Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Contains the ending address






2. Security is made up of: System administration - ________ - installation and configuration mechanisms within the environment - and other security issues.






3. Has two individual assurace ratings. C1 and C2. The Higher the number of assurance rating the greater the protection






4. When the contents of the address defined in the program's instruction is added to that of an index register.






5. Which uses Protection Profiles and Security Targets?






6. Which is an ISO standard product evaluation criteria that supersedes several different criteria






7. Which addresses a portion of the primary memory by specifying the actual address of the memory location?






8. When the address location that is specified in the program instruction contains the address of the final desired location.






9. The reference monitor must mediate all access - _____________ - be verifiable as correct - and must always be invoked.






10. The Indexed memory addresses that software uses






11. In the Orange Book - functionality and assurance are NOT _____________ as they are in the ITSEC and the Common Criteria.






12. What prevents a process from accessing another process' data?






13. The Physical memory address that the CPU uses






14. Accreditation is the authorization by management to _____________________. This authorization may be either provisional or full.






15. Mandatory Protection






16. Which Orange Book evaluation level is described as "Controlled Access Protection"? - This class requires a more granular method of providing access control. The system must enforce strict logon procedures and provide decision-making capabilites when






17. Bell-LaPadula model was proposed for enforcing access control in _____________________.






18. Levels of Security and Levels of Trust Lower Letters of the alphabet represent higher levels of security. Higher numbers indicate a greater level of trust.






19. Bell-LaPadula Model - ____________ : A subject at a given security level can NOT READ data that reside at a higher security level.






20. In access control terms - the word "dominate" refers to ___________.






21. A set of objects that a subject is able to access






22. What Orange Book security rating is reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions?






23. Which increases the performance in a computer by overlapping the steps of different instructions?






24. Which can be used as a covert channel?






25. The Orange Book describes four hierarchical levels to categorize security systems. Which levels require mandatory protection?






26. The group that oversees the processes of evaluation within TCSEC is?






27. Based on the Bell-LaPadula Security model - and evidence of reference monitor enforcement must be available.






28. The security mechanisms and the system as a whole must perform predictably and acceptably in different situations continuously.






29. The subject must have Need to Know for ONLY the information they are trying to access.






30. Should always trace to individuals responsible for observing and recording the data






31. A form of ROM(Read-Only Memory) that can be modified after it has been manufactured. It can only be programmed only one time.






32. Bell-LaPadula - ______________: This rule is based on named subjects and objects. It specifies that specific permissions allow a subject to pass on permissions to pass on permissions at its own discretion. These permissions are stored in an access ma






33. Which computer design approaches is based on the fact that in earlier technologies - the instruction fetch was the longest part of the cycle






34. In B2 Distinct address spaces must be provided to _________ - and a covert channel analysis is conducted. B2 adds assurance by adding requirements to the design of the system






35. The first mathematical model of a multi-level security policy used to define the concept of a secure state - the modes of access - and rules for granting access?






36. Individual subjects must be uniquely identified.






37. Audit data must be captured and protected to enforce accountability






38. The hardware - firmware and software elements of a trusted computing base that implement the reference monitor concept.






39. Commonly referred to as The Big Mess Because of its lack of structure. MS-DOS is an example of a monolithic operation system






40. The security kernel is the mechanism that _____________ of the reference monitor concept.






41. According to the Orange Book - which security level is the first to require a system to protect against covert timing channels?






42. The Bell-LaPadula model Subjects and Objects are ___________.






43. Requires more stringent authentication mechanisms and well-defined interfaces among layers.






44. When the RAM and secondary storage are combined the result is __________.






45. To ensure that the Trusted Computing Base is not tampered with during shipment or installation.






46. According to the Orange Book - trusted facility management is not required for which security levels?






47. n this class more granularity is provided in each protection mechanism - and the programming code that is not necessary to support the security policy is excluded.






48. Which describe a condition when RAM and Secondary storage are used together?






49. Mediates all access and Functions between subjects and objects.






50. In B1 the security policy is based on Informal statement and the design specifications are reviewed and verified where as in B2 the ___________________ - and the system design and implementation are subject to more thorough review and testing procedu