Security Goals & Controls

Question 1

What is a strict mathematical model where access to resources is determined by the system based on predefined security labels and rules?
A. ABAC
B. RBAC
C. MAC
D. DAC

Answer 1

MAC (Mandatory Access Control): MAC is a highly restrictive access control model where the system enforces access based on security labels assigned to both subjects (users) and objects (resources). These labels define the level of sensitivity or clearance required to access a resource. Access decisions are made by the system, not by the user.

Question 2

What is the process of granting an authenticated entity permission to access a resource or perform a specific function?
A. Authorization
B. Accounting
C. Authentication
D. Availability

Answer 2

A. Authorization

Question 3

Which security goal controls an attacker’s ability to get unauthorized access to data or information from an application or system?
A. Availability
B. Integrity
C. Non-repudiation
D. Confidentiality

Answer 3

D. Confidentiality
Confidentiality: Ensures that sensitive information is protected from unauthorized access, use, disclosure, copying, modification, or destruction.

Question 4

Which of these are common ways to authenticate people? Choose more than one option.
A. An X.509 device certificate
B. A password, PIN, or passphrase they know
C. A smart card token or fob that they possess
D. A network interface MAC address
E. A QR or other code they present on a device
F. A biometric attribute

Answer 4

B. A password, PIN, or passphrase they know
C. A smart card token or fob that they possess
E. A QR or other code they present on a device
F. A biometric attribute

Question 5

What is one way to enable authentication of non-traditional network endpoints such as smart card readers, HVAC systems, medical equipment, and IP-enabled door locks?
A. Protected access files
B. Packet mode
C. Repudiation
D. Endpoint fingerprinting

Answer 5

D. Endpoint fingerprinting

Question 6

Which security control enforces the inability of a subject to deny that they participated in a digital transaction, agreement, contract, or communication such as an email?
A. Integrity
B. Availability
C. Non-repudiation
D. Confidentiality

Answer 6

C. Non-repudiation

Question 7

Which type of security control is made up of mandatory policies and regulations that are in place to maintain consistency and compliance?
A. Deterrent
B. Corrective
C. Preventative
D. Directive

Answer 7

D. Directive

Question 8

Which category of controls supports ongoing maintenance, due care, and continual improvement such as conducting tested patch management?
A. Operational
B. Managerial
C. Physical
D. Technical

Answer 8

A. Operational
These controls are implemented and executed to ensure the security of systems and data. They include activities like patch management, user access controls, and incident response procedures.