Cissp Study

Front 1

No Read Up, No Write Down describes what Security Model

Back 1

Bell LaPadula

Hint 1

Concerns Confidentiality only

Front 2

Biba, Clark Wilson, and Non-Interference models cover what aspect of security

Back 2

Integrity

Hint 2

Which among the CIA triad?

Front 3

Execution and memory space assigned to each process is called a _______ _______

Back 3

Protection Domain

Front 4

The Boundary that separates the TCB from the rest of the system.

Back 4

Security Perimeter

Front 5

Programming technique used to encapsulate methods and data in an object

Back 5

Information Hiding

Front 6

System component that manages and enforces access controls on objects

Back 6

Reference Monitor

Hint 6

Security Kernel

Front 7

Operates at the highest level of information classification where all users must have clearances for the highest level

Back 7

System High mode

Front 8

Lack of parameter checking leaves a system vulnerable to this type of attack

Back 8

Buffer overflow

Front 9

Also called a maintenance hook

Back 9

Trap door

Front 10

Attack that exploits difference in time when a security control is applied and a service is used

Back 10

TOC/TOU attack

Front 11

This recovery mode permits access by only privileged users from privileged terminals

Back 11

Maintenance mode

Front 12

Design where a component failure allows the system to continue to function

Back 12

Fault-tolerant

Front 13

Design where a failure causes termination of processes to protect the system from compromise

Back 13

Fail-safe

Front 14

Design where a failure causes non-critical processes to terminate, and system runs in a degraded state

Back 14

Fail-soft or Resilient

Front 15

Design where a failure causes the system to use backup spare components to compensate for failed ones

Back 15

Fail-over

Front 16

This standard includes levels of assurance, from D (Least secure) to A (Most secure)

Back 16

TCSEC (Trusted Computer Security Evaluation Criteria)

Front 17

TCSEC Minimal Protection (one class)

Back 17

D (Minimal Protection)

Front 18

TCSEC Discretionary Protection (two classes)

Back 18

C1 (User logon, Groups allowed)
C2 (Individual Logon, password, auditing)

Front 19

TCSEC Mandatory Protection (three classes)

Back 19

B1 (MAC)
B2 (MAC with Trusted path and assurance)
B3 (MAC with proven mathematical model)

Front 20

TCSEC Verified Protection (one class)

Back 20

A1 (Mathematical model must be proven)

Front 21

European counterpart to TCSEC

Back 21

ITSEC (Information Technology Security Evaluation Criteria)

Front 22

ITSEC separately evaluates ____ and _____

Back 22

Functionality and Assurance

Front 23

The ITSEC subject of an evaluation is called the ___ __ _____

Back 23

Target of Evaluation (TOE)

Front 24

Combination of ITSEC, TCSEC, and Canada's CTCPEC

Back 24

Common Criteria

Front 25

Unit of evaluations levels in the Common Criteria

Back 25

Evaluation Assurance Level
(EAL)

Front 26

4 Phases of DITSCAP and NIACAP accreditation

Back 26

1. Definition
2. Verification
3. Validation
4. Post Accreditation

Front 27

This Access Control model specifies the rights that a subject can transfer to an object, or that a subject can take from another subject.

Back 27

Take-Grant model

Front 28

TCSEC Level that addresses covert storage channels

Back 28

B2

Front 29

TCSEC level that addresses both covert storage and timing channels

Back 29

B3, A1

Front 30

Consolidation of power should not be allowed in a secure system, this is called

Back 30

Separation (or segregation) of duties

Front 31

Two operators are needed to perform a function. This is called

Back 31

Dual Control

Front 32

Two operators review and approve each other's work. This is called

Back 32

Two-man control

Front 33

Operators are given varying assignments for a time period, then their assignment changes. This is called

Back 33

Rotation of duties

Front 34

This type of recovery is required for only B3 and A1 TCSEC levels

Back 34

Trusted Recovery

Front 35

Operating system loaded without the front-end security enabled, is only done in this mode

Back 35

Single-user mode

Front 36

Required tracking of changes to a system under B2, B3, and A1 is called

Back 36

Configuation Management

Front 37

This refers to the data left on media after erasure

Back 37

Data Remanence

Front 38

Separation of duties, least privilege, personnel security, configuration control, Record retention, are examples of what type of controls?

Back 38

Administrative Controls

Front 39

Software controls, media controls, hardware controls, physical access controls are examples of what type of controls?

Back 39

Operations Controls

Front 40

A weakness in a system which might be exploited

Back 40

Vulnerability

Front 41

An event that can cause harm to a system and create a loss of C, I , A

Back 41

Threat

Front 42

EF

Back 42

Exposure Factor

Hint 42

(Percentage of Asset Loss caused by threat)

Front 43

SLE

Back 43

Single Loss Expectancy

Hint 43

(Asset Value x Exposure Factor)

Front 44

ARO

Back 44

Annualized Rate of Occurence

Hint 44

Frequency of threat occurence per year

Front 45

ALE

Back 45

Annualized Loss Expectancy

Hint 45

SLE x ARO