Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Security Architecture and Design > Flashcards

Security Architecture and Design Flashcards

1
Q 
A holistic lifecycle for developing security architecture that begins with assessing business requirements and subsequently creating a chain of traceability through phases of strategy, concept, design, implementation and metrics is characteristic of which of the following frameworks?
A. Zachman
B. SABSA
C. ISO 27000
D. TOGAF
A

B. SABSA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q 
Which of the following component of ITIL's service portfolio primarily focused on translating designs into operational services through a project management standard?
A. service strategy
B. service design
C. service transition
D. service operations
A

C. service transition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following can best be used to capture detailed security requirements?
A. threat modeling, covert channels, data classification
B. data classification, risk assessments, covert channels
C. risk assessments, covert channels, and threat modeling
D. threat modeling, data classification, risk assessments

A

D. threat modeling, data classification, risk assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q 
Which of the following security standards is internationally recognized as the standards for sound security practices and is focused on the standardization and certification of an organization's information security management system?
A. ISO 15408
B. ISO 27001
C. ISO 9001
D. ISO 9146
A

B. ISO 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q 
Which of the following describes the rules that need to be implemented to ensure that the security requirement are met?
A. security kernel
B. security policy
C. security model
D. security reference monitor
A

B. security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q 
A two dimensional grouping of individual subjects into groups or roles and granting access to groups to objects is an example of which of the following types of models?
A. multilevel lattice
B. state machine
C. non-interference
D. matrix based
A

D. matrix based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q 
Which of the following models ensures that a subject with a clearance level of secret has the ability to write only to objects classified as secret or top secret but is prevent from writing information classified as public?
A. Biba-integrity
B. clark-wilson
C. brewer-nash
D. bell-lapadula
A

D. bell-lapadula

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q 
Which of the following is unique to the biba-integrity model?
A. simple property
B. star property
C. invocation property
D. Strong star property
A

C. invocation property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q 
Which of the following models is best considered in a shared data hosting environment so that the data of one customer is not disclosed to a competitor or other customers sharing that hosted environment?
A. brewer-nash
B. clark-wilson
C. bell-lapadula
D. lipner
A

A. brewer-nash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q 
Which of the following security models is primarily concerned with how the subjects and objects are created and how subjects are assigned rights or privileges?
A. bell-lapdula
B. biba-integrity
C. chinese wall
D. graham-denning
A

D. graham-denning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q 
Which of the following ISO standards provides the evaluation criteria that can be used to evaluate security requirements of different products with different functions?
A. 15408
B. 27000
C. 9100
D. 27002
A

A. 15408

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q 
In the common criteria, the common set of functional and assurance requirements for a category of vendor products deployed in a particular type of environment are known as
A. protection profiles
B. security target
C. trusted computing base
D. ring protection
A

A. protection profiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q 
Which of the following evaluation assurance level that is formally verified, designed and tested is expected for a high risk situation?
A. EAL 1
B. EAL 3
C. EAL 5
D. EAL 7
A

D. EAL 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q 
Formal acceptance of an evaluated system by management is known as
A. certification
B. accreditation
C. validation
D. verification
A

B. accreditation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q 
Which stage of the capability maturity model is characterized by having organizational processes that are proactive?
A. initial
B. managed
C. defined
D. optimizing
A

C. defined

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q 
Which of the following best provides a method of quantifying risks associated with information technology when validating the abilities of new security controls and countermeasures to address the identified risks?
A. threat/risk assessment
B. penetration testing
C. vulnerability assessment
D. data classification
A

A. threat/risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q 
The use of proxies to protect more trusted assets from less sensitive ones is an example of which of the following types of security services?
A. access control
B. boundary control
C. integrity
D. audit and monitoring
A

B. boundary control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following is the main reason for security concerns in mobile computing devices?
A. the 3G protocol is inherently insecure
B. lower processing power
C. hackers are targeting mobile computing devices
D. lack of anti-virus software

A

B. lower processing power

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In decentralized environments device drivers that enable the OS to control and communicate with hardware need to be securely designed, developed and deployed because they are
A. typically installed by end users and granted access to the supervisor state
B. typically installed by administrators and granted access to user mode state
C. typically installed by software without human interaction
D. integrated as part of the operating system

A

A. typically installed by end users and granted access to the supervisor state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q 
A system administrator grants rights to a group of individuals called accounting instead of granting rights to each individual.  This is an example of which of the following security mechanisms?
A. layering
B. data hiding
C. cryptographic protections
D. abstraction
A

D. abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q 
Which of the following are the evaluation criteria most in use today for rating IDS systems?
A. ITSEC
B. Common Criteria
C. Red Book
D. Orange Book
A

B. Common Criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the subject of the Red Book?

A

security evaluation for networks and network components

23
Q

What is the subject of the Orange Book?

A

security requirements for operating systems

24
Q

Certain types of attacks have been made more potent by which of the following advances to microprocessor technology?
A. Increased circuits, cache memory, and multiprogramming.
B. Dual mode computing
C. Direct memory access I/O
D. Increases in processing power

A

D. Increases in processing power

25
Q

CPUs and operating systems can work in two main types of multitasking modes. What controls access and the use of system resources in preemptive multitasking mode?
A. The user and application
B. The program that is loaded into memory
C. The operating system
D. The CPU and user

A

C. The operating system

26
Q

Virtual storage combines RAM and secondary storage for system memory. Which of the following is a security concern pertaining to virtual storage?
A. More than one process uses the same resource
B. It allows cookies to remain persistent in memory
C. It allows for side-channel attacks to take place
D. Two processes can carry out a denial of service

A

A. More than one process uses the same resource

27
Q 
Which of the following is a common association of the Clark-Wilson access model?
A. Chinese Wall
B. Access tuple
C. Read up and write down rule
D. Subject and application binding
A

D. Subject and application binding

aka: access triple

28
Q

What is access triple?

A

user, program, object

A user can’t access an object without going through a program. Part of the Clark-Wilson model.

29
Q

What data access model do the Bell-LaPadula and Biba models use?

A

read up, write down

30
Q

Which of the following correctly describes the relationship between the reference monitor and the security kernel?
A. The security kernel implements and enforces the reference monitor.
B. The reference monitor is the core of the trusted computing base, which is made up of the security kernel.
C. The reference monitor implements and enforces the security kernel.
D. The security kernel, aka abstract machine, implements the reference monitor concept.

A

A. The security kernel implements and enforces the reference monitor.

31
Q

What is the core of the trusted computing base?

A

security kernel

32
Q

What is another name for reference monitor?

A

abstract machine

33
Q

What is another name for abstract machine?

A

reference monitor

34
Q 
The trusted computing base ensures security within a system when a process in one domain must access another domain in order to retrieve sensitive information.  What function does the TCB initiate to ensure that this is done in a secure manner?
A. I/O operation execution
B. Process deactivation
C. Execution domain switching
D. Virtual memory to real memory mapping
A

C. Execution domain switching

35
Q

The Zachman architecture framework is often used to set up an enterprise security architecture. Which of the following does not correctly describe the Zachman Framework?
A. A two dimensional model that uses communication interrogatives intersecting with different levels.
B. A security oriented model that gives instructions in a modular fashion.
C. Used to build a robust enterprise architecture versus a technical security architecture.
D. Uses six perspectives to describe a holistic information infrastructure

A

B. A security oriented model that gives instructions in a modular fashion.

36
Q

Describe elements of the Zachman Framework

A

two dimensional model that addresses the what, how, where, who, when, and why from 6 different perspectives.
Used for enterprise architecture not security

37
Q

John has been told to report to the board of directors with a vendor neutral enterprise architecture framework that will help the company reduce fragmentation that results from the misalignment of IT and business processes. Which of the following frameworks should he suggest?
A. DoDAF (Department of Defense Architecture Framework)
B. CMMI (Capability Maturity Model Integration)
C. ISO/IEC 42010
D. TOGAF (The Open Group Architecture Framework

A

D. TOGAF (The Open Group Architecture Framework

38
Q

What is ISO/IEC 42010?

A

recommended practices intended to simplify the design and conception of software intensive architectures.

39
Q 
Protection profiles used in the Common Criteria evaluation process contain five elements.  Which of the following establishes the type and intensity of the evaluation?
A. Descriptive elements
B. Evaluation assurance requirements
C. Evaluation assurance level
D. Security target
A

B. Evaluation assurance requirements

40
Q

Which of the following best defines a virtual machine?
A. A virtual instance of an operating system
B. A piece of hardware that runs multiple operating systems environments simultaneously.
C. A physical environment for multiple guests
D. An environment that can be fully utilized while running legacy applications.

A

A. A virtual instance of an operating system

41
Q 
Bethany is working on a mandatory access control system.  She has been working on a file classified as secret.  She can no longer access this file because it has been reclassified as Top Secret.  She deduces that the project she was working on has just increased in confidentiality and she knows more about this project than her clearance and need to know allows.  Which of the following refers to a concept that attempts to prevent this type of scenario from occurring?
A. Covert storage channel
B. Inference attack
C. Noninterference
D. Aggregation
A

C. Noninterference

42
Q

Virtualization offers many benefits. Which of the following incorrectly describes virtualization?
A. Virtualization simplifies operating system patching
B. Virtualization can be used to build a secure computing environment
C. Virtualization can provide fault and error containment
D. Virtual machines offer powerful debugging capabilities

A

A. Virtualization simplifies operating system patching

43
Q 
Which security architecture model defines how to securely develop access rights between subjects and objects?
A. Brewer-Nash
B. Clark-Wilson
C. Graham-Denning
D. Bell-LaPadula
A

C. Graham-Denning

44
Q

What is the Brewer-Nash model?

A

Intended to provide access controls that can change dynamically depending on a user’s previous actions.

Protect against conflicts of interest

45
Q

What is the Clark-Wilson model?

A

Intended to protect the integrity of data and ensure that properly formatted transactions take place within applications.

46
Q

What is the Bell-LaPadula model?

A

Intended to address the US military’s concern with the security of its systems and the leakage of classified information.

47
Q 
Operating systems can be programmed to carry out different methods for process isolation.  Which of the following refers to a method in which an interface defines how communication can take place between two processes and no process can interact with the other's internal programming code?
A. Virtual mapping
B. Encapsulation of objects
C. Time multiplexing
D. Naming distinctions
A

B. Encapsulation of objects

48
Q

Which of the following is not a responsibility of the memory manager?
A. Use complex controls to ensure integrity and confidentiality when processes need to use the same shared memory segments.
B. Limit processes to interact only with the memory segments assigned to them.
C. Swap contents from RAM to the hard drive as needed.
D. Run an algorithm to identify unused committed memory and inform the operating system that the memory is available.

A

D. Run an algorithm to identify unused committed memory and inform the operating system that the memory is available.

49
Q

What is the function of the garbage collector?

A

Run an algorithm to identify unused committed memory and inform the operating system that the memory is available.

50
Q

Several types of read only memory devices can be modified after they are manufactured. Which of the following statements correctly describes the differences between two types of ROM?
A. PROM can only be programmed once, while EEPROM can be programmed many times.
B. A UV light is used to erase data on EEPROM, while onboard programming circuitry and signals erase data on EPROM.
C. The process used to delete data on PROM erases one byte at a time, while to erase data on an EPROM chip, you must remove it from the hardware.
D. The voltage used to write bits into the memory cells of EPROM burns out the fuses that connect individual memory cells, while UV light is used to write the memory cells of PROM.

A

A. PROM can only be programmed once, while EEPROM can be programmed many times.

51
Q 
The Information Technology Infrastructure Library consists of 5 sets of instructional books.  Which of the following is considered the core set and focuses on the overall planning of the intended IT services?
A. Service Operation
B. Service Design
C. Service Transition
D. Service Strategy
A

D. Service Strategy

52
Q 
Widgets Inc's software development processes are documented and the organization is capable of producing its own standard of software processes.  Which of the following Capability Maturity Model Integration levels best describes Widgets Inc?
A. Initial
B. Repeatable
C. Defined
D. Managed
A

C. Defined

53
Q

What are the 5 levels of CMMI?

A 
Initial
Repeatable
Defined
Managed
Optimized

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions