Question 1

Bell-LaPadula security rules prevent information from being moved from a level of higher security to a level of lower security.

Accepted Answer

A) True 
 B)False

Question 2

Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.

Accepted Answer

A) True 
 B)False

Question 3

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)____.

Accepted Answer

A)  access control list 
B)  capabilities table 
C)  access control matrix 
D)  sensitivity level 
A)  access control list 
B)  capabilities table 
C)  access control matrix 
D)  sensitivity level

Question 4

____ controls cover security processes that are designed by the strategic planners and executed by security administrators.

Accepted Answer

A)  Operational 
B)  Management 
C)  Personnel 
D)  Technical 
A)  Operational 
B)  Management 
C)  Personnel 
D)  Technical

Question 5

One discretionary model is ____,in which access is granted based on a set of rules specified by the central authority.

Accepted Answer

A)  mandatory access controls 
B)  lattice-based access controls 
C)  role-based access controls 
D)  rule-based access controls 
A)  mandatory access controls 
B)  lattice-based access controls 
C)  role-based access controls 
D)  rule-based access controls

Question 6

Information Technology-Code of Practice for Information Security Management was originally published as British Standard BS7799.

Accepted Answer

A) True 
 B)False

Question 7

One of the key elements of the Clark-Wilson model is the unconstrained data item which is a data item with protected integrity._________________________

Accepted Answer

A) True 
 B)False

Question 8

To design a security blueprint,an organization can use a(n)____________________,which is a generic blueprint offered by a service organization.

Accepted Answer

The answer of To design a security blueprint,an organization can...

Question 9

The personnel security ____________________ structure assigns each user of an information asset an authorization level that identifies the level of information classification he or she can access.

Accepted Answer

The answer of The personnel security ____________________ structure assigns each...

Question 10

Providing information security for the information and information systems that support the operations and assets under their control is the primary responsibility of which group under the InfoSec governance framework?

Accepted Answer

A)  Board of directors/trustees 
B)  Senior executives 
C)  Senior managers 
D)  All employees and users 
A)  Board of directors/trustees 
B)  Senior executives 
C)  Senior managers 
D)  All employees and users

Question 11

The primary objective of the Committee of Sponsoring Organizations of the Treadway Commission (COSO),a private-sector initiative formed in 1985,is to identify the factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence._________________________

Accepted Answer

A) True 
 B)False

Question 12

Nondiscretionary controls can be based on roles or on a specified set of ____________________.

Accepted Answer

The answer of Nondiscretionary controls can be based on roles...

Question 13

In an access control matrix,as part of lattice-based controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)capability table._________________________

Accepted Answer

A) True 
 B)False

Question 14

Under the TCSEC model,the term ____ can be misleading-note that in this context,it means that components are part of the TCB security system,but it does not necessarily follow that they are all above reproach.

Accepted Answer

A)  reference monitor 
B)  trusted 
C)  covert 
D)  security policy 
A)  reference monitor 
B)  trusted 
C)  covert 
D)  security policy

Question 15

Within lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a capabilities table.

Accepted Answer

A) True 
 B)False

Question 16

There are six access controls methodologies categorized by their inherent characteristics.List and briefly define them.

Accepted Answer

Preventative: Controls that help an orga

Question 17

A convenience store safe that can only be opened during store hours is an example of the ____________________ isolation access control.

Accepted Answer

temporal

Question 18

Under the Common Criteria,____ is the user-generated specifications for security requirements.

Accepted Answer

A)  Target of Evaluation (To
E)  
B)  Protection Profile (PP) 
C)  Security Target (ST) 
D)  Security Functional Requirements (SFRs) 
A)  Target of Evaluation (To
E)  
B)  Protection Profile (PP) 
C)  Security Target (ST) 
D)  Security Functional Requirements (SFRs)

Question 19

The ITSEC is the international set of criteria for evaluating computer systems and is very similar to the TCSEC._________________________

Accepted Answer

A) True 
 B)False

Question 20

Which of the following is the primary purpose of ISO/IEC 27001:2005?

Accepted Answer

A)  Use within an organization to formulate security requirements and objectives 
B)  Implementation of business-enabling information security 
C)  Use within an organization to ensure compliance with laws and regulations 
D)  To enable organizations that adopt it to obtain certification 
A)  Use within an organization to formulate security requirements and objectives 
B)  Implementation of business-enabling information security 
C)  Use within an organization to ensure compliance with laws and regulations 
D)  To enable organizations that adopt it to obtain certification

Bell-LaPadula security rules prevent information from being moved from a level of higher security to a level of lower security.

Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)____.

____ controls cover security processes that are designed by the strategic planners and executed by security administrators.

One discretionary model is ____,in which access is granted based on a set of rules specified by the central authority.

Information Technology-Code of Practice for Information Security Management was originally published as British Standard BS7799.

One of the key elements of the Clark-Wilson model is the unconstrained data item which is a data item with protected integrity._________________________

To design a security blueprint,an organization can use a(n)____________________,which is a generic blueprint offered by a service organization.

The personnel security ____________________ structure assigns each user of an information asset an authorization level that identifies the level of information classification he or she can access.

Providing information security for the information and information systems that support the operations and assets under their control is the primary responsibility of which group under the InfoSec governance framework?

The primary objective of the Committee of Sponsoring Organizations of the Treadway Commission (COSO),a private-sector initiative formed in 1985,is to identify the factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence._________________________

Nondiscretionary controls can be based on roles or on a specified set of ____________________.

In an access control matrix,as part of lattice-based controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)capability table._________________________

Under the TCSEC model,the term ____ can be misleading-note that in this context,it means that components are part of the TCB security system,but it does not necessarily follow that they are all above reproach.

Within lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a capabilities table.

There are six access controls methodologies categorized by their inherent characteristics.List and briefly define them.

A convenience store safe that can only be opened during store hours is an example of the ____________________ isolation access control.

Under the Common Criteria,____ is the user-generated specifications for security requirements.

The ITSEC is the international set of criteria for evaluating computer systems and is very similar to the TCSEC._________________________

Which of the following is the primary purpose of ISO/IEC 27001:2005?

Introduction to the Management of Information Security

Planning for Security

Planning for Contingencies

Information Security Policy

Developing the Security Program

Security Management Practices

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Protection Mechanisms

Personnel and Security

Law and Ethics

Filters

Exam 6: Security Management Models

Bell-LaPadula security rules prevent information from being moved from a level of higher security to a level of lower security.

Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)____.

____ controls cover security processes that are designed by the strategic planners and executed by security administrators.

One discretionary model is ____,in which access is granted based on a set of rules specified by the central authority.

Information Technology-Code of Practice for Information Security Management was originally published as British Standard BS7799.

One of the key elements of the Clark-Wilson model is the unconstrained data item which is a data item with protected integrity._________________________

To design a security blueprint,an organization can use a(n)____________________,which is a generic blueprint offered by a service organization.

The personnel security ____________________ structure assigns each user of an information asset an authorization level that identifies the level of information classification he or she can access.

Providing information security for the information and information systems that support the operations and assets under their control is the primary responsibility of which group under the InfoSec governance framework?

The primary objective of the Committee of Sponsoring Organizations of the Treadway Commission (COSO),a private-sector initiative formed in 1985,is to identify the factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence._________________________

Nondiscretionary controls can be based on roles or on a specified set of ____________________.

In an access control matrix,as part of lattice-based controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)capability table._________________________

Under the TCSEC model,the term ____ can be misleading-note that in this context,it means that components are part of the TCB security system,but it does not necessarily follow that they are all above reproach.

Within lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a capabilities table.

There are six access controls methodologies categorized by their inherent characteristics.List and briefly define them.

A convenience store safe that can only be opened during store hours is an example of the ____________________ isolation access control.

Under the Common Criteria,____ is the user-generated specifications for security requirements.

The ITSEC is the international set of criteria for evaluating computer systems and is very similar to the TCSEC._________________________

Which of the following is the primary purpose of ISO/IEC 27001:2005?

Introduction to the Management of Information Security

Planning for Security

Planning for Contingencies

Information Security Policy

Developing the Security Program

Security Management Practices

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Protection Mechanisms

Personnel and Security

Law and Ethics

Filters