Question 1

Under the TCSEC model,the term ____ can be misleading-note that in this context,it means that components are part of the TCB security system,but it does not necessarily follow that they are all above reproach.
A) reference monitor
B) trusted
C) covert
D) security policy

Accepted Answer

Under the TCSEC model, the term "trusted" indicates that a component is part of the Trusted Computing Base (TCB) security system, but it does not necessarily imply that the component is beyond attack or compromise. Hence, it can be misleading. The other options like reference monitor, covert, and security policy have distinct meanings and are not applicable in this context.

Question 2

Under the Biba model,the ____ property permits a subject to have write access to an object only if the security level of the subject is equal to or higher than that of the object.
A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Accepted Answer

The property described in the question is the integrity property in the Biba model. The integrity star property extends this concept by allowing a subject with a higher security level to write to an object with a lower security level, but only if this does not compromise the overall integrity of the system.

Question 3

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)____.
A) access control list
B) capabilities table
C) access control matrix
D) sensitivity level

Accepted Answer

An access control list (ACL) is a column of attributes associated with a particular object, specifying which users or system processes are granted access to objects and what operations are allowed on given objects.

Question 4

Under the Common Criteria,____ is the document describing the system being evaluated's security properties.
A) Target of Evaluation (ToE)
B) Protection Profile (PP)
C) Security Target (ST)
D) Security Functional Requirements (SFRs)

Accepted Answer

The Security Target (ST) is the document that describes the security properties of the Target of Evaluation (TOE), which is the system being evaluated. The Protection Profile (PP) is a document that describes security requirements for a certain type of product, while the Security Functional Requirements (SFRs) are a set of requirements that define security functions that are required in a product.

Question 5

____ access controls are implemented at the option of the data user.
A) Mandatory
B) Nondiscretionary
C) Discretionary
D) Lattice-based

Accepted Answer

Discretionary access controls (DAC) are grants of permission to information based on the identity of the user requesting access. The role of the data user determines the access controls. Therefore, the permission to access the data established in a discretionary scheme could vary depending on the user.

Question 6

Under ITSEC,what is the highest level of assessment a product can be rated?
A) EAL7
B) E1
C) E6
D) A1

Accepted Answer

The answer of Under ITSEC,what is the highest level of...

Question 7

Under the Bell-LaPadula model,the ____ property prohibits a subject of lower clearance from reading an object of higher classification,but allows a subject with a higher clearance level to read an object at a lower level.
A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Accepted Answer

The property described in the question is known as the "simple security" property under the Bell-LaPadula model. This property ensures that confidentiality is maintained by prohibiting a subject from accessing an object with a higher classification level than the subject's clearance level. However, it also allows a subject with a higher clearance level to access an object with a lower classification level to perform their duties. The other options listed are not relevant to this property.

Question 8

Under the Common Criteria,____ is the user-generated specifications for security requirements.
A) Target of Evaluation (ToE)
B) Protection Profile (PP)
C) Security Target (ST)
D) Security Functional Requirements (SFRs)

Accepted Answer

The answer of Under the Common Criteria,____ is the user-generated...

Question 9

Under the Biba model,the ____ property permits a subject to have read access to an object only if the security level of the subject is either lower or equal to the level of the object.
A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Accepted Answer

The simple integrity property of the Biba model allows a subject to read an object only if the subject's integrity level is lower than or equal to the object's integrity level, ensuring that higher integrity data is not contaminated by lower integrity subjects.

Question 10

An Automated Teller Machine (ATM)is an example of a ____.
A) content-dependent access control
B) constrained user interface
C) temporal isolation
D) None of these

Accepted Answer

A constrained user interface limits the actions that a user can take and the input that the system accepts. An ATM only allows users to perform certain transactions (such as withdrawing cash or checking their account balance) using a limited set of buttons and commands. Content-dependent access control and temporal isolation are not relevant to the operation of an ATM.

Question 11

Under TCSEC,the ____ is the combination of all hardware,firmware,and software responsible for enforcing the security policy.
A) trusted computing base
B) reference monitor
C) covert channel
D) verification module

Accepted Answer

According to the Trusted Computer System Evaluation Criteria (TCSEC), the trusted computing base (TCB) is the combination of all hardware, firmware, and software components that are responsible for enforcing the security policy of a system. This includes the operating system, access control mechanisms, and other security-related components that are crucial to the operation of the system. The TCB is essential for maintaining the security and integrity of the system, and it is subject to rigorous testing and evaluation to ensure that it meets the highest standards for security.

Question 12

Storage of classified documents must be accessible only to authorized individuals,which usually requires which of the following?
A) Safes
B) Locking file cabinets
C) Other protective devices for hard copies
D) All of these

Accepted Answer

All of the options listed (safes, locking file cabinets, and other protective devices for hard copies) are commonly used to provide secure storage for classified documents. Using a combination of these measures can provide multiple layers of protection and help ensure that only authorized individuals are able to access the sensitive information.

Question 13

Under TCSEC,the ____ is the piece of the system that manages access controls-in other words,it mediates all access to objects by subjects.
A) trusted computing base
B) reference monitor
C) covert channel
D) verification module

Accepted Answer

Under the Trusted Computer System Evaluation Criteria (TCSEC), the reference monitor is the component of the system responsible for mediating all access to objects by subjects. It is considered to be the most crucial part of the Trusted Computing Base (TCB).

Question 14

____ access controls are determined by a central authority and can be based on roles or tasks.
A) Mandatory
B) Nondiscretionary
C) Discretionary
D) Lattice-based

Accepted Answer

Nondiscretionary access controls are determined by a central authority and can be based on roles or tasks. Mandatory access controls are based on specific security labels assigned to each object and subject, discretionary access controls are determined by the owner of the object being accessed, and lattice-based access controls use a mathematical model to determine access based on the subject's clearance level and the object's classification level.

Question 15

Under the TCSEC model,the term ____ refers to the rules of configuration for a system,rather than a managerial guidance document.
A) reference monitor
B) trusted
C) covert
D) security policy

Accepted Answer

The term that refers to the rules of configuration for a system in the TCSEC model is security policy. The security policy is a statement of the security rules to which a system is expected to conform, and it specifies what is allowed and what is not allowed in terms of access to system resources. The reference monitor is a key concept in the TCSEC model, but it refers to a software module that enforces the security policy rather than the policy itself. "Trusted" and "covert" are not relevant terms in this context.

Question 16

Access to a specific set of information may be dependent on its subject matter is called ____.
A) content-dependent access controls
B) constrained user interfaces
C) temporal isolation
D) None of these

Accepted Answer

Content-dependent access controls determine whether a user should be granted access to specific content based on the subject matter. This ensures that sensitive or confidential information is only accessible to those who have a legitimate need to know. Constrained user interfaces and temporal isolation are not related to this concept.

Question 17

Under lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a(n)____.
A) access control list
B) capabilities table
C) access control matrix
D) sensitivity level

Accepted Answer

A capabilities table is a row of attributes associated with a particular subject, detailing the access rights the subject has to various objects.

Question 18

Under the Bell-LaPadula model,the ____ property prohibits a high-level subject from sending messages to a lower-level object.In short,subjects can read down and objects can write or append up.
A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Accepted Answer

The star (*) property of the Bell-LaPadula model prohibits a high-level subject from writing to a lower-level object, ensuring that information does not flow from a higher security level to a lower one.

Question 19

What is the highest level of protection or evaluation which a system can be assigned under TCSEC?
A) A1
B) B1
C) B3
D) Beyond A1

Accepted Answer

TCSEC defines four evaluation classes, with Class D being the highest level of protection and evaluation.

Question 20

The Clark-Wilson model,designed for commercial environments is a(n)____ model.
A) confidentiality
B) integrity
C) availability
D) None of these

Accepted Answer

The Clark-Wilson model is designed to ensure the integrity of data in commercial environments. It focuses on ensuring that data is accurate and consistent, and that unauthorized changes to data are prevented. The model does not directly address confidentiality or availability.

Quiz 6: Security Management Models

Under the TCSEC model,the term ____ can be misleading-note that in this context,it means that components are part of the TCB security system,but it does not necessarily follow that they are all above reproach.

Under the Biba model,the ____ property permits a subject to have write access to an object only if the security level of the subject is equal to or higher than that of the object.

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer) is referred to as a(n) ____.

Under the Common Criteria,____ is the document describing the system being evaluated's security properties.

____ access controls are implemented at the option of the data user.

Under ITSEC,what is the highest level of assessment a product can be rated?

Under the Bell-LaPadula model,the ____ property prohibits a subject of lower clearance from reading an object of higher classification,but allows a subject with a higher clearance level to read an object at a lower level.

Under the Common Criteria,____ is the user-generated specifications for security requirements.

Under the Biba model,the ____ property permits a subject to have read access to an object only if the security level of the subject is either lower or equal to the level of the object.

An Automated Teller Machine (ATM) is an example of a ____.

Under TCSEC,the ____ is the combination of all hardware,firmware,and software responsible for enforcing the security policy.

Storage of classified documents must be accessible only to authorized individuals,which usually requires which of the following?

Under TCSEC,the ____ is the piece of the system that manages access controls-in other words,it mediates all access to objects by subjects.

____ access controls are determined by a central authority and can be based on roles or tasks.

Under the TCSEC model,the term ____ refers to the rules of configuration for a system,rather than a managerial guidance document.

Access to a specific set of information may be dependent on its subject matter is called ____.

Under lattice-based access controls,the row of attributes associated with a particular subject (such as a user) is referred to as a(n) ____.

Under the Bell-LaPadula model,the ____ property prohibits a high-level subject from sending messages to a lower-level object.In short,subjects can read down and objects can write or append up.

What is the highest level of protection or evaluation which a system can be assigned under TCSEC?

The Clark-Wilson model,designed for commercial environments is a(n) ____ model.