CISSP Domain 3: Common Criteria

Question 1

What does Common Criteria (CC) define?

Answer 1

various levels of testing and confirmation of system’s security capabilities

Question 2

What does the number of the level of CC define?

Answer 2

indicates what kind of testing and confirmation has been performed

Question 3

What are the objectives of the CC guidelines?

Answer 3

• add to buyers’ confidence in the security of evaluated, rated IT products
• eliminate duplicate evaluations (if one country follows CC, same evaluations don’t need to be performed elsewhere)
• to keep making security evaluations more cost-effective and efficient
• to make sure evaluation of IT products adhere to high and consistent standards
• to promote evaluation and increse availability of evaluated IT products
• evaluate the functionality and assurance of the target of evaluation

Question 4

Name each level and assurance level

Answer 4

• EAL 1, Functionality Tested
• EAL 2, Structually Tested
• EAL 3, Methodically Tested and Checked
• EAL 4, Methodically Designed, Tested, and Reviewed
• EAL 5, Semi-formally Designed and Tested
• EAL 6, Semi-formally Verified, Designed and Tested
• EAL 7, Formally Verified, Designed, and Tested