Quiz 3

Question 1

An object is said to have security clearance of a given level; whereas a subject is said to have a security classification of a given level

a) True
b) False

Answer 1

b) False

Question 2

The Chinese Wall Model (CWM) incorporates both discretionary and mandatory access concepts

a) True
b) False

Answer 2

a) True

Question 3

Kernel Mode allows privileged instructions to be executed and privileged areas of memory to be accessed

a) True
b) False

Answer 3

a) True

Question 4

Well-Formed Transactions are when users can manipulate the data arbitrarily to be able to complete transactions.

a) True
b) False

Answer 4

b) False

Question 5

One strength of the attribute-based access control (ABAC) model is the improved performance when evaluating predicates on both resource and user properties for each access.

a) True
b) False

Answer 5

b) False

Question 6

Row-level granularity for database security does not cause any problems with inference from the data returned by the query in question.

a) True
b) False

Answer 6

a) True

Question 7

ACL is per object, whereas a capability list is per user.

a) True
b) False

Answer 7

a) True

Question 8

A multilevel secure system for confidentiality must enforce No write up and No read down.

a) True
b) False

Answer 8

b) False

Question 9

The BLP (Bell-LaPadula) model was developed as a formal model for access control.

a) True
b) False

Answer 9

a) True

Question 10

The term identity federation is used to describe the technology, standards, policies, and processes that allow an organization to trust digital identities, identity attributes, and credentials created and issued by another organization.

a) True
b) False

Answer 10

a) True

Question 11

In Access Management, this element determines what is allowable and unallowable in an access transaction.

a) Resource Management
b) Privilege Management
c) Policy Management
d) All of the above
e) None of the above

Answer 11

c) Policy Management

Question 12

In the Attribute-Based Access Control (ABAC) model, entities such as files, tables, programs, and networks are considered:

a) Subjects
b) Objects
c) Environments
d) All of the above
e) None of the above

Answer 12

b) Objects

Question 13

In the Traditional UNIX approach (minimal access control list), the filesystem uses these classes for File Access Control.

a) Owner Class
b) Group Class
c) Other Class
d) All of the above
e) None of the above

Answer 13

d) All of the above

Question 14

The Bell-Lapadula model considers which of the following access modes:

a) Modify
b) Observer
c) Execute
d) Invoke
e) All of the above
f) None of the above

Answer 14

f) None of the above

Question 15

Which of the following is not a functional component of a trusted platform module (TPM).

a) Execution engine
b) Nonvolatile memory
c) Key generation
d) Powerline modulator
e) Opt-in

Answer 15

d) Powerline modulator

Question 16

Which of the following are NOT properties of the reference monitor?

a) Verifiability
b) Confidentiality
c) Complete Mediation
d) Isolation
e) All of the above
f) None of the Above

Answer 16

b) Confidentiality -> Pg. 457

Question 17

Which of the following is a benefit of Role-Based Access Control (RBAC)?

a) Rights are granted on the user level, allowing granular access control
b) A user is strictly allowed one role, making it easy to manage and prevent users from receiving unauthorized roles
c) Policies do not need to be updated when users leave an organization
d) Unauthorized users cannot gain access to the system because users are not allowed to authenticate themselves

Answer 17

c) Policies do not need to be updated when users leave an organization

Question 18

In Role-Based Access Control, what is the relationship of roles to resources?

a) One to one
b) One to many
c) Many to one
d) Many to many

Answer 18

d) Many to many -> Pg. 128

Question 19

In Role Based Access Control, setting a maximum number of users that can be assigned to a given role is an example of :

a) Sessions
b) Cardinality
c) Prequesite Roles
d) Mutually Exclusive Roles
e) All of the above
f) None of the above

Answer 19

b) Cardinality -> Pg. 133

Question 20

A ____ model controls access based on the identity of the requester and on access rules stating what requester’s are (or are not) allowed to do.

a) Mandatory access control
b) Role-based access control
c) Discretionary access control
d) Attribute-based access control
None of the above

Answer 20

c) Discretionary access control -> Pg. 116