CAP Security Architecture & Engineering 2

Question 1

Which security principle states that a failed security mechanism should deny access rather than allow it?

Accepted Answer

Fail-safe defaults

Answer

Complete mediation

Answer

Open design

Answer

Separation of privilege

Question 2

What does the security architecture principle of 'complete mediation' require?

Accepted Answer

Every access to every object must be checked against the access control policy each time access is attempted

Answer

All access requests must pass through a single centralized security gateway

Answer

Security controls must be applied at every OSI network layer simultaneously

Answer

All users must complete multi-factor authentication before accessing any resource

Question 3

In federal security architecture, what is a 'common control' as defined in NIST guidance?

Accepted Answer

A security control whose implementation is managed by an external entity and can be inherited by multiple information systems

Answer

A security control implemented identically across all information systems in an agency

Answer

A mandatory baseline control that every federal system must implement regardless of categorization

Answer

A control shared between the system owner and the user community

Question 4

In the Biba Integrity Model, what does the 'simple integrity axiom' (no read down) state?

Accepted Answer

A subject cannot read objects at a lower integrity level than its own

Answer

A subject cannot write to objects at a higher integrity level than its own

Answer

A subject cannot read objects at a higher integrity level than its own

Answer

A subject cannot modify objects at a lower integrity level than its own

Question 5

What is the significance of 'security categorization' as the first step of the RMF for security architecture decisions?

Accepted Answer

It determines the potential impact (Low, Moderate, High) of a breach of confidentiality, integrity, or availability, driving control baseline selection

Answer

It assigns a dollar value to information assets to prioritize security spending

Answer

It classifies information as classified or unclassified for mandatory access control purposes

Answer

It ranks systems by the number of users to determine infrastructure scaling requirements

Question 6

Which security architecture concept describes using role assignments rather than individual user identities to determine access rights?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 7

What does the principle of 'economy of mechanism' require in secure system design?

Accepted Answer

Keeping security mechanisms as simple and small as possible to reduce the attack surface and ease verification

Answer

Selecting security products that offer the best value for the acquisition budget

Answer

Minimizing the number of security staff required to operate the system

Answer

Reducing operational security costs through automation wherever possible