Security Architecture and Design Flashcards
Which database security risk occurs when data from a higher classification level is mixed with data from a lower classification level? A) Aggregation B) Inference C) Contamination D) Polyinstantiation
Contamination
Contamination is the mixing of data from a higher classification level and/or need-to-know requirement with data from a lower classification level and/or need-to-know requirement.
What is a security perimeter? (Choose all that apply.)
A) The boundary of the physically secure area surrounding your system
B) The imaginary boundary that separates the TCB from the rest of the system
C) The network where your firewall resides
D) Any connections to your computer system
The boundary of the physically secure area surrounding your system
The imaginary boundary that separates the TCB from the rest of the system
Although the most correct answer in the context of this chapter is option B, option A is also a correct answer in the context of physical security.
How many major categories do the TCSEC criteria define? A) Two B) Three C) Four D) Five
Four
TCSEC defines four major categories: category A is verified protection, category B is mandatory protection, category C is discretionary protection, and category D is minimal protection.
Which Bell-LaPadula property keeps lower-level subjects from accessing objects with a higher security level? A) (star) Security Property B) No write up property C) No read up property D) No read down property
No read up property
The no read up property, also called the Simple Security Policy, prohibits subjects from reading a higher security level object.
What is the most commonly used technique to protect against virus attacks? A) Signature detection B) Heuristic detection C) Data integrity assurance D) Automated reconstruction
Signature detection
Signature detection mechanisms use known descriptions of viruses to identify malicious code resident on a system.
In which of the following security modes can you be assured that all users have access permissions for all information processed by the system but will not necessarily need to know of all that information? A) Dedicated B) System high C) Compartmented D) Multilevel
System high
In system high mode, all users have appropriate clearances and access permissions for all information processed by the system but need to know only some of the information processed by that system.
What is a trusted computing base (TCB)?
A) Hosts on your network that support secure transmissions
B) The operating system kernel and device drivers
C) The combination of hardware, software, and controls that work together to enforce a security policy
D) The software and controls that certify a security policy
The combination of hardware, software, and controls that work together to enforce a security policy
The TCB is the combination of hardware, software, and controls that work together to enforce a security policy.
Which one of the following storage devices is most likely to require encryption technology in order to maintain data security in a networked environment? A) Hard disk B) Backup tape C) Removable drives D) RAM
Removable drives
Removable drives are easily taken out of their authorized physical location, and it is often not possible to apply operating system access controls to them. Therefore, encryption is often the only security measure short of physical security that can be afforded to them. Backup tapes are most often well controlled through physical security measures. Hard disks and RAM chips are often secured through operating system access controls.
What advanced virus technique modifies the malicious code of a virus on each system it infects? A) Polymorphism B) Stealth C) Encryption D) Multipartitism
Polymorphism
In an attempt to avoid detection by signature-based antivirus software packages, polymorphic viruses modify their own code each time they infect a system.
Which one of the following types of memory might retain information after being removed from a computer and, therefore, represent a security risk? A) Static RAM B) Dynamic RAM C) Secondary memory D) Real memory
Secondary memory
Secondary memory is a term used to describe magnetic and optical media. These devices will retain their contents after being removed from the computer and may later be read by another user.
Many PC operating systems provide functionality that enables them to support the simultaneous execution of multiple applications on single-processor systems. What term is used to describe this capability? A) Multiprogramming B) Multithreading C) Multitasking D) Multiprocessing
Multitasking
Multitasking is processing more than one task at the same time. In most cases, multitasking is actually simulated by the operating system even when not supported by the processor.
What is system certification?
A) Formal acceptance of a stated system configuration
B) A technical evaluation of each part of a computer system to assess its compliance with security standards
C) A functional evaluation of the manufacturer’s goals for each hardware and software component to meet integration standards
D) A manufacturer’s certificate stating that all components were installed and configured correctly
A technical evaluation of each part of a computer system to assess its compliance with security standards
A system certification is a technical evaluation. The other options describe system accreditation and manufacturer standards, not implementation standards.
Which one of the following passwords is least likely to be compromised during a dictionary attack? A) mike B) elppa C) dayorange D) fsasoalg
fsasoalg
Except fsasoalg, the choices are forms of common words that might be found during a dictionary attack. Mike is a name and would be easily detected. Elppa is simply apple spelled backwards, and dayorange combines two dictionary words. Crack and other utilities can easily see through these “sneaky” techniques. Fsasoalg is simply a random string of characters that a dictionary attack would not uncover.
Which one of the following tools provides a solution to the problem of users forgetting complex passwords? A) LastPass B) Crack C) Shadow password files D) Tripwire
LastPass
LastPass is a tool that allows users to create unique, strong passwords for each service they use without the burden of memorizing them all.
What file is instrumental in preventing dictionary attacks against UNIX systems? A) /etc/passwd B) /etc/shadow C) /etc/security D) /etc/pwlog
/etc/shadow
Shadow password files move encrypted password information from the publicly readable /etc/passwd file to the protected /etc/shadow file.
When designing firewall rules to prevent IP spoofing, which of the following principles should you follow?
A) Packets with internal source IP addresses don’t enter the network from the outside.
B) Packets with internal source IP addresses don’t exit the network from the inside.
C) Packets with public IP addresses don’t pass through the router in either direction.
D) Packets with external source IP addresses don’t enter the network from the outside.
Packets with internal source IP addresses don’t enter the network from the outside.
Packets with internal source IP addresses should not be allowed to enter the network from the outside because they are likely spoofed.
What is a security control?
A) A security component that stores attributes that describe an object
B) A document that lists all data classification types
C) A list of valid access rules
D) A mechanism that limits access to an object
A mechanism that limits access to an object
A control limits access to an object to protect it from misuse by unauthorized users.
Which one of the following is a layer of the ring protection scheme that is not normally implemented in practice? A) Layer 0 B) Layer 1 C) Layer 3 D) Layer 4
Layer 1
Layers 1 and 2 contain device drivers but are not normally implemented in practice. Layer 0 always contains the security kernel. Layer 3 contains user applications. Layer 4 does not exist.
Tom built a database table consisting of the names, telephone numbers, and customer IDs for his business. The table contains information on 30 customers. What is the degree of this table? A) Two B) Three C) Thirty D) Undefined
Three
The cardinality of a table refers to the number of rows in the table while the degree of a table is the number of columns.
What database technique can be used to prevent unauthorized users from determining classified information by noticing the absence of information normally available to them? A) Inference B) Manipulation C) Polyinstantiation D) Aggregation
Polyinstantiation
Polyinstantiation allows the insertion of multiple records that appear to have the same primary key values into a database at different classification levels.
For what type of information system security accreditation are the applications and systems at a specific, self contained location evaluated? A) System accreditation B) Site accreditation C) Application accreditation D) Type accreditation
Site accreditation
The applications and systems at a specific, self-contained location are evaluated for DITSCAP and NIACAP site accreditation.
What type of memory chip allows the end user to write information to the memory only one time and then preserves that information indefinitely without the possibility of erasure? A) ROM B) PROM C) EPROM D) EEPROM
PROM
Programmable read-only memory (PROM) chips may be written to once by the end user but may never be erased. The contents of ROM chips are burned in at the factory, and the end user is not allowed to write data. EPROM and EEPROM chips both make provisions for the end user to somehow erase the contents of the memory device and rewrite new data to the chip.
Which security principle mandates that only a minimum number of operating system processes should run in supervisory mode? A) Abstraction B) Layering C) Data hiding D) Least privilege
Least privilege
The principle of least privilege states that only processes that absolutely need kernel-level access should run in supervisory mode. The remaining processes should run in user mode to reduce the number of potential security vulnerabilities.
What term describes the processor mode used to run the system tools used by administrators seeking to make configuration changes to a machine? A) User mode B) Supervisory mode C) Kernel mode D) Privileged mode
User mode
All user applications, regardless of the security permissions assigned to the user, execute in user mode. Supervisory mode, kernel mode, and privileged mode are all terms that describe the mode used by the processor to execute instructions that originate from the operating system.
What is system accreditation?
A) Formal acceptance of a stated system configuration
B) A functional evaluation of the manufacturer’s goals for each hardware and software component to meet integration standards
C) Acceptance of test results that prove the computer system enforces the security policy
D) The process to specify secure communication between machines
Formal acceptance of a stated system configuration
Accreditation is the formal acceptance process. A functional evaluation of the manufacturer’s goals is not an appropriate answer because it addresses manufacturer standards. The other options are incorrect because there is no way to prove that a configuration enforces a security policy and accreditation does not entail secure communication specification.
