Access Control

Front 1

What is an example of discretionary access control?

Back 1

Identity-based access control

Front 2

The rule-based access control where access is determined by rules (such as the correspondence of clearance labels to classification labels) is a type of:

Back 2

Mandatory Access control

Front 3

Another type of non-discretionary access control is lattice-based access control. In this type of control a lattice model is applied. How is this type of access control concept applied?

Back 3

The pair of elements is the subject and object, and the subject has an upper bound equal or higher than the upper bound of the object being accessed.

Front 4

Which authentication mechanisms creates a problem for mobile users?

Back 4

address-based mechanism.

Front 5

Which is an example of discretionary access control?

Back 5

Identity-based access control

Front 6

The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:

Back 6

Detective/physical

Front 7

What is called the percentage of invalid subjects that are falsely accepted?

Back 7

False Acceptance Rate (FAR) or Type II Error

Front 8

Which BEST provides e-mail message authenticity and confidentiality?

Back 8

Signing the message using the sender's private key and encrypting the message using the receiver's public key

Front 9

Which type of attack consists of modifying the length and fragmentation offset fields in sequential IP packets?

Back 9

Teardrop attack

Front 10

What is the main difference between a Smurf and a Fraggle attack?

Back 10

A Smurf attack is ICMP-based and a Fraggle attack is UDP-based.

Front 11

ISO has defined five basic tasks related to network management:

Back 11

Fault management: Detects the devices that present some kind of fault.
Configuration management: Allows users to know, define and change remotely the configuration of any device.
Accounting resources: Holds the records of the resource usage in the WAN.
Performance management: Monitors usage levels and sets alarms when a threshold has been surpassed.
Security management: Detects suspicious traffic or users and generates alarms accordingly.

Front 12

In a stateful inspection firewall, data packets are captured by an inspection engine that is operating at the:

Back 12

Network or Transport Layer.

Front 13

What ISO/OSI layer do switches primarily operate at?

Back 13

Data link layer

Front 14

A hardware RAID implementation is usually:

Back 14

platform-independent.

Front 15

Which of the following Common Data Network Services is used to a shared printer or a print queue/spooler?

Back 15

Print services.

Front 16

What is the proper term to refer to a single unit of TCP data at the transport layer?

Back 16

TCP segment.

Front 17

To mitigate the risk of fire in your new data center, you plan to implement a heat-activated fire detector. Your requirement is to have the earliest warning possible of a fire outbreak. Which type of sensor would you select and where would you place it?

Back 17

Rate-of-rise temperature sensor and below the raised floors

Front 18

Which could be defined as the likelihood of a threat agent taking advantage of a vulnerability?

Back 18

A risk

Front 19

Which of the following is the best reason for the use of an automated risk analysis tool?

Back 19

Minimal information gathering is required due to the amount of information built into the tool.

Front 20

What is commonly used for retrofitting multilevel security to a database management system?

Back 20

A trusted front-end.

Front 21

What is based on the premise that the quality of a software product is a direct function of the quality of its associated software development and maintenance processes?

Back 21

The Software Capability Maturity Model (CMM)

Front 22

What is NOT a suitable method for distributing certificate revocation information?

Back 22

CA revocation mailing list

Front 23

A public key algorithm that does both encryption and digital signature is which of the following?

Back 23

RSA

Front 24

Which of the following is not an encryption algorithm?

Back 24

SHA-1

Front 25

What kind of Encryption technology does Verisign's SSL utilize?

Back 25

Hybrid: Symmetric and asymmetric cryptography

Front 26

What is the key size of the International Data Encryption Algorithm (IDEA)?

Back 26

128 bits

Front 27

There are more than 20 books in the Rainbow Series. Which one covers password management guidelines

Back 27

Green Book

Front 28

There are more than 20 books in the Rainbow Series. Which one covers Database Management System Interpretation?

Back 28

Lavender Book

Front 29

Which Rainbow book covers Trusted Network Interpretation?

Back 29

Red Book

Front 30

In the Bell-LaPadula model, the Star-property is also called:

Back 30

The confinement property

Front 31

What Bell LaPadula states that the classification of an object does not change while the object is being processed by the system?

Back 31

The Tranquillity property

Front 32

Configuration Management controls what?

Back 32

Auditing and controlling any changes to the Trusted Computing Base.

Front 33

Most threats come from:

Back 33

Errors and Omissions

Front 34

What is defined as a key distribution protocol that uses hybrid encryption to convey session keys that are used to encrypt data in IP packets?

Back 34

Simple Key-management for Internet Protocols (SKIP)

Front 35

What is an Internet IPsec protocol to negotiate, establish, modify, and delete security associations, and to exchange key generation and authentication data, independent of the details of any specific key generation technique, key establishment protocol, encryption algorithm, or authentication mechanism?

Back 35

Internet Security Association and Key Management Protocol (ISAKMP)

Front 36

What is defined as a key establishment protocol based on the Diffie-Hellman algorithm proposed for IPsec but superseded by IKE?

Back 36

OAKLEY

Front 37

What attribute is included in a X.509-certificate

Back 37

Distinguished name of the subject

Front 38

Who vouches for the binding between the data items in a digital certificate?

Back 38

Certification authority

Front 39

In a Public Key Infrastructure, how are public keys published?

Back 39

Through digital certificates.

Front 40

What key size is used by the Clipper Chip?

Back 40

80 bits

Front 41

What is NOT included in a Public Key Infrastructure (PKI)?

Back 41

Internet Key Exchange (IKE)

Front 42

the attacker has the ciphertext of several messages encrypted with the same encryption algorithm. Its goal is to discover the plaintext of the messages by figuring out the key used in the encryption process.

Back 42

ciphertext-only attack

Front 43

the attacker has the plaintext and the ciphertext of one or more messages

Back 43

known-plaintext attack

Front 44

the attacker can chose the ciphertext to be decrypted and has access to the resulting plaintext

Back 44

chosen-ciphertext attack

Front 45

What can best be described as a domain of trust that shares a single security policy and single management?

Back 45

A security domain

Front 46

What is defined as the hardware, firmware and software elements of a trusted computing base that implement the reference monitor concept?

Back 46

A security kernel

Front 47

In the Bell-LaPadula model, the Star-property is also called:

Back 47

The confinement property

Front 48

The Orange Book describes four hierarchical levels to categorize security systems. Which levels require mandatory protection?

Back 48

A and B

Front 49

What access control technique is also known as multilevel security?

Back 49

Mandatory access control

Front 50

In Mandatory Access Control, sensitivity labels contain what information?

Back 50

the item's classification and category set

Front 51

According to the Orange Book, which security level is the first to require a system to protect against covert timing channels?

Back 51

B3

Front 52

According to the Orange Book, which security level is the first to require configuration management?

Back 52

B2

Front 53

Which of the following uses a directed graph to specify the rights that a subject can transfer to an object, or that a subject can take from another subject?

Back 53

Take-Grant model

Front 54

What is another name for the Orange Book?

Back 54

The Trusted Computer System Evaluation Criteria (TCSEC)

Front 55

If an operating system permits executable objects to be used simultaneously by multiple users without a refresh of the objects, what security problem is most likely to exist?

Back 55

disclosure of residual data.

Front 56

Which Orange Book evaluation level is described as "Labeled Security Protection"?

Back 56

B1

Front 57

What corresponds to the type of memory addressing where the address location that is specified in the program instruction contains the address of the final desired location?

Back 57

Indirect addressing

Front 58

Which of the following is a tool used to supplement the UNIX/Linux filesystem integrity?

Back 58

Tripwire

Front 59

Which security model uses division of operations into different parts and requires different users to perform each part?

Back 59

Clark-Wilson model

Front 60

The Orange Book states that "Hardware and software features shall be provided that can be used to periodically validate the correct operation of the on-site hardware and firmware elements of the TCB [Trusted Computing Base]." This statement is the formal requirement for:

Back 60

System Integrity

Front 61

In what security mode can a system be operating if all users have the clearance to all data processed by the system, but might not have the need-to-know and formal access approval?

Back 61

Compartmented security mode

Front 62

Which TCSEC (Orange Book) rating or level requires the system to clearly identify functions of the security administrator to perform security-related functions?

Back 62

B3

Front 63

Compartmented Mode Workstations (CMW) are most similar to what Orange Book evaluation level?

Back 63

B3

Front 64

Which of the following is NOT a common integrity goal?

Back 64

Prevent paths that could lead to inappropriate disclosure.

Front 65

Which security model ensures that actions that take place at a higher security level do not affect actions that take place at a lower level?

Back 65

The noninterference model

Front 66

What is necessary for a subject to have read access to an object in a Multi-Level Security Policy?

Back 66

The subject's sensitivity label must dominate the object's sensitivity label

Front 67

Which of the following is a straightforward approach that provides access rights to subjects for objects?

Back 67

Access Matrix model

Front 68

What was developed by the National Computer Security Center (NCSC)?

Back 68

TCSEC

Front 69

What is not an Orange Book-defined operational assurance requirement?

Back 69

Configuration management

Front 70

Which of the following are required for Life-Cycle Assurance?

Back 70

Security Testing and Trusted distribution.

Front 71

What is necessary for a subject to have write access to an object in a Multi-Level Security Policy?

Back 71

The subject's sensitivity label must be dominated by the object's sensitivity label.

Front 72

What statement pertaining to the Trusted Computer System Evaluation Criteria (TCSEC) is incorrect?

Back 72

With TCSEC, functionality and assurance are evaluated separately.

Front 73

What can be defined as a formal declaration by a Designated Approving Authority where an information system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk?

Back 73

Accreditation

Front 74

What control requires that two persons are needed to perform a specific task to minimize errors and reduce fraud?

Back 74

Dual preventative control.

Front 75

What describes a computer processing architecture in which a language compiler or pre-processor breaks program instructions down into basic operations that can be performed by the processor at the same time?

Back 75

Very-Long Instruction-Word Processor (VLIW)

Front 76

How do the Information Labels of Compartmented Mode Workstations differ from the Sensitivity Levels of B3 evaluated systems?

Back 76

Information Labels contain more information than Sensitivity Labels, but are not used by the Reference Monitor to determine access permissions.

Front 77

What can best be defined as the process of independently assessing a system against a standard of comparison, such as evaluation criteria?

Back 77

Evaluation

Front 78

What is used to protect programs from all unauthorized modification or executional interference?

Back 78

A protection domain

Front 79

What increases the performance in a computer by overlapping the steps of different instructions?

Back 79

pipelining

Front 80

In what security mode can a system be operating if all users have the clearance or authorization and need-to-know to all data processed within the system?

Back 80

Dedicated security mode

Front 81

At what Orange Book evaluation levels are configuration management required?

Back 81

B2 and above

Front 82

At what Orange Book evaluation levels are design specification and verification required?

Back 82

B1 and above.

Front 83

A trusted system does NOT involve which of the following?

Back 83

Assurance that the security policy can be enforced in an efficient and reliable manner.

Front 84

cryptanalyst obtains a sample of ciphertext, without the plaintext associated with it. This data is relatively easy to obtain in many scenarios, but this attack is generally difficult, and requires a very large ciphertext sample.

Back 84

ciphertext-only attack

Front 85

is one in which the cryptanalyst obtains a sample of ciphertext and the corresponding plaintext as well.

Back 85

known-plaintext attack

Front 86

the cryptanalyst is able to choose a quantity of plaintext and then obtain the corresponding encrypted ciphertext.

Back 86

chosen-plaintext attack

Front 87

special case of chosen-plaintext attack in which the cryptanalyst is able to choose plaintext samples dynamically, and alter his or her choices based on the results of previous encryptions.

Back 87

adaptive-chosen-plaintext attack

Front 88

A cryptanalyst can mount an attack of this type in a scenario in which he has free use of a piece of decryption hardware, but is unable to extract the decryption key from it.

Back 88

adaptive-chosen-ciphertext

Front 89

Attack in which cryptanalyst may choose a piece of ciphertext and attempt to obtain the corresponding decrypted plaintext. This type of attack is generally most applicable to public-key cryptosystems.

Back 89

A chosen-ciphertext attack