Test your basic knowledge |

CISSP Security Architecture And Design

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Users need to be Identified individually to provide more precise acces control and auditing functionality.






2. A process that resides in a privileged domain to be able to execute its instructions and process its data with the assurance that programs in a different domain can NOT negatively affect its environment.






3. The Security Kernel is the Core of The TCB and is the _____________ to building trusted computing systems.






4. Mandatory Access requires that _____________ be attached to all objects.






5. If a system initializes in a secure state and all allowed state transitions are secure - the every subsequent state will be secure no matter what inputs occur.






6. What does the Clark-Wilson security model focus on






7. Requires more stringent authentication mechanisms and well-defined interfaces among layers.






8. Data in Cache can be accessed much more quickly than Data






9. A Policy based control. All objects and systems have a sensitivity level assigned to them






10. The assignment of a specific individual to administer the security-related functions of a system.






11. When a computer spends more time moving data from one small portion of memory to another THAN Actually processing the data






12. Trusted facility management is an assurance requirement only for ________________.






13. Ssoftware that is stored within ROM (Read-Only Memory) - (ROM is nonvolatile)






14. This type of environment is highly secured environment that processes very sensitive information. It requires systems that are highly resistant to penetration.






15. Based on the Bell-LaPadula Security model - and evidence of reference monitor enforcement must be available.






16. According to the Orange Book - trusted facility management is not required for which security levels?






17. Mandatory Protection






18. In Access Control terms it means to be higher than or equal to. In the Bell-Lapadula Model - this is refered to as the dominance relation - which is the relationship of the subject's clearance to the object's classification


19. An imaginary line that separates the trusted components of the TCB from those elements that are NOT trusted?






20. Contains an Address of where the instruction and dara reside that need to be processed.






21. Using TPs (Transformation Procedures) to modify CDIs (Constrained Data) items is refered to as Well-Formed transaction






22. The reference monitor - in accordance with the security policy - ____________ that are made in the access control database.






23. I/O drivers and utilities






24. Best defined as a mode of system termination that automatically leaves system processes and components in a secure state when a failure occurs or is detected in the system?






25. Involves sharing the processor amoung all ready processes






26. Contains the ending address






27. The process of Evaluating the security stance of the software or system against a selected set of standards or policies. This may precede accreditation but is not a required precursor.






28. The subject must have Need to Know for ONLY the information they are trying to access.






29. Accreditation is also defined as an ____________________ by a designated authority that an information system is approved to operate in a particular security configuration with a prescribed set of safeguards






30. The Physical memory address that the CPU uses






31. What access control technique is also known as multilevel security?






32. The security kernel is the mechanism that _____________ of the reference monitor concept.






33. Which Orange Book evaluation level is described as "Discretionary Security Protection"?






34. Each data object must contain a classification label and each subject must have a clearance label.






35. Documentation must be provided - including test - design - and specification document - user guides and manuals






36. A form of ROM(Read-Only Memory) that can be modified after it has been manufactured. It can only be programmed only one time.






37. An abstract machine which must mediate all access to subjects to objects - be protected from modification - be verifiable as correct - and is always invoked






38. When a vendor submits a product for evaluation - it submits it to the ____________.






39. Logical access control mechanisms are used to enforce authentication and the uniquenes of each individual's identification.






40. A portion of a process. When the thread is generated - it shares the same domain(resources) as its process.






41. Contains the beginning address






42. TCSEC provides a means to evaluate ______________________.






43. Based on The Bell-LaPadula model - because it allows for multilevel security to be integrated into the code.






44. The total(sum)combination of protection mechanisms within a computer system. The TCB includes hardware - software - and firmware.






45. The Bell-LaPadula Model is a _______________.






46. Security is made up of: System administration - ________ - installation and configuration mechanisms within the environment - and other security issues.






47. The reference monitor must mediate all access - _____________ - be verifiable as correct - and must always be invoked.






48. Developed after the Bell-LaPadula model. Its a state machine model and is very similar to the Bell-LaPadula Model.






49. Individual subjects must be uniquely identified.






50. The Biba Model is not concerned with security levels and confidentiality. It uses _________________.