ch 6

Under lattice-based access controls, the column of attributes associated with a particular object (such as a printer) is referred to as which of the following?

ACL

Which of the following provides advice about the implementation of sound controls and control objectives for InfoSec. and was created by the Information Systems Audit and Control Association (ISACA) and the IT Governance Institute?

COBIT

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

CORRECTIVE

A security blueprint is the outline of the more thorough security framework.

FALSE

Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure

FALSE

Under the Clark-Wilson model, internal consistency means that the system is consistent with similar data in the outside world.

FALSE

Under the Common Criteria, which term specifies the user-generated specifications for security requirements? a. Security Target (ST) b. Target of Evaluation (ToE) c. Protection Profile (PP) d. Security Functional Requirements (SFRs)

PP

Which of the following specifies the authorization classification of information asset an individual user is permitted to access, subject to the need-to-know principle? Discretionary access controls b. Sensitivity levels c. Security clearances d. Task-based access controls

Security clearances

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"? a. Common Criteria b. TCSEC c. Bell-LaPadula d. ITSEC

TCSEC

The COSO framework is built on five interrelated components. Which of the following is NOT one of them? a. Internal reporting b. Control activities c. Risk assessment d. Control environment

a. Internal reporting

Which of the following is NOT a category of access control? . preventative b. remitting c. deterrent d. compensating

b remitting

Which of the following is NOT one of the five levels in the U.S. military data classification scheme? a. top secret b. private c. secret d. confidential

b. private

Which security architecture model is based on the premise that higher levels of integrity are more worthy of trust than lower ones.

biba

Which of the following is NOT a change control principle of the Clark-Wilson model? a. The maintenance of internal and external consistency b. No unauthorized changes by authorized subjects c. No changes by authorized subjects without external validation d. No changes by unauthorized subjects

c

In the COSO framework, ___________ activities include those policies and procedures that support management directives.

control

____________________ channels are unauthorized or unintended methods of communications hidden inside a computer system, and include storage and timing channels.

covert

Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.

false

Which access control principle specifies that members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties? a. eyes only b. need-to-know c. separation of duties d. least privilege

least privilege

The ____________________ principle is based on the requirement that people are not allowed to view data simply because it falls within their level of clearance.

need-to-know

Which type of access controls can be role-based or task-based?

nondiscretionary controls

To design a security blueprint, an organization can use a(n) ____________________, which is a generic blueprint offered by a service organization.

security model

Which of the following is a generic blueprint offered by a service organization which must be flexible, scalable, robust, and detailed?

security model

A time-release safe is an example of which type of access control?

temporal isolation

Which of the following is NOT one of the five levels in the U.S. military data classification scheme? a. top secret b. private c. secret d. confidential

top secret

Lattice-based access control specifies the level of access each subject has to each object, if any.

true