Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Based on a known address with an offset value applied.






2. Buffer overflows occurs when a program or process tries to store more data in a _____________ than it was intended to hold.






3. The Security Model Incorporates the ____________ that should be enforced in the system.






4. What Orange Book security rating is reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions?






5. A channel within a computer system or network that is designed for the authorized transfer of information is identified as a(n)?






6. Has two individual assurace ratings. C1 and C2. The Higher the number of assurance rating the greater the protection






7. The TCB is the ________________ within a computer system that work together to enforce a security policy.






8. This type of environment is highly secured environment that processes very sensitive information. It requires systems that are highly resistant to penetration.






9. Which Orange Book evaluation level is described as "Controlled Access Protection"? - This class requires a more granular method of providing access control. The system must enforce strict logon procedures and provide decision-making capabilites when






10. The Reserved hard drive space used to to extend RAM capabilites.






11. The Bell-LaPadula model Subjects and Objects are ___________.






12. Which addresses a portion of the primary memory by specifying the actual address of the memory location?






13. Which Orange Book evaluation level is described as "Verified Design"?






14. B1 is also called "Labeled Security" and each data object must have a classification label and each subject a clearance label. On each access attempt - the classification and clearance are checked to verify that the access is permissible.






15. What prevents a process from accessing another process' data?






16. Certification is a Technical review that assesses the _____________ - where as Accreditation is management's Official acceptance of the information in the Certification process findings.






17. There is only only one class in Division D. Reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.






18. Contains the beginning address






19. Happen because input data is not checked for appropriate length at time of input






20. What is defined as the hardware - firmware and software elements of a trusted computing base that implement the reference monitor concept?






21. Which describe a condition when RAM and Secondary storage are used together?






22. Which Orange Book evaluation level is described as "Discretionary Security Protection"?






23. The security kernel is the mechanism that _____________ of the reference monitor concept.






24. The Biba Model - ______________: A subject cannot request service (invoke) to subjects of higher integrity






25. A system uses the Reference Monitor to ___________________ of a subject and an object?






26. Involves sharing the processor amoung all ready processes






27. Each data object must contain a classification label and each subject must have a clearance label.






28. According to the Orange Book - trusted facility management is not required for which security levels?






29. Best defined as a mode of system termination that automatically leaves system processes and components in a secure state when a failure occurs or is detected in the system?






30. Which is an ISO standard product evaluation criteria that supersedes several different criteria






31. In ______________ the subject must have: Need to Know for ALL the information contained within the system.






32. The type of environment that would require A1 systems is the most secure of secure environments. It deals with top-secret information and cannot adequately trust anyone using the systems without strict authentication - restrictions and auditing.






33. The total(sum)combination of protection mechanisms within a computer system. The TCB includes hardware - software - and firmware.






34. Developed after the Bell-LaPadula model. Its a state machine model and is very similar to the Bell-LaPadula Model.






35. The security mechanisms and the system as a whole must perform predictably and acceptably in different situations continuously.






36. If an operating system permits executable objects to be used sequentially by multiple users without a refresh of the objects - what security problem is most likely to exist?






37. In the Bell-LaPadula Model the Subject's Label contains ___________________.






38. Mandatory Protection






39. Applications and user activity






40. Based on the Bell-LaPadula Security model - and evidence of reference monitor enforcement must be available.






41. Security Labels are not required until __________; thus C2 does not require security labels but B1 does






42. Includes the security kernel as well as other security-related system functions that are within the boundary of the trusted computing base. System elements that are outside of the security perimeter need not be trusted.






43. Ssoftware that is stored within ROM (Read-Only Memory) - (ROM is nonvolatile)






44. The Orange book does NOT Cover ________________ - And Database management systems






45. What model use an access control triples and requires that the system maintain separation of duty ?






46. Can be erased - modified and upgraded.






47. THE (Technische Hogeschool Eindhoven) - VAX/VMS - Multics and Unix . THE and Multics are no longer in use






48. The Availability - Integrity and confidentiality requirements of multitasking operating systems






49. Discretionary protection






50. The Orange Book describes four hierarchical levels to categorize security systems. Which levels require mandatory protection?