Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Should always trace to individuals responsible for observing and recording the data






2. Access control labels must be associated properly with objects.






3. Commonly referred to as The Big Mess Because of its lack of structure. MS-DOS is an example of a monolithic operation system






4. Data in Cache can be accessed much more quickly than Data






5. When a computer uses more than one CPU in parallel to execute instructions is known as?






6. I/O drivers and utilities






7. Individual subjects must be uniquely identified.






8. The Orange book requires protection against two_____________ - which are these Timing and Storage






9. In an automated system ________________ could be achieved by: A computer system designed to identify individuals responsible for any input.






10. Which describe a condition when RAM and Secondary storage are used together?






11. The centerpiece of the DoD Rainbow Series publications.Developed by the National Computer Security Center (NCSC)?






12. Certification is a Technical review that assesses the _____________ - where as Accreditation is management's Official acceptance of the information in the Certification process findings.






13. In ______________ the subject must have: Need to Know for ALL the information contained within the system.






14. When the RAM and secondary storage are combined the result is __________.






15. In both the Bell-LaPadula and Biba Models if the word "Simple is used ______________.






16. Based on a known address with an offset value applied.






17. To ensure that the Trusted Computing Base is not tampered with during shipment or installation.






18. There is only only one class in Division D. Reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.






19. The Red Book aka Trusted Network Interpretation (TNI) - provides _________________ for Trusted computer and communications network systems under the areas of assurance requirements






20. What access control technique is also known as multilevel security?






21. Permits a database to have two records that are identical except for Their classifications






22. THE (Technische Hogeschool Eindhoven) - VAX/VMS - Multics and Unix . THE and Multics are no longer in use






23. B3 is also called "Security Domains" and imposes more granularity in each protection mechanism.






24. The Physical memory address that the CPU uses






25. Happen because input data is not checked for appropriate length at time of input






26. Bell-LaPadula Model -______________: A subject in a given security level can NOT WRITE information to a LOWER security level.






27. Which Orange Book evaluation level is described as "Discretionary Security Protection"?






28. Discretionary access control is based on individuals and/or groups. It requires a separation of users and information and identification and authentication of individual entities






29. The Reserved hard drive space used to to extend RAM capabilites.






30. Users need to be Identified individually to provide more precise acces control and auditing functionality.






31. In access control terms - the word "dominate" refers to ___________.






32. The first mathematical model of a multi-level security policy used to define the concept of a secure state - the modes of access - and rules for granting access?






33. What does the simple integrity axiom mean in the Biba model?






34. Accreditation is also defined as an ____________________ by a designated authority that an information system is approved to operate in a particular security configuration with a prescribed set of safeguards






35. Trusted facility management is an assurance requirement only for ________________.






36. Which computer design approaches is based on the fact that in earlier technologies - the instruction fetch was the longest part of the cycle






37. Mandatory Protection






38. The Biba Model adresses _____________________.






39. If an operating system permits executable objects to be used sequentially by multiple users without a refresh of the objects - what security problem is most likely to exist?






40. Succesfully Evaluated products are placed on?






41. What is called the formal acceptance of the adequacy of a system's overall security by management?






42. Contains the ending address






43. In B2 Subjects and devices requre labels and the system must NOT allow ________. No Trapdoors exists.






44. The Bell-LaPadula Model is a _______________ that enforces Confidentiality aspect of access control. Formed by David Bell and Leonard LaPadula.






45. Bell-LaPadula - ______________: This rule is based on named subjects and objects. It specifies that specific permissions allow a subject to pass on permissions to pass on permissions at its own discretion. These permissions are stored in an access ma






46. Levels of Security and Levels of Trust Lower Letters of the alphabet represent higher levels of security. Higher numbers indicate a greater level of trust.






47. In B1 the security policy is based on Informal statement and the design specifications are reviewed and verified where as in B2 the ___________________ - and the system design and implementation are subject to more thorough review and testing procedu






48. TCSEC provides a means to evaluate ______________________.






49. The Availability - Integrity and confidentiality requirements of multitasking operating systems






50. A set of objects that a subject is able to access