Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. What is defined as the hardware - firmware and software elements of a trusted computing base that implement the reference monitor concept?






2. As per FDA data should be ______________________________.






3. The omission of networks and network components in the TCSEC was recognized and addressed in the "Trusted Network Interpretation of the TCSEC" otherwise known as ___________.






4. THE (Technische Hogeschool Eindhoven) - VAX/VMS - Multics and Unix . THE and Multics are no longer in use






5. Software - hardware and firmware must be able to be tested individually to ensure that each enforces the security policy in an effective manner throughout their lifetimes.






6. Which describe a condition when RAM and Secondary storage are used together?






7. Applications and user activity






8. A type of memory used for High-speed writing and reading activities.






9. Which increases the performance in a computer by overlapping the steps of different instructions?






10. In B2 Subjects and devices requre labels and the system must NOT allow ________. No Trapdoors exists.






11. Which can be used as a covert channel?






12. Bell-LaPadula - ______________: This rule is based on named subjects and objects. It specifies that specific permissions allow a subject to pass on permissions to pass on permissions at its own discretion. These permissions are stored in an access ma






13. The Biba model (introduced in 1977) - The Sutherland model (published in 1986) - The Brewer-Nash model (published in 1989)






14. Mandatory Protection






15. Should always trace to individuals responsible for observing and recording the data






16. The Orange book requires protection against two_____________ - which are these Timing and Storage






17. In Access Control terms it means to be higher than or equal to. In the Bell-Lapadula Model - this is refered to as the dominance relation - which is the relationship of the subject's clearance to the object's classification

Warning: Invalid argument supplied for foreach() in /var/www/html/basicversity.com/show_quiz.php on line 183


18. A portion of a process. When the thread is generated - it shares the same domain(resources) as its process.






19. A is a form of EPROM - but its data storage can be erased and modified electrically by onboard programming circuitry and signals.






20. The Biba Model - ______________: A subject cannot request service (invoke) to subjects of higher integrity






21. Documentation must be provided - including test - design - and specification document - user guides and manuals






22. What does the Clark-Wilson security model focus on






23. The reference monitor must mediate all access - _____________ - be verifiable as correct - and must always be invoked.






24. Verification Protection






25. What does the * (star) property mean in the Bell-LaPadula model?






26. Accreditation is the authorization by management to _____________________. This authorization may be either provisional or full.






27. Each data object must contain a classification label and each subject must have a clearance label.






28. Includes the security kernel as well as other security-related system functions that are within the boundary of the trusted computing base. System elements that are outside of the security perimeter need not be trusted.






29. What is called the formal acceptance of the adequacy of a system's overall security by management?






30. In ______________ the subject must have: Need to Know for ALL the information contained within the system.






31. When the contents of the address defined in the program's instruction is added to that of an index register.






32. Can be erased - modified and upgraded.






33. The TCB is the ________________ within a computer system that work together to enforce a security policy.






34. To ensure that the Trusted Computing Base is not tampered with during shipment or installation.






35. The Security Kernel is the Core of The TCB and is the _____________ to building trusted computing systems.






36. An abstract machine which must mediate all access to subjects to objects - be protected from modification - be verifiable as correct - and is always invoked






37. An organization within the National Security Agency (NSA) is responsible for Evaluating computer systems and products. The Trusted Product Evaluation program (TPEP) oversees the testing by approved entities of commercial products against a specific s






38. Succesfully Evaluated products are placed on?






39. Which TCSEC level first addresses object reuse?






40. Which Orange Book evaluation level is described as "Discretionary Security Protection"?






41. TCSEC provides a means to evaluate ______________________.






42. A logical form of separation used by secure computing systems - Processes are _____________ so that each cannot access objects outside its permitted domain






43. A Policy based control. All objects and systems have a sensitivity level assigned to them






44. According to the Orange Book - which security level is the first to require a system to protect against covert timing channels?






45. Mediates all access and Functions between subjects and objects.






46. If a system initializes in a secure state and all allowed state transitions are secure - the every subsequent state will be secure no matter what inputs occur.






47. Mandatory access control is enfored by the use of security labels.






48. There is only only one class in Division D. Reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.






49. When a vendor submits a product for evaluation - it submits it to the ____________.






50. Happen because input data is not checked for appropriate length at time of input