- A holistic lifecycle for developing security architecture that begins with assessing business requirements and subsequently creating a ‘chain of traceability’ through phases of strategy, concept, design, implementation and metrics is characteristic of which of the following frameworks?
A. Zachman
B. SABSA
C. ISO 27000
D. TOGAF
B
- While an Enterprise Security Architecture (ESA) can be applied in many different ways, it is focused on a few key goals. Identify the proper listing of the goals for the ESA:
A. It represents a simple, long term view of control, it provides a unified vision for common security controls, it leverages existing technology investments, it provides a fixed approach to current and future threats and also the needs of peripheral functions
B. It represents a simple, long term view of control, it provides a unified vision for common security controls, it leverages new technology investments, it provides a flexible approach to current and future threats and also the needs of core functions
C. It represents a complex, short term view of control, it provides a unified vision for common security controls, it leverages existing technology investments, it provides a flexible approach to current and future threats and also the needs of core functions.
D. It represents a simple, long term view of control, it provides a unified vision for common security controls, it leverages existing technology investments, it provides a flexible approach to current and future threats and also the needs of core functions
D
- Which of the following can BEST be used to capture detailed security requirements?
A. Threat modeling, covert channels, and data classification
B. Data classification, risk assessments, and covert channels
C. Risk assessments, covert channels, and threat modeling
D. Threat modeling, data classification, and risk assessments
D
- Which of the following security standards is internationally recognized as the standards for sound security practices and is focused on the standardization and certification of an organization’s Information Security Management System (ISMS)?
A. ISO 15408
B. ISO 27001
C. ISO 9001
D. ISO 9146
B
- Which of the following describes the rules that need to be implemented to ensure that the security requirements are met?
A. Security kernel
B. Security policy
C. Security model
D. Security reference monitor
B
- A two-dimensional grouping of individual subjects into groups or roles and granting access to groups to objects is an example of which of the following types of models?
A. Multilevel lattice
B. State machine
C. Non-interference
D. Matrix-based
D
- Which of the following models ensures that a subject with clearance level of ‘Secret’ has the ability to write only to objects classified as ‘Secret’ or ‘Top Secret’ but is prevented from writing information classified as ‘Public’?
A. Biba-Integrity
B. Clark-Wilson
C. Brewer-Nash
D. Bell-LaPadula
D
- Which of the following is unique to the Biba Integrity Model?
A. Simple property
B. * (star) property
C. Invocation property
D. Strong * property
C
- Which of the following models is BEST considered in a shared data-hosting environment so that the data of one customer is not disclosed to a competitor or other customers sharing that hosted environment?
A. Brewer-Nash
B. Clark-Wilson
C. Bell-LaPadula
D. Lipner
A
- Which of the following security models is primarily concerned with how the subjects and objects are created and how subjects are assigned rights or privileges?
A. Bell-LaPadula
B. Biba-Integrity
C. Chinese Wall
D. Graham-Denning
D
- Which of the following ISO standards provides the evaluation criteria that can be used to evaluate security requirements of different products with different functions?
A. 15408
B. 27000
C. 9100
D. 27002
A
- In the Common Criteria, the common set of functional and assurance requirements for a category of vendor products deployed in a particular type of environment are known as:
A. Protection Profiles
B. Security Target
C. Trusted Computing Base
D. Ring Protection
A
- Which of the following evaluation assurance level that is formally verified, designed and tested is expected for high risk situation?
A. EAL 1
B. EAL 3
C. EAL 5
D. EAL 7
D
- Formal acceptance of an evaluated system by management is known as:
A. Certification
B. Accreditation
C. Validation
D. Verification
B
- Which stage of the Capability Maturity Model (CMM) is characterized by having organizational processes that are proactive?
A. Initial
B. Managed
C. Defined
D. Optimizing
C
- Which of the following BEST provides a method of quantifying risks associated with information technology when validating the abilities of new security controls and countermeasures to address the identified risks?
A. Threat/risk assessment
B. Penetration testing
C. Vulnerability assessment
D. Data classification
A
- The TCSEC identifies two types of covert channels, what are they? (Choose TWO)
A. Storage
B. Boundary
C. Timing
D. Monitoring
A|C
- Which of the following is the main reason for security concerns in mobile computing devices?
A. The 3G/4G protocols are inherently insecure
B. Lower processing power
C. Hackers are targeting mobile devices
D. The lack of anti-virus software.
B
- In decentralized environments device drivers that enable the OS to control and communicate with hardware need to be securely designed, developed and deployed because they are:
A. Typically installed by end-users and granted access to the supervisor state
B. Typically installed by administrators and granted access to user mode state
C. Typically installed by software without human interaction.
D. Integrated as part of the operating system.
A
- A system administrator grants rights to a group of individuals called “Accounting” instead of granting rights to each individual. This is an example of which of the following security mechanisms?
A. Layering
B. Data hiding
C. Cryptographic protections
D. Abstraction
D
- Asymmetric key cryptography is used for the following:
A. Encryption of data, Access Control, Steganography
B. Steganography, Access control, Nonrepudiation
C. Nonrepudiation, Steganography, Encryption of Data
D. Encryption of Data, Nonrepudiation, Access Control
D
- Which of the following supports asymmetric key cryptography?
A. Diffie-Hellman
B. Rijndael
C. Blowfish
D. SHA-256
A
- What is an important disadvantage of using a public key algorithm compared to a symmetric algorithm?
A. A symmetric algorithm provides better access control.
B. A symmetric algorithm is a faster process.
C. A symmetric algorithm provides nonrepudiation of delivery.
D. A symmetric algorithm is more difficult to implement.
B
- When a user needs to provide message integrity, what option is BEST?
A. Send a digital signature of the message to the recipient
B. Encrypt the message with a symmetric algorithm and send it
C. Encrypt the message with a private key so the recipient can decrypt it with the corresponding public key
D. Create a checksum, append it to the message, encrypt the message, and then send to recipient
D
-
Domain 1 - Security and Risk Management37
-
Domain 2 - Asset Security16
-
Domain 3 - Security Engineering40
-
Domain 4 - Communications & Network Security20
-
Domain 5 - Identity & Access Management18
-
Domain 6 - Security Assessment & Testing12
-
Domain 7 - Security Operations35
-
Domain 8 - Security in the Software Development Life Cycle22
-
All 8 Domains200
