Exam 8: Security Management Models

The Information Technology Infrastructure Library (ITIL)is a collection of policies andpractices for managing the development and operation of IT infrastructures.____________

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

One of the TCSEC's covert channels,which communicate by modifying a stored object.

Which of the following is NOT a change control principle of the Clark-Wilson model?

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure.

To design a security program,an organization can use a(n)____________________,which is a generic outline of the more thorough and organization-specific blueprint offered by a service organization.

What are the five principles that are focused on the governance and management of IT as specified by COBIT 5?

Which of the following is a generic blueprint offered by a service organization which must be flexible,scalable,robust,and detailed?

Lattice-based access control specifies the level of access each subject has to each object,if any.

Controls access to a specific set of information based on its content.

Controls implemented at the discretion or option of the data user.

____________________ channels are unauthorized or unintended methods of communications hidden inside a computer system,and include storage and timing channels.

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

In information security,a specification of a model to be followed during the design,selection,and initial and ongoing implementation of all subsequent security controls is known as a blueprint.____________

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as which of the following?

In a lattice-based access control,a restriction table is the row of attributes associated with aparticular subject (such as a user). ____________

Within TCSEC,the combination of all hardware,firmware,andsoftware responsible for enforcing the security policy.

Which piece of the Trusted Computing Base's security system manages access controls?

Which control category discourages an incipient incident?

Lattice-based access controls use a two-dimensional matrix to assign authorizations,what are the two dimensions and what are they called?