LaPadula modelc. Clark-Wilson modeld. State machine model
A

B: The Bell-LaPadula model was designed to protect confidentiality.

83
Q
  1. The Biba model is ____________.a. A confidentiality protection schemeb. Based on user rolesc. Lattice basedd. An integrity analog of the Clark-Wilson model.
A

C: Biba is lattice based.

84
Q
  1. Which of the following is true?a. The levels in the lattice structure of the Biba model are bound by the least lower bound and the greatest upper bound.b. The Clark-Wilson model maintains resource availability.c. The Information Flow model restricts traffic flow to within the current security level. d. The noninterference model ensures that the actions of subjects at one security level are unseen and make no effect on objects or subjects at a different security level.
A

D: The noninterference model ensures that the actions of subjects at one security level are unseen and make no effect on objects or subjects at a different security level.

85
Q
  1. Which security model is an example of a multi-level security mode?a. Biba modelb. Bell-LaPadula modelc. Clark-Wilson modeld. Non-interference model
A

B: The Bell-LaPadula model is an example of a multilevel security mode.

86
Q
  1. Which of the following is an example of a multi-level security model?a. Bell-LaPadulab. Information flowc. Clark-Wilsond. Take-Grant
A

A: Bell-LaPadula is an example of a multi-level security model.

87
Q
  1. Which of the following is secure in each and every instance of its existence? a. expert systemb. state machine modelc. neural networkd. trusted computing base
A

B: A state machine model is secure in each and every instance of its existence.

88
Q
  1. Which of the following is a rule of the Bell-LaPadula model?a. * (star) property ruleb. No Read downc. * (star) integrity axiomd. No write up
A

A: The * (star) property rule (no write down) is a rule of the Bell-LaPadula model.

89
Q
  1. All but which of the following is a classification evaluation criteria for the B1 level of Trusted Computer System Evaluation Criteria (TCSEC)?a. each object must have a classification labelb. each subject must have a clearance labelc. restrictions against covert channels.d. data leaving the system must have an accurate security label
A

C: B2 is the level which requires restrictions against cover channels, not B1.

90
Q
  1. What level of Trusted Computer System Evaluation Criteria (TCSEC) certification has a requirement of verified protection?a. C2b. B2c. B3d. A1
A

D: A1 TCSEC certification has a requirement of verified protection.

91
Q
  1. Which grade or level of the TCSEC requires mandatory protection mechanisms?a. Ab. Bc. Cd. D
A

B: Level B requires mandatory protection mechanisms.

92
Q
  1. Which of the following TCSEC classifications offers the highest level of security?a. C2b. B3c. A1d. D
A

C: The TCSEC label A1 offers the highest level of security.

93
Q
  1. Which of the following is not an element of the evaluation criteria of TCSEC?a. Security policy b. Subject identification mechanismsc. Continuous protectiond. System platform
A

D: The actual platform of the system is not an evaluation criteria of TCSEC. Any platform that can meet the security requirements can qualify.

94
Q
  1. The Trusted Network Interpretation (TNI), an extension of the orange book, can be found in what book?a. Red bookb. Blue bookc. Yellow bookd. Purple book
A

A: The Red book is the Trusted Network Interpretation (TNI).

95
Q
  1. What is the equivalent or comparable system security evaluation method to the TCSEC that is used primarily in Europe?a. Trusted Data Base Management System (TDI) b. Information Technology Security Evaluation Criteria (ITSEC)c. Common Criteria (CC)d. Trusted Network Interpretation (TNI)
A

B: The Information Technology Security Evaluation Criteria (ITSEC) is the TCSEC equivalent used in Europe.

96
Q
  1. Which of the following represents the highest possible guarantee of security? a. Trustb. Privacyc. Assuranced. Confidentiality
A

C: Assurance represents the highest guarantee of security.

97
Q
  1. The Trusted Computer System Evaluation Criteria (TCSEC) is published in a book with what color cover?a. Blueb. Redc. Yellowd. Orange
A

D: The Trusted Computer System Evaluation Criteria (TCSEC) is the orange book.

98
Q
  1. When a system is approved or verified to operate within a specific security mode, it is said to be?a. Certifiedb. Assuredc. Accredited d. Verified
A

C: When a system is approved or verified to operate within a specific security mode, it is said to be accredited.

99
Q
  1. What certification and accreditation process has been developed to be used in the private sector?a. DITSCAPb. NIACAPc. ITSECAPd. CIAP
A

D: CIAP or Commercial Information Security Analysis Process is a private sector certification and accreditation process.

100
Q
  1. Which of the following contains two types of covert channelsa. Storage and timingb. Memory and timingc. I/O and processingd. Device and protocol
A

A: The two types of covert channels are storage and timing.

101
Q
  1. The ITSEC classification uses different ratings than that of the TCSEC. What is the TCSEC equivalent of the ITSEC E4?a. B2b. C1c. A1d. B3
A

A: B2 it the TCSEC equivalent of ITSEC E4.

102
Q
  1. C2 is the lowest TCSEC classification that requires which of the following?a. No data remanenceb. Each object must be assigned a classification levelc. Prevention of covert channelsd. Distinct process isolation
A

A: C2 is the lowest TCSEC classification to require no data remanence.

103
Q
  1. Which of the following is not true regarding the orange book?a. Addressed only confidentiality b. Is a government/military specific evaluation methodc. Is applicable to networksd. Employs a few number of ratings and therefore has a restricted set of evaluation criteria
A

C: The TCSEC orange book only applies to stand-alone systems, not to networks.

104
Q
  1. What replaced TCSEC in Dec 2000?a. ITSECb. Common Criteriac. IEEE 1394d. DITSCAP
A

B: The Common Criteria (CC) replaced TCSEC.

105
Q
  1. Which of the following is not a classification level defined in the Red Book (Trusted Network Interpretation) (TNI)?a. No classification assignedb. C2c. B2d. A1
A

D: A1 is not a classification defined in the Red book.

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions