Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Users are trusted but a certain level of accountability is required. C2 over is seen as the most reasonable class for commmercial applications - but the level of protection is still relatively weak.






2. Bell-LaPadula Model -______________: A subject in a given security level can NOT WRITE information to a LOWER security level.






3. The Bell-LaPaula Model's main goal was to ___________________ in an unauthorized manner. (Developed by the US gov)






4. Developed after the Bell-LaPadula model. Its a state machine model and is very similar to the Bell-LaPadula Model.






5. The Biba Model - ______________: A Subject cannot write data to an object at a higher integrity level (No write Up)






6. Bell-LaPadula Model - ____________ : A subject at a given security level can NOT READ data that reside at a higher security level.






7. What prevents a process from accessing another process' data?






8. The Availability - Integrity and confidentiality requirements of multitasking operating systems






9. Individual subjects must be uniquely identified.






10. The reference monitor must mediate all access - _____________ - be verifiable as correct - and must always be invoked.






11. In both the Bell-LaPadula and Biba Models if the word "* or Star is used - _______________.






12. Ensuring thta information does not flow from a higher security lever to a lower level in the Bell-LaPadula Model is referred to as ___________________ - which would take place through a "write down" operation. (An actual compromise occurs if and when






13. Audit data must be captured and protected to enforce accountability






14. The subject must have Need to Know for ONLY the information they are trying to access.






15. As per FDA data should be ______________________________.






16. What is defined as the hardware - firmware and software elements of a trusted computing base that implement the reference monitor concept?






17. The hardware - firmware and software elements of a trusted computing base that implement the reference monitor concept.






18. A1 is also called "Verified Design" and requires formal verification of the design and specifications.






19. Reference Monitor is responsible for ______________ it compares the security labels of a subject and an object






20. The reserved hard drive space used to Extend RAM capabilities. Windows system use the pagefile.sys file to reserve this space






21. In ______________ the subject must have: Need to Know for ALL the information contained within the system.






22. The Policy must be explicit and well defined and enforced by the mechanisms within the system






23. What does the * (star) property mean in the Bell-LaPadula model?






24. Components considered as part of the Trusted Computing Base (from the Orange Book) are?






25. Which addresses a portion of the primary memory by specifying the actual address of the memory location?






26. This class ("Structured Protection") requires more stringent authentication mechanisms and well-defined interfaces between layers. Subjects and devices require labels and the system must not allow covert channels.






27. Which is a straightforward approach that provides access rights to subjects for objects?






28. Should always trace to individuals responsible for observing and recording the data






29. Mediates all access and Functions between subjects and objects.






30. Has two individual assurace ratings. C1 and C2. The Higher the number of assurance rating the greater the protection






31. A logical form of separation used by secure computing systems - Processes are _____________ so that each cannot access objects outside its permitted domain






32. The Bell-LaPadula Model is a _______________ that enforces Confidentiality aspect of access control. Formed by David Bell and Leonard LaPadula.






33. To ensure that the Trusted Computing Base is not tampered with during shipment or installation.






34. Security Labels are not required until __________; thus C2 does not require security labels but B1 does






35. The Biba Model - _____________: A subject cannot read data from a lower Integrity level " No Read Down"






36. Which TCSEC level first addresses object reuse?






37. A domain of trust that shares a single security policy and single management






38. A ring protection system ________: User mode programs from direct access to peripherals and requires them to make use of services running at more privileged levels.






39. Based on the Bell-LaPadula Security model - and evidence of reference monitor enforcement must be available.






40. The object reuse concept must also be invoked - meaning that any medium holding data must not contain any remnants of information after it is released for another subject to use. All data must be efficiently erased once the subject is doen with the m






41. The Bell-LaPadula model Subjects and Objects are ___________.






42. Which integrity model defines a constrained data item - an integrity verification procedure and a transformation procedure?






43. Mandatory Protection






44. Software - hardware and firmware must be able to be tested individually to ensure that each enforces the security policy in an effective manner throughout their lifetimes.






45. Requires more stringent authentication mechanisms and well-defined interfaces among layers.






46. When a computer uses more than one CPU in parallel to execute instructions is known as?






47. Permits a database to have two records that are identical except for Their classifications






48. Which uses Protection Profiles and Security Targets?






49. An imaginary line that separates the trusted components of the TCB from those elements that are NOT trusted?






50. According to the Orange Book - which security level is the first to require a system to protect against covert timing channels?