Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. In ______________ the subject must have: Need to Know for ALL the information contained within the system.






2. Accreditation is the authorization by management to _____________________. This authorization may be either provisional or full.






3. Audit data must be captured and protected to enforce accountability






4. When the contents of the address defined in the program's instruction is added to that of an index register.






5. Which in the Orange Book ratings represents the highest level of trust?






6. The Biba Model - _____________: A subject cannot read data from a lower Integrity level " No Read Down"






7. Which Orange Book evaluation level is described as "Verified Design"?






8. The security kernel is the mechanism that _____________ of the reference monitor concept.






9. In B2 Subjects and devices requre labels and the system must NOT allow ________. No Trapdoors exists.






10. A channel within a computer system or network that is designed for the authorized transfer of information is identified as a(n)?






11. Which describe a condition when RAM and Secondary storage are used together?






12. Remaining parts of the operating system






13. The Biba Model - ______________: A Subject cannot write data to an object at a higher integrity level (No write Up)






14. Which evaluation class of the Trusted Network Interpretation (TNI) offers security domains?






15. An abstract machine which must mediate all access to subjects to objects - be protected from modification - be verifiable as correct - and is always invoked






16. The C2 evaluation class of the _________________ offers controlled access protection.






17. When a computer spends more time moving data from one small portion of memory to another THAN Actually processing the data






18. The Biba Model is not concerned with security levels and confidentiality. It uses _________________.






19. TCSEC addresses Confidentiality - but _____________ . The TCSEC focuses mainly on one attribute of Security Confidentiality.






20. In the Bell-LaPadula Model the Object's Label contains ___________________.






21. Security is made up of: System administration - ________ - installation and configuration mechanisms within the environment - and other security issues.






22. Security Labels are not required until __________; thus C2 does not require security labels but B1 does






23. Requires more stringent authentication mechanisms and well-defined interfaces among layers.






24. The Bell-LaPadula Model is a _______________.






25. The Biba Model adresses _____________________.






26. Which uses Protection Profiles and Security Targets?






27. Data in Cache can be accessed much more quickly than Data






28. The Orange book requires protection against two_____________ - which are these Timing and Storage






29. What does the Clark-Wilson security model focus on






30. An imaginary line that separates the trusted components of the TCB from those elements that are NOT trusted?






31. The Biba model (introduced in 1977) - The Sutherland model (published in 1986) - The Brewer-Nash model (published in 1989)






32. Developed after the Bell-LaPadula model. Its a state machine model and is very similar to the Bell-LaPadula Model.






33. What Orange Book security rating is reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions?






34. Discretionary access control is based on individuals and/or groups. It requires a separation of users and information and identification and authentication of individual entities






35. When a vendor submits a product for evaluation - it submits it to the ____________.






36. Which Orange Book evaluation level is described as "Controlled Access Protection"? - This class requires a more granular method of providing access control. The system must enforce strict logon procedures and provide decision-making capabilites when






37. A form of ROM(Read-Only Memory) that can be modified after it has been manufactured. It can only be programmed only one time.






38. The reserved hard drive space used to Extend RAM capabilities. Windows system use the pagefile.sys file to reserve this space






39. The process of Evaluating the security stance of the software or system against a selected set of standards or policies. This may precede accreditation but is not a required precursor.






40. When the RAM and secondary storage are combined the result is __________.






41. The security mechanisms and the system as a whole must perform predictably and acceptably in different situations continuously.






42. This class ("Structured Protection") requires more stringent authentication mechanisms and well-defined interfaces between layers. Subjects and devices require labels and the system must not allow covert channels.






43. Includes the security kernel as well as other security-related system functions that are within the boundary of the trusted computing base. System elements that are outside of the security perimeter need not be trusted.






44. What prevents a process from accessing another process' data?






45. Contains the beginning address






46. Configuration management is also defined in the Orange Book BUT As a _____________________ and NOT an operational assurance requirement.






47. An organization within the National Security Agency (NSA) is responsible for Evaluating computer systems and products. The Trusted Product Evaluation program (TPEP) oversees the testing by approved entities of commercial products against a specific s






48. Accreditation is also defined as an ____________________ by a designated authority that an information system is approved to operate in a particular security configuration with a prescribed set of safeguards






49. What are the components of an object's sensitivity label?






50. Users are trusted but a certain level of accountability is required. C2 over is seen as the most reasonable class for commmercial applications - but the level of protection is still relatively weak.