Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Security Architecture & Design > Flashcards

Security Architecture & Design Flashcards

1
Q

What are the 9 main components of the CPU?

A 
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q 
Which component of the CPU performs numerical calculations?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Arithmetic Logic Unit (ALU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q 
Which component of the CPU supervises data transfers over the bus system between the CPU and I/O devices?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Bus Interface Unit (BIU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q 
Which component of the CPU coordinates other CPU components during program execution?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Control Unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q 
Which component of the CPU converts incoming instructions into individual commands?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Decode Unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q 
Which component of the CPU handles higher math operations for the ALU and control unit?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Floating Point Unit (FPU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q 
Which component of the CPU handles addressing and cataloguing data that's stored in memory and translates logical addressing into physical addressing?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Memory Management Unit (MMU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q 
Which component of the CPU monitors all CPU functions to ensure they are properly executed?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Protection Test Unit (PTU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q 
Which component of the CPU hold CPU data, addresses and instructions temporarily, in special buffers?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Registers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q 
Which component of the CPU pre-loads instructions into CPU registers?
Arithmetic Logic Unit (ALU)
Bus Interface Unit (BIU)
Control Unit
Decode Unit
Floating Point Unit (FPU)
Memory Management Unit (MPU)
Pre-fetch Unit
Protection Test Unit (PTU)
Registers
A

Pre-fetch Unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The basic operation of a microprocessor consists of two distinct phases. What are they?

A

fetch and execute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Fetch and Execute are otherwise known as what in CPU terms?

A

Basic Machine Cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the basic machine cycle controlled by?

A

CPU Clock signals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 4 operating states for a computer CPU?

A
  • Operating (or run) state
  • Problem (or application) state
  • Supervisory state
  • Wait state
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

During which CPU state are only a limited subset of non privileged instructions available?

A

Problem (or application) state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When the CPU executes a privileged instruction, meaning that instruction is available to a system admin or authorised user/process only, what state is the CPU in?

A

Supervisory state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the two basic types of CPU designs?

A
  • Complex Instruction Set Computing (CISC)

- Reduced Instruction Set Computing (RISC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which CPU design can perform multiple operations per instruction and is optimised for systems in which the fetch phase is the longest part of the instruction execution cycle?

A
  • Complex Instruction Set Computing (CISC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which CPU design uses fewer, simpler instructions, requiring fewer clock cycles to execute and is optimised for systems in which the fetch and execute phases are approximately equal?

A
  • Reduced Instruction Set Computing (RISC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are two ways of describing a microprocessor?

A
  • Scalar

- Superscalar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the difference between scalar and superscalar

A

Scalar executes a single instruction at a time whereas superscalar can execute multiple instructions concurrently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which classification of processor can alternate the execution of multiple subprograms or tasks on a single processor?

  • Multitasking
  • Multiprogramming
  • Multiprocessing
A

Multitasking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which classification of processor alternates the execution of multiple programs on a single processor?

  • Multitasking
  • Multiprogramming
  • Multiprocessing
A

Multiprogramming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which classification of processor executes multiple programs on multiple processors simultaneously?

A

Multiprocessing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is “Multistate” in relation to a processor?

A

OS supports multiple operating states, ie Normal and Safe mode in Windows.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What term is used for an operating system that provides different shell environments, profiles or privilege levels for each user, e.g. “Run As” in Windows?

A

Multi-User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which piece of hardware groups electronic conductors that interconnect the various components of the computer?

A

Bus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the 3 bus structures?

A
  • Data Bus
  • Address Bus
  • Control Bus
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which bus structure transmits data between the CPU, memory and peripheral devices?

  • Data Bus
  • Address Bus
  • Control Bus
A
  • Data Bus
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which bus structure transmits addresses of data and instructions between the CPU and memory?

A
  • Address Bus
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which bus structure transmits control information (device status) between the CPU and other devices?

A
  • Control Bus
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which part of a computer stores programs, instructions and data?

A

Memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the two main types of physical (real) memory?

A

Random Access Memory (RAM)

Read Only Memory (ROM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the two main types of RAM?

A

Dynamic RAM

Static RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which type of RAM is faster and doesn’t need to be refreshed?
SRAM or DRAM?

A

SRAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Firmware typically uses which type of memory?

RAM or ROM?

A

ROM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

The term “Main Storage” and “Primary memory” relates to what?

A

Physical memory (normally RAM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are the 4 variations of ROM?

A
  • Programmable Read-Only memory (PROM)
  • Erasable PROM (EPROM)
  • Electonically EPROM (EEPROM)
  • Flash Memory
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which type of ROM cannot be re-written?

  • Programmable Read-Only memory (PROM)
  • Erasable PROM (EPROM)
  • Electonically EPROM (EEPROM)
  • Flash Memory
A

PROM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which type of ROM can be erased by shining UV light on the chip?

  • Programmable Read-Only memory (PROM)
  • Erasable PROM (EPROM)
  • Electonically EPROM (EEPROM)
  • Flash Memory
A
  • Erasable PROM (EPROM)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Dynamic storage on non-volatile magnetic media such as a hard disk is otherwise known as what?

A

Secondary memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

A paging file, swap space or swap partition is typically known as what type of memory?

A

Virtual memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are two important security concepts associated with memory?

A
  • the protection domain

- memory addressing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which security concept prevents other programs or processes from accessing or modifying the contents of address space that’s already been assigned to another active program or process?

A

the protection domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What security concept describes the method used by the CPU to access the contents of memory?

A
  • memory addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the difference between memory space and address space?

A

memory space describes the amount of physical memory in a computer system whereas address space specifies where memory is located in a computer system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is otherwise known as a hard coded address assigned to physically installed memory and can only be accessed by the OS that maps physical address to virtual addresses?

A

A physical memory address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is the term used to describe the address that applications use to specify a desired location in memory?

A

Virtual (or symbolic) memory address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the 5 common virtual memory addressing modes?

A
  • Base addressing
  • Absolute addressing
  • Indexed addressing
  • Indirect addressing
  • Direct addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which virtual memory address mode is the origin for calculating other addresses?

  • Base addressing
  • Absolute addressing
  • Indexed addressing
  • Indirect addressing
  • Direct addressing
A
  • Base addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Which virtual memory address mode identifies a location without reference to the base address, or it may be the base address itself?

  • Base addressing
  • Absolute addressing
  • Indexed addressing
  • Indirect addressing
  • Direct addressing
A
  • Absolute addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Which virtual memory address mode specifies an address relative to an index register? If the index register changes, the resulting memory location changes)

  • Base addressing
  • Absolute addressing
  • Indexed addressing
  • Indirect addressing
  • Direct addressing
A
  • Indexed addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Which virtual memory address mode contains the address to the final desired location in memory?

  • Base addressing
  • Absolute addressing
  • Indexed addressing
  • Indirect addressing
  • Direct addressing
A
  • Indirect addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Which virtual memory address mode specifies the address of the final desired memory location?

  • Base addressing
  • Absolute addressing
  • Indexed addressing
  • Indirect addressing
  • Direct addressing
A
  • Direct addressing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is the difference between virtual memory and virtual addressing?

A

virtual memory combines physical memory and hard disk space to create more apparent memory whereas virtual addressing is the method used by applications and programs to specify a desired location n physical memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is firmware?

A

A program or set of computer instructions stored in the physical circuitry of ROM memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

BIOS is a common example of firmware. True or False?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What does BIOS stand for?

A

Basic Input-Output System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What does a computer BIOS do?

A

Contains instructions needed to start a computer when it is first powered on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What are the 3 main components of an operating system?

A
  • Kernel
  • Device Drivers
  • Tools
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is the core component of an operating system, that allows processes, controls hardware devices and communication to external devices that may be connected to the computer?

A

Kernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What are the 6 main functions of the OS?

A
  • Process management
  • Resource Management
  • I/O device management
  • memory Management
  • File management
  • Communications Management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Virtualisation - What is a hypervisor?

A

software program that allocates resources for each resident OS and serves as an OS for multiple OS’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

The entire compliment of protection mechanisms within a computer system that’s responsible for enforcing a security policy (hardware, firmware, software) is otherwise known as what?

A

Trusted Computing Base (TCB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

The ability to permit or deny the use of an object by a subject is otherwise known as what?

A

Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What is the system component called that enforces access control on an object?

A

Reference Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is a security kernel?

A

It’s the combination of hardware, firmware, software elements in a TCB that implements the reference monitor concept

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What are the 3 requirements of the security kernel?

A
  • Mediate all access
  • Be protected from modification
  • Be verified as correct
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is the “Security Mode of Operation”?

A

describes how a system handles stored information at various classification levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What are the four system classification levels commonly assigned to authorised user’s by the US military?

A
  • Dedicated
  • System High
  • Multi-level
  • Limited access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Which of the following system classification levels requires that all authorised users have a clearance level equal to or higher than the highest level of information processed on the system and a valid need to know?

  • Dedicated
  • System High
  • Multi-level
  • Limited access
A
  • Dedicated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Which of the following system classification levels requires that all authorised user have a clearance level equal to or higher than the highest level of information processed on the system, but a valid need to know isn’t necessarily required?

  • Dedicated
  • System High
  • Multi-level
  • Limited access
A
  • System High
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Which of the following system classification levels is information at different classification levels stored or processed on a TCB and where authorised users must have an appropriate classification level, but access restrictions are enforced by the system accordingly?

  • Dedicated
  • System High
  • Multi-level
  • Limited access
A
  • Multi-level
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Which of the following system classification levels doesn’t require authorised user’s to have security clearance , but the highest level of information on the system is Sensitive But Unclassified? (SBU)

  • Dedicated
  • System High
  • Multi-level
  • Limited access
A
  • Limited Access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

A Trusted Computer System is a system with a Trusted Computer Base. True or False?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What are the four types of security designs that can protect a system during hardware/software failure?

A
  • Fault tolerant
  • Fail-safe
  • Fail-soft (resilient)
  • Fail-over
77
Q

Which of the four recovery procedures is used were the system continues to operate after the failure of a computer or network component?

  • Fault tolerant
  • Fail-safe
  • Fail-soft (resilient)
  • Fail-over
A
  • Fault tolerant
78
Q

Which of the four recovery procedures describes when a hardware or software failure is detected, a program execution is terminated and the system is protected from compromise?

  • Fault tolerant
  • Fail-safe
  • Fail-soft (resilient)
  • Fail-over
A

Fail-safe

79
Q

Which of the four recovery procedures desribes when a hardware or software failure is detected, certain non-critical processing is terminated and the computer or network continues to function in a degraded mode?

  • Fault tolerant
  • Fail-safe
  • Fail-soft (resilient)
  • Fail-over
A

Fail-soft (resilient)

80
Q

Which of the four recovery procedures describes when a hardware or software failure is detected, the system automatically transfers processing to a component, such as a clustered server?

  • Fault tolerant
  • Fail-safe
  • Fail-soft (resilient)
  • Fail-over
A

Fail-over

81
Q

Which recovery procedure is used where a system must be able to detect & correct or circumvent a system fault?

  • Fault tolerant
  • Fail-safe
  • Fail-soft (resilient)
  • Fail-over
A

Fault tolerant

82
Q

Name 5 common types of security architecture vulnerabilities?

A
  • Covert channels
  • Rootkits
  • Race conditions
  • State attacks
  • Emanations
83
Q

Security Architecture Vulnerabilities: What is a covert channel?

A

Unknown, hidden communication that take place within the medium of a legitimate communications channel

84
Q

Security Architecture Vulnerabilities: What is a rootkit?

A

Rootkits use various techniques to hide themselves within the target system

85
Q

Security Architecture Vulnerabilities: What are race conditions?

A

A flaw in the system where the output or result of an activity in the system is unexpectedly tied to the timing of other events.

86
Q

Security Architecture Vulnerabilities: What is a state attack?

A

Commonly used on web-based applications that involves an attacker stealing a user’s session ID and thus compromising the application.

87
Q

Security Architecture Vulnerabilities: What are emanations?

A

The unintentional emissions of electromagnetic or acoustic energy that can be intercepted by eavesdroppers.

88
Q

In relation to race conditions, what is the-time-of-check-to-time-of-use bug?

A

Two programs that try to open the same file for exclusive use are able to open the file, when only one should be able to.

89
Q

What term is used to describe multiple layers of protection?

A

Defence in depth

90
Q

Name 6 common types of system hardening:

A
  • Remove all unnecessary components
  • Remove all unnecessary accounts
  • Close all unnecessary network listening ports
  • Change default passwords
  • All necessary programs should run at the lowest possible privilege
  • Install security patches
91
Q

What is a heterogeneous environment?

A

An environment that contains a variety of different systems, ie Windows Server, Linux, Solaris

92
Q

What is the advantage of a heterogeneous environment?

A

various types of systems may not possess common vulnerabilities making them harder to attack

93
Q

What is a homogeneous environment?

A

one were all of the environments are the same. ie all servers on Windows Server 2008

94
Q

What is the disadvantage of a homogeneous environment?

A

weakness in one system could mean weakness in all meaning if one is compromised so could all

95
Q

What are two types of system resilience?

A
  • Filter malicious input

- Redundant components

96
Q

What is “Filter malicious input” in relation to system resilience?

A

System can recognise and reject input that may be an attack

97
Q

What are redundant components in relation to system resilience?

A

System contains redundant components that permit the system to continue running even when hardware failures or malfunctions occur

98
Q

Name 4 types of redundant components in relation to system resilience?

A
  • multiple power supplies
  • multiple network interfaces
  • redundant storage techniques (RAID)
  • redundant server architecture (clustering)
99
Q

What is a maintenance hook?

A

Hidden, undocumented features in software programs that are intended to inappropriately expose data or functions for illicit use.

100
Q

Name 4 common types of security countermeasures that a security expert should consider to implement against a hacker

A
  • Reveal as little info as possible, ie don’t display OS, database, app version.
  • Limit access based on role
  • Disable unnecessary services
  • Use strong authentication
101
Q

What is TEMPEST?

A

testing of electromagnetic frequencies emanating from systems

102
Q

TEMPEST: what are the 3 levels of protection depending on the distance between an attacker and target system?

A

Level 1 - Systems with only 1 metre of safe distance
Level 2 - Systems with 20 metres of safe distance
Level 3 - Systems with 100 metres of safe distance

103
Q

Bell LaPadula, Access Matrix and Take-Grant address which principle of CIA?

A

Confidentiality

104
Q

Biba and Clark-Wilson address which principle of CIA?

A

Integrity

105
Q

The basic premise of Bell LaPadula is that information cannot flow downward. True or False?

A

True

106
Q

What is the “Simple Security Property” (SS Property)

A

A subject can’t read information from an object that has a higher sensitivity label than the subject (also known as no read up or NRU)

107
Q

What is the *-property (star property)

A

A subject can’t write information to an object that has a lower sensitivity label than the subject. (also known as no write down or NWD)

108
Q

Is Bell LaPadula a discretionary or mandatory access control system?

A

Mandatory

109
Q

What two additional properties can provide Bell LaPadula with the flexibility of a discretionary access control system?

A
  • Discretionary Security Property

- Trusted Subject

110
Q

What is the discretionary security property in relation to Bell LaPadula?

A

determines access based on an access matrix

111
Q

What is a “trusted subject” in relation to Bell LaPadula?

A

A trusted subject is an entity that can violate the *-property but not its intent

112
Q

What access rights to an object does the Access Matrix model provide for a subject?

A

Read / Write / Execute (R/W/X)

113
Q

Is the Access Matrix model a discretionary or mandatory access model?

A

Discretionary

114
Q

What is the Take-Grant system?

A

specifies the rights that a subject can transfer to or from another subject or object

115
Q

Take-Grant specifies rights through 4 basic operations. What are they?

A

Create, Revoke, Take and Grant

116
Q

Which integrity is a lattice-based model and only address the first goal of integrity, ie ensuring that modifications to data aren’t made by unauthorised user’s or processes?

A

Biba

117
Q

What are the two properties of Biba?

A

Simple Integrity Property

*-integrity property (Star Integrity Property)

118
Q

In relation to Biba, what is the Simple Integrity Property?

A

A subject can’t read information from an object that has a lower integrity level than the subject. (otherwise known as no read down)

119
Q

In relation to Biba, what is the *-integrity property?

A

A subject can’t write information to an object that has a higher integrity level than the subject (otherwise known as no write up)

120
Q

Which integrity model meets the following criteria?

  • establishes a security framework for use in commercial activities, such as the banking industry
  • addresses all 3 goals of integrity
  • identifies special requirements for inputting data
A

Clark-Wilson

121
Q

The Clark-Wilson model specified which 4 requirements for inputting data?

A

Unconstrained Data Item (UDI)
Constrained Data Item (CDI)
Integrity Verification procedures (IVP)
Transformation Procedures (TP)

122
Q

What is Unconstrained Data Item (UDI)?

A

data outside the control area such as input data

123
Q

What is Constrained Data Item (CDI)?

A

Data inside the control area (integrity must be preserved)

124
Q

What are Integrity Verification Procedures (IVP) used for?

A

Checks validity of CDI’s

125
Q

What are Transformation Procedures (TP) used for?

A

Maintains integrity of CDI’s

126
Q

Which integrity model is based on the concept of a “well formed transaction”, in which a transaction is sufficiently ordered and controlled so that it maintains internal and external consistency?

A

Clark-Wilson

127
Q

Which Access Control model does the following describe?

  • based on flow of information rather than imposing access controls
  • uses a security policy to assign class, value and direction of flow from one application/system to another?
A

Information Flow Model

128
Q

Which type of access control model is useful for analysing covert channels, through detailed analysis of the flow of information in a system including the sources of information and paths of flow?

A

Information Flow Model

129
Q

Which Access Control Model ensures that the actions of different subjects and objects aren’t seen by (and don’t interfere with) other objects and subject on the same system?

A

Non-Interference Model

130
Q

the standard fr quantifying the security of a computer system or network is known as?

A

Evaluation Criteria

131
Q

What are the 4 common types of evaluation criteria?

A
  • Common Criteria
  • Trusted Computer System Evaluation Criteria (TCSEC)
  • Trusted Network Interpretation (TNI)
  • European Information Technology Security Evaluation Criteria (ITSEC)
132
Q

TCSEC is commonly known by which other name?

A

The Orange book

133
Q

Which Evaluation Criteria is the formal implementation of the Bell LaPadula model?

  • Common Criteria
  • Trusted Computer System Evaluation Criteria (TCSEC)
  • Trusted Network Interpretation (TNI)
  • European Information Technology Security Evaluation Criteria (ITSEC)
A

TCSEC

134
Q

What were the 3 objectives of TCSEC?

A
  • Measurement
  • Guidance
  • Acquisition
135
Q

In relation to TCSEC, which objective provides a metric for assessing comparative levels of trust between different computer systems?

  • Measurement
  • Guidance
  • Acquisition
A
  • Measurement
136
Q

In relation to TCSEC, which objective provides customers a standard for specifying acquisition requirements and identifying systems that meet those requirements?

  • Measurement
  • Guidance
  • Acquisition
A
  • Acquisition
137
Q

In relation to TCSEC, which objective identifies standard security requirements that vendors must build into systems to achieve a given trust level?

  • Measurement
  • Guidance
  • Acquisition
A

-Guidance

138
Q

What are the 4 basic control requirements identified in the Orange Book?

A
  • Security Policy
  • Assurance
  • Documentation
  • Accountability
139
Q

What are the 4 specific requirements of the TCSEC security policy?

A
  • Discretionary Access Control
  • Mandatory Access Control
  • Object Re-use
  • Labels
140
Q

What does Object Re-Use protect against in relation to TCSEC?

A

protects confidentiality of objects that are re-assigned after initial use and can define procedures for actually erasing the data.

141
Q

In which type of system are Labels required?

DAC or MAC systems?

A

MAC

142
Q

What are the 3 labelling requirements of TCSEC?

A

integrity
export
subject/object

143
Q

What is the difference between a “covert storage channel” and “covert timing channel”?

A
  • covert storage channel conveys information by altering stored system data
  • covert timing channel covey’s information by altering a system’s resources, performance or timing.
144
Q

What are the 9 operation assurance requirements in TCSEC?

A
  • System Architecture: system design that implements specific security features
  • System Integrity: hardware and firmware tested to verify proper operation
  • Covert Channel Analysis: detect unintended communication paths not protected by a systems normal security mechanisms
  • Trusted Facility: assignment of an admin for security functions of system
  • Trusted Recovery: Ensures that security isn’t compromised in the event of a system crash/failure
  • Security testing: Specifies required testing
  • Design specification and verification: requires mathematical and automated proof that design conforms with security policy
  • Configuration Management: recording of changes made to TCB during design, development, maintenance
  • Trusted Distribution: Protects system during transport from vendor to customer
145
Q

What are the 3 requirements of Accountability in relation to TCSEC?

A
  • Identification and Authentication
  • Trusted Path
  • Audit
146
Q

What is the Trusted Path in TCSEC?

A

A direct communications path between the user and TCB that doesn’t require interaction with untrusted applications or OS layers.

147
Q

What are the 4 TCSEC requirements for Documentation?

A
  • Security Features User Guide
  • Trusted Facility manual
  • Test documentation
  • Design documentation
148
Q

The Orange Book defines four major hierarchical classes of security protection and numbered sub-classes. (higher number means higher security) What are they?

A

D: Minimal Protection
C: Discretionary Protection (C1 and C2)
B: Mandatory Protection (B1, B2, and B3)
A: Verified Protection (A1)

149
Q

What is Class D: Minimal Protection used for?

A

Systems that fail evaluation

150
Q

What is the difference between Class 1 (Discretionary Protection) and Class 2 (Controlled Access Protection)?

A

In C1 a system doesn’t have to distinguish between individual users and types of access whereas C2 does

151
Q

B1 (Labelled Security Protection) has which requirement?

A

Sensitivity labels for all subjects and storage objects

152
Q

B2 (Structured protection) has which 2 requirements?

A

Sensitivity labels for all subjects and objects and trusted path requirements

153
Q

B3 (Security domains) has which requirement?

A

Access Control Lists and System must protect against covert channels

154
Q

Which Class, C1 or C2 requires “Object Re-use” features?

A

C2 (Controlled Access Protection)

155
Q

What are the 2 requirements of A1 (Verified Design)

A
  • Formal Top level specification required

- configuration management procedures must be enforced throughout entire system life cycle.

156
Q

What are the two requirements beyond the A1 class of protection for systems?

A
  • Self-protection and reference monitors implemented in TCB

- TCB verified to source code level

157
Q 
Which of the following are MAC systems?
D: Minimal Protection
C: Discretionary Protection (C1 and C2)
B: Mandatory Protection (B1, B2, and B3)
A: Verified Protection (A1)
A

B: Mandatory Protection (B1, B2, and B3)
A: Verified Protection (A1)

158
Q 
Which of the following are DAC systems?
D: Minimal Protection
C: Discretionary Protection (C1 and C2)
B: Mandatory Protection (B1, B2, and B3)
A: Verified Protection (A1)
A

C: Discretionary Protection (C1 and C2)

159
Q

What are the 4 limitations of the Orange Book?

A
  • Addresses only confidentiality issues
  • Isn’t applicable to most commercial systems
  • emphasises protection from unauthorised access, however most violations involve insiders
  • Doesn’t address networking issues
160
Q

Which 2 elements of CIA does Trusted Network Interpretation address?

A

Confidentiality and Integrity

161
Q

What is the Trusted network Interpretation otherwise known as?

A

The Red Book

162
Q

What are the two parts of TNI?

A
  • Part 1: A guideline for extending the system protection standards in TCSEC to cover networks.
  • Part 2: Additional security features such as Communication Integrity, protection from Denial of Service and Transmission Security
163
Q

Which of the elements of CIA does ITSEC address?

A

All 3

164
Q

ITSEC evaluates an entire system (defined as Target of Evaluation (TOE)) rather than a single computing platform. True or False?

A

True

165
Q

ITSEC evaluates functionality and assurance separately. How many functionality classes and evaluation levels are there?

A

10 functionality classes and 7 evaluation levels

166
Q

How ITSEC classes and levels compare to TCSEC

A

NA & E0 equivalent to D
F-C1 & E1 equivalent to C1
F-C2 & E2 equivalent to C2
F-B1 & E3 equivalent to B1
F-B2 & E4 equivalent to B2
F-B3 & E5 equivalent to B3
F-B3 & E6 equivalent to A1
F-IN & NA equivalent to TOEs with high integrity requirements
F-AV & NA equivalent to TOEs with high availability requirements
F-DI & NA equivalent to TOEs with high integrity requirements during data communications
F-DC & NA equivalent to TOEs with high confidentiality requirements during data communications
F-DX & NA equivalent to Networks with high confidentiality and integrity requirements

167
Q

What is the purpose of the Common Criteria?

A

To standardise and improve existing European and North American evaluation criteria

168
Q

Which evaluation criteria is adopted as an international standard is ISO 15408?

A

Common criteria

169
Q

How many Evaluation Assurance levels are there in common criteria?

A

8

170
Q

Common criteria evaluation assurance levels along with TCSEC and ITSEC equivalents

A 
EAL0 = NA = NA - Inadequate assurance
EAL1 = NA = NA - Functionally tested
EAL2 = C1 = E1 - Structurally tested
EAL3 = C2 = E2 - Methodically tested and checked
EAL4 = B1 = E3 - Methodically designed, tested, reviewed
EAL5 = B2 = E4 - Semi formally designed and tested
EAL6 = B3 = E5 - Semi formally verified designed/tested
EAL7 = A1 = E6 - Formally verified design and tested
171
Q

What is a Designated Approving Authority (DAA)?

A

An authority that grants accreditation of a system.

172
Q

When should system certification and accreditation be verified?

A

When changes are made to the system and every 3 years

173
Q

What are the two systems accreditation bodies for US military and government bodies respectively?

A
  • the Defence Information Technology Security Certification and Accreditation Process (DITSCAP)
  • the National Information Assurance Certification and Accreditation Process (NIACAP)
174
Q

What are the 4 phases of DITSCAP?

A
  • Definition - Security requirements are determined by defining the organisation and system’s mission, environment and architecture
  • Verification - Ensures a system undergoing development remains compliant with the “System Security Authorisation Agreement” (SSAA)
  • Validation - Confirms compliance with the SSAA
  • Post-accreditation - Represents ongoing activities required to maintain ongoing compliance and address new and evolving threats.
175
Q

NIACAP consists of the same 4 phases as DITSCAP, however what are the 3 additional phases?

A

Site accreditation - All applications and systems at a specific location are evaluated.
Type accreditation - A specific application or system for multiple locations is evaluated.
System accreditation - A specific application or system at a specific location is evaluated

176
Q

What is the Director of Central Intelligence Directive (DCID) 6/3?

A

the process used to protect sensitive information that stored on CIA computers.

177
Q

What is the Zachman Framework?

A

allows for the communication and collaboration of all entities in the development of the architecture. provides logical structure for integrating the various perspectives such as the plan, design and build aspects.

178
Q

What is the Sherwood Applied Business Security Architecture Framework (SABSA)?

A

follows same outline as Zachman. hollistic lifecycle for developing security architecture that starts with assessing business requirements and then creating a “chain of traceability”

179
Q

What is “The Open Group Architecture Framework (TOGAF)?

A

open framework for architecture design

180
Q

What is ITIL?

A
  • collection of best practices for IT governance
  • defines structure and skill requirements
  • sets operational procedures and practices
181
Q

What is the Lipner Model?

A

combines elements of BellLaPadula and Biba with the idea of job functions or roles in a novel way to protect confidentiality and integrity.

182
Q

What is the Brewer Nash Chinese Wall Model?

A

focuses on preventing conflict of interest when a given subject has access to objects with sensitive information associated with two competing parties.

183
Q

What is the Graham Denning Model?

A

concerned with how subjects and objects are created, assigned rights and how ownership of objects is managed.

184
Q

What is the Harrison-Ruzzo-Ullman model?

A

similar to Graham Denning and is composed of generic rights and a finite set of commands. also concerned with situations where a subject should be restricted from gaining particular privileges.

185
Q

Which ISO standards are considered the stanard for security practices?

A

27001 and 27002

186
Q

What is 27001 focused on?

A

standardisation and certification of an organisations ISMS. (security governance)

187
Q

What does 27002 provide?

A

code of practice for information security management. lists security control objectives and rcomends range of security controls. is more of a guideline

188
Q

What is COBIT?

A
  • framework for IT management
189
Q

What is Middleware?

A

connectivity software

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions