Question 1

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as which of the following?

Accepted Answer

A)  access control list 
B)  capabilities table 
C)  access matrix 
D)  sensitivity level 
A)  access control list 
B)  capabilities table 
C)  access matrix 
D)  sensitivity level A

Question 2

Access is granted based on a set of rules specified by the central authority.

Accepted Answer

A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB 
A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB D

Question 3

What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Accepted Answer

​For most information,the U.S.military uses a three-level classification scheme for information deemed to be National Security Information (NSI),as defined in Executive Order 12958 in 1995 and Executive Order 13526 in 2009.Here are the classifications along with descriptions from the document: Sec.1.2.Classification Levels.
(a)Information may be classified at one of the following three levels: 
1)"Top Secret" shall be applied to information,the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security that the original classification authority is able to identify or describe.
2)"Secret" shall be applied to information,the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the original classification authority is able to identify or describe.
3)"Confidential" shall be applied to information,the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the original classification authority is able to identify or describe. ​

Question 4

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

Accepted Answer

A)  preventative 
B)  deterrent 
C)  corrective 
D)  compensating 
A)  preventative 
B)  deterrent 
C)  corrective 
D)  compensating

Question 5

Access controls are build on three key principles. List and briefly define them.

Accepted Answer

Least privilege: The principle by which

Question 6

​Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Accepted Answer

A) True 
 B)False

Question 7

Lattice-based access controls use a two-dimensional matrix to assign authorizations,what are the two dimensions and what are they called?

Accepted Answer

Lattice-based access control specifies t

Question 8

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

Accepted Answer

A) True 
 B)False

Question 9

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

Accepted Answer

A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB 
A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB

Question 10

A security blueprint is the outline of the more thorough security framework.

Accepted Answer

A) True 
 B)False

Question 11

Which piece of the Trusted Computing Base's security system manages access controls?

Accepted Answer

A)  trusted computing base 
B)  reference monitor 
C)  covert channel 
D)  verification module 
A)  trusted computing base 
B)  reference monitor 
C)  covert channel 
D)  verification module

Question 12

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know.

Accepted Answer

A) True 
 B)False

Question 13

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"?

Accepted Answer

A)  Bell-LaPadula 
B)  TCSEC 
C)  ITSEC 
D)  Common Criteria 
A)  Bell-LaPadula 
B)  TCSEC 
C)  ITSEC 
D)  Common Criteria

Question 14

A framework or security model customized to an organization,including implementation details.

Accepted Answer

A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB 
A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB

Question 15

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure.

Accepted Answer

A) True 
 B)False

Question 16

A TCSEC-defined covert channel,which transmit information by managing the relative timing of events.

Accepted Answer

A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB 
A)  Blueprint 
B)  DAC 
C)  content-dependent access controls 
D)  rule-based access controls 
E)  separation of duties
F) sensitivity levels
G) storage channels
H) task-based controls
I) timing channels
J)TCB

Question 17

A time-release safe is an example of which type of access control?

Accepted Answer

A)  content-dependent 
B)  constrained user interface 
C)  temporal isolation 
D)  nondiscretionary 
A)  content-dependent 
B)  constrained user interface 
C)  temporal isolation 
D)  nondiscretionary

Question 18

Which of the following specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle?

Accepted Answer

A)  Discretionary access controls 
B)  Task-based access controls 
C)  Security clearances 
D)  Sensitivity levels 
A)  Discretionary access controls 
B)  Task-based access controls 
C)  Security clearances 
D)  Sensitivity levels

Question 19

According to COSO,internal control is a process designed to provide reasonable assurance regarding the achievement of objectives in what three categories?

Accepted Answer

Effectiveness and efficiency o

Question 20

In information security,a framework or security model customized to an organization,including implementation details is known as a floorplan.

Accepted Answer

A) True 
 B)False

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as which of the following?

Access is granted based on a set of rules specified by the central authority.

What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

Access controls are build on three key principles. List and briefly define them.

Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Lattice-based access controls use a two-dimensional matrix to assign authorizations,what are the two dimensions and what are they called?

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

A security blueprint is the outline of the more thorough security framework.

Which piece of the Trusted Computing Base's security system manages access controls?

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know.

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"?

A framework or security model customized to an organization,including implementation details.

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure.

A TCSEC-defined covert channel,which transmit information by managing the relative timing of events.

A time-release safe is an example of which type of access control?

Which of the following specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle?

According to COSO,internal control is a process designed to provide reasonable assurance regarding the achievement of objectives in what three categories?

In information security,a framework or security model customized to an organization,including implementation details is known as a floorplan.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 8: Security Management Models

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as which of the following?

Access is granted based on a set of rules specified by the central authority.

What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

Access controls are build on three key principles. List and briefly define them.

​Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Lattice-based access controls use a two-dimensional matrix to assign authorizations,what are the two dimensions and what are they called?

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

A security blueprint is the outline of the more thorough security framework.

Which piece of the Trusted Computing Base's security system manages access controls?

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know.

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"?

A framework or security model customized to an organization,including implementation details.

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure.

A TCSEC-defined covert channel,which transmit information by managing the relative timing of events.

A time-release safe is an example of which type of access control?

Which of the following specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle?

According to COSO,internal control is a process designed to provide reasonable assurance regarding the achievement of objectives in what three categories?

In information security,a framework or security model customized to an organization,including implementation details is known as a floorplan.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Dumpster delving is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information.