Question 1

Lattice-based access controls use a two-dimensional matrix to assign authorizations,what are the two dimensions and what are they called?

Accepted Answer

Lattice-based access control specifies t...

Question 2

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

Accepted Answer

A) True 
 B)False

Question 3

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer) is referred to as which of the following?

Accepted Answer

A)   access control list
B)   capabilities table 
C)   access matrix
D)   sensitivity levelE) B) and C)
F) A) and D) A

Question 4

A security blueprint is the outline of the more thorough security framework.

Accepted Answer

A) True 
 B)False

Question 5

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

Accepted Answer

A)   Blueprint
B)   DAC
C)   content-dependent access controls
D)   rule-based access controls
E)   separation of dutiesF)  sensitivity levelsG)  storage channelsH)  task-based controlsI)  timing channelsJ) TCBK) F) and G)
L) E) and J)

Question 6

A framework or security model customized to an organization,including implementation details.

Accepted Answer

A)   Blueprint
B)   DAC
C)   content-dependent access controls
D)   rule-based access controls
E)   separation of dutiesF)  sensitivity levelsG)  storage channelsH)  task-based controlsI)  timing channelsJ) TCBK) None of the above
L) I) and J)

Question 7

Which of the following specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle?

Accepted Answer

A)   Discretionary access controls
B)   Task-based access controls 
C)   Security clearances
D)   Sensitivity levelsE) B) and C)
F) C) and D)

Question 8

In information security,a framework or security model customized to an organization,including implementation details is known as a floorplan.

Accepted Answer

A) True 
 B)False

Question 9

Which piece of the Trusted Computing Base's security system manages access controls?

Accepted Answer

A)   trusted computing base
B)   reference monitor 
C)   covert channel
D)   verification moduleE) C) and D)
F) A) and B)

Question 10

​Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Accepted Answer

A) True 
 B)False

Question 11

What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Accepted Answer

​For most information,the U.S.military uses a three-level classification scheme for information deemed to be National Security Information (NSI),as defined in Executive Order 12958 in 1995 and Executive Order 13526 in 2009.Here are the classifications along with descriptions from the document: Sec.1.2.Classification Levels.
(a)Information may be classified at one of the following three levels: 
1)"Top Secret" shall be applied to information,the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security that the original classification authority is able to identify or describe.
2)"Secret" shall be applied to information,the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the original classification authority is able to identify or describe.
3)"Confidential" shall be applied to information,the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the original classification authority is able to identify or describe. ​

Question 12

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure.

Accepted Answer

A) True 
 B)False

Question 13

Access is granted based on a set of rules specified by the central authority.

Accepted Answer

A)   Blueprint
B)   DAC
C)   content-dependent access controls
D)   rule-based access controls
E)   separation of dutiesF)  sensitivity levelsG)  storage channelsH)  task-based controlsI)  timing channelsJ) TCBK) D) and J)
L) B) and G) D

Question 14

Access controls are build on three key principles. List and briefly define them.

Accepted Answer

Least privilege: The principle by which ...

Question 15

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"?

Accepted Answer

A)   Bell-LaPadula
B)   TCSEC 
C)   ITSEC
D)   Common CriteriaE) A) and D)
F) A) and C)

Question 16

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

Accepted Answer

A)   preventative
B)   deterrent 
C)   corrective
D)   compensatingE) All of the above
F) B) and C)

Question 17

A time-release safe is an example of which type of access control?

Accepted Answer

A)   content-dependent
B)   constrained user interface 
C)   temporal isolation
D)   nondiscretionaryE) A) and D)
F) A) and C)

Question 18

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know.

Accepted Answer

A) True 
 B)False

Question 19

According to COSO,internal control is a process designed to provide reasonable assurance regarding the achievement of objectives in what three categories?

Accepted Answer

Effectiveness and efficiency o...

Question 20

A TCSEC-defined covert channel,which transmit information by managing the relative timing of events.

Accepted Answer

A)   Blueprint
B)   DAC
C)   content-dependent access controls
D)   rule-based access controls
E)   separation of dutiesF)  sensitivity levelsG)  storage channelsH)  task-based controlsI)  timing channelsJ) TCBK) C) and J)
L) B) and G)

Exam 8: Security Management Models

Lattice-based access controls use a two-dimensional matrix to assign authorizations,what are the two dimensions and what are they called?

Correct Answer
verified
Lattice-based access control specifies t...
View Answer

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

Correct Answer
verified

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer) is referred to as which of the following?

Correct Answer
verified
A

A security blueprint is the outline of the more thorough security framework.

Correct Answer
verified

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

Correct Answer
verified

A framework or security model customized to an organization,including implementation details.

Correct Answer
verified

Which of the following specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle?

Correct Answer
verified

In information security,a framework or security model customized to an organization,including implementation details is known as a floorplan.

Correct Answer
verified

Which piece of the Trusted Computing Base's security system manages access controls?

Correct Answer
verified

Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Correct Answer
verified

What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure.

Correct Answer
verified

Access is granted based on a set of rules specified by the central authority.

Correct Answer
verified
D

Access controls are build on three key principles. List and briefly define them.

Correct Answer
verified
Least privilege: The principle by which ...
View Answer

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"?

Correct Answer
verified

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

Correct Answer
verified

A time-release safe is an example of which type of access control?

Correct Answer
verified

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know.

Correct Answer
verified

According to COSO,internal control is a process designed to provide reasonable assurance regarding the achievement of objectives in what three categories?

Correct Answer
verified
Effectiveness and efficiency o...
View Answer

A TCSEC-defined covert channel,which transmit information by managing the relative timing of events.

Correct Answer
verified

Exam 8: Security Management Models

Lattice-based access controls use a two-dimensional matrix to assign authorizations,what are the two dimensions and what are they called?

Correct AnswerverifiedLattice-based access control specifies t...View AnswerShow Answer

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

Correct AnswerverifiedShow Answer

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer) is referred to as which of the following?

Correct AnswerverifiedA

A security blueprint is the outline of the more thorough security framework.

Correct AnswerverifiedShow Answer

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

Correct AnswerverifiedShow Answer

A framework or security model customized to an organization,including implementation details.

Correct AnswerverifiedShow Answer

Which of the following specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle?

Correct AnswerverifiedShow Answer

In information security,a framework or security model customized to an organization,including implementation details is known as a floorplan.

Correct AnswerverifiedShow Answer

Which piece of the Trusted Computing Base's security system manages access controls?

Correct AnswerverifiedShow Answer

​Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Correct AnswerverifiedShow Answer

What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure.

Correct AnswerverifiedShow Answer

Access is granted based on a set of rules specified by the central authority.

Correct AnswerverifiedD

Access controls are build on three key principles. List and briefly define them.

Correct AnswerverifiedLeast privilege: The principle by which ...View AnswerShow Answer

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"?

Correct AnswerverifiedShow Answer

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

Correct AnswerverifiedShow Answer

A time-release safe is an example of which type of access control?

Correct AnswerverifiedShow Answer

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know.

Correct AnswerverifiedShow Answer

According to COSO,internal control is a process designed to provide reasonable assurance regarding the achievement of objectives in what three categories?

Correct AnswerverifiedEffectiveness and efficiency o...View AnswerShow Answer

A TCSEC-defined covert channel,which transmit information by managing the relative timing of events.

Correct AnswerverifiedShow Answer

Correct Answer
verified
Lattice-based access control specifies t...
View Answer

Correct Answer
verified

Correct Answer
verified
A

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
D

Correct Answer
verified
Least privilege: The principle by which ...
View Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
Effectiveness and efficiency o...
View Answer

Correct Answer
verified