Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Which TCSEC level first addresses object reuse?






2. Which is an ISO standard product evaluation criteria that supersedes several different criteria






3. B1 is the ___________________ of the Trusted Network Interpretation (TNI) or TCSEC that offers labeled security protection.






4. Intended for environments that require systems to handle classified data.






5. The Biba Model is not concerned with security levels and confidentiality. It uses _________________.






6. Best defined as a mode of system termination that automatically leaves system processes and components in a secure state when a failure occurs or is detected in the system?






7. Buffer overflows occurs when a program or process tries to store more data in a _____________ than it was intended to hold.






8. Succesfully Evaluated products are placed on?






9. Includes the security kernel as well as other security-related system functions that are within the boundary of the trusted computing base. System elements that are outside of the security perimeter need not be trusted.






10. The omission of networks and network components in the TCSEC was recognized and addressed in the "Trusted Network Interpretation of the TCSEC" otherwise known as ___________.






11. In Access Control terms it means to be higher than or equal to. In the Bell-Lapadula Model - this is refered to as the dominance relation - which is the relationship of the subject's clearance to the object's classification

Warning: Invalid argument supplied for foreach() in /var/www/html/basicversity.com/show_quiz.php on line 183


12. A nonvolatile storage media etc computer hard drive - floppy disks and CD-ROMs






13. B3 is also called "Security Domains" and imposes more granularity in each protection mechanism.






14. Which can be used as a covert channel?






15. The object reuse concept must also be invoked - meaning that any medium holding data must not contain any remnants of information after it is released for another subject to use. All data must be efficiently erased once the subject is doen with the m






16. A portion of a process. When the thread is generated - it shares the same domain(resources) as its process.






17. What is defined as the hardware - firmware and software elements of a trusted computing base that implement the reference monitor concept?






18. What does the simple security (ss) property mean in the Bell-LaPadula model?






19. Security Labels are not required until __________; thus C2 does not require security labels but B1 does






20. Which addresses a portion of the primary memory by specifying the actual address of the memory location?






21. Mandatory access control is enfored by the use of security labels.






22. In an automated system ________________ could be achieved by: A computer system designed to identify individuals responsible for any input.






23. The assignment of a specific individual to administer the security-related functions of a system.






24. Requires more stringent authentication mechanisms and well-defined interfaces among layers.






25. The Biba Model - ______________: A Subject cannot write data to an object at a higher integrity level (No write Up)






26. Trusted facility management is an assurance requirement only for ________________.






27. Should always trace to individuals responsible for observing and recording the data






28. The Reserved hard drive space used to to extend RAM capabilites.






29. In B2 Subjects and devices requre labels and the system must NOT allow ________. No Trapdoors exists.






30. The Orange Book describes four hierarchical levels to categorize security systems. Which levels require mandatory protection?






31. A logical form of separation used by secure computing systems - Processes are _____________ so that each cannot access objects outside its permitted domain






32. Users need to be Identified individually to provide more precise acces control and auditing functionality.






33. The Policy must be explicit and well defined and enforced by the mechanisms within the system






34. The Orange book does NOT Cover ________________ - And Database management systems






35. Execute one instruction at a time.






36. Which uses Protection Profiles and Security Targets?






37. The *-Property rule is refered to as ____________.






38. Another word for Primary storage and distinguishes physical memory from virtual memory.






39. There is only only one class in Division D. Reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.






40. A subject at a given clearance may not read an object at a higher classification






41. TCB contains The Security Kernel and all ______________.






42. A form of ROM(Read-Only Memory) that can be modified after it has been manufactured. It can only be programmed only one time.






43. Verification Protection






44. Contains the beginning address






45. Documentation must be provided - including test - design - and specification document - user guides and manuals






46. The group that oversees the processes of evaluation within TCSEC is?






47. The total combination of protection mechanisms within a computer system






48. What is called the formal acceptance of the adequacy of a system's overall security by management?






49. Used by Windows systems to reserve the "Swap Space"






50. Which Orange Book evaluation level is described as "Verified Design"?