Chapter 8

Question 1

What type of exception handling technique tries handle errors in an application?

Answer 1

Try…Catch

Question 2

What term describes where a system is allowed to continue operations after a component fails.

Answer 2

Fail-Soft

Question 3

What term describes that when a system fails, it will revert to a state that protects the health and safety of people.

Answer 3

Fail-Safe

Question 4

What term describes prioritizing the physical security of assets over anything else ?

Answer 4

Fail-Secure

Question 5

What describes allowing a process to read from and write only to certain memory locations?

Answer 5

Confinement/Sandboxing

Question 6

What is responsible for ensuring a system behaves properly and is the combination of hardware, software, and components that work together to enforce security policies.

Answer 6

TCB

Question 7

What is a channel that allows communication between the TCB and system without exposing the TCB to Security exploitations.

Answer 7

Trusted Paths

Question 8

What allows a subject from being able to break out of isolation to affect the TCB and allows a subject to perform command line ops without risk to the TCB.

Answer 8

Trusted Shell

Question 9

What describes a system that is always secure no matter what state it’s in ?

Answer 9

State Machine Model

Question 10

What is a table of subjects and objects that indicates the actions that each subject can perform on each object.

Answer 10

ACM

Question 11

What Bell-LaPadula property states that a subject may not read information at a higher security level ?

Answer 11

Simple Security Property

Question 12

What Bell-LaPadula property states that a subject may not write information to an object at a lower level ?

Answer 12

Star Security Property

Question 13

What Bell-LaPadula property states that the system uses an access matrix to enforce discretionary access controls?

Answer 13

Discretionary Security Property

Question 14

What model is based on the information flow model and focuses on integrity.

Answer 14

Biba Model

Question 15

What Biba model property states that a subject cannot read an object at a lower security level ?

Answer 15

Simple Security Property

Question 16

What Biba model property states that a subject cannot modify an object at a higher security level ?

Answer 16

Star Security Model

Question 17

What model focuses on integrity and uses a three part relationship of subject/programs/objects?

Answer 17

Clark-Wilson Model

Question 18

What model applies to a single integrated database, and creates security domains that are sensitive to the notion of conflict of interest ?

Answer 18

Brewer and Nash Model

Question 19

What model permits access controls to change dynamically based on the user’s previous activity ?

Answer 19

Brewer and Nash Model

Question 20

What model is where subjects are allowed to only perform predetermined actions against predetermined objects?

Answer 20

Goguen–Meseguer Model

Question 21

What model is based on automation theory and domain separation ?

Answer 21

Goguen–Meseguer Model

Question 22

What model is based on the idea of defining a set of system states, initial states, and state transitions?

Answer 22

Sutherland Model

Question 23

What model is focused on the secure creation and deletion of both subjects and objects?

Answer 23

Graham-Denning Model

Question 24

What model is an extension of the Graham-Denning model?

Answer 24

HRU Model

Question 25

What focuses on the assignment of object access rights to subjects as well as the resilience of those assigned rights?

Answer 25

HRU Model

Question 26

What are the two key elements of the common criteria?

Answer 26

Protection Profiles
Security Targets

Question 27

What element of the common criteria specified the “I Want” from a customer ?

Answer 27

Protection Profiles

Question 28

What element of the common criteria specifies the “I Will” from the vendor ?

Answer 28

Security Targets

Question 29

What EAL level is when some confidence in correct operation is required but where threats to security is not serious ?

Answer 29

EAL1 / Functionally Tested

Question 30

What EAL level is when delivery of design information and test results are in keeping with good commercial practices.

Answer 30

EAL 2 / Structurally Tested

Question 31

What EAL level is when security engineering begins at the design stage and is carried through without substantial subsequent alteration.

Answer 31

EAL 3 / Methodically Tested and Checked

Question 32

What EAL level is when rigorous positive security engineering and good commercial development practices are used ?

Answer 32

EAL 4 / Methodically Designed, Tested, and Reviewed

Question 33

What EAL level uses rigorous security engineering and commercial development practices, including specialist security engineering techniques, for semi-formal testing.

Answer 33

EAL 5 / Semi-Formally Designed and Tested

Question 34

What EAL level uses direct, rigorous security engineering techniques at all phases of design, development, and testing to produce a premium TOE.

Answer 34

EAL 6 / Semi-Formally Verified, Designed, and Tested

Question 35

What EAL level is used only for highest-risk situations or where high value assets are involved?

Answer 35

EAL 7 / Formally Verified, Designed, and Tested

Question 36

What authorization decision does an AO give when a security control is inherited from another provider?

Answer 36

Common Control Authorization

Question 37

What authorization does an AO give when a third-party provider provides an IT/IS servers that are deemed to have risk at an acceptable level ?

Answer 37

Authorization to Use