CAP Security Architecture & Engineering 2

Question 1

Which security principle states that a failed security mechanism should deny access rather than allow it?

Accepted Answer

Fail-safe defaults

Answer

Fail-safe defaults means that when a system or security control fails, it defaults to a secure state — denying access rather than permitting it.

Question 2

What does the security architecture principle of 'complete mediation' require?

Accepted Answer

Every access to every object must be checked against the access control policy each time access is attempted

Answer

Complete mediation requires that every access request to every object is validated against access controls each time, with no caching of previous authorization decisions.

Question 3

In federal security architecture, what is a 'common control' as defined in NIST guidance?

Accepted Answer

A security control whose implementation is managed by an external entity and can be inherited by multiple information systems

Answer

Common controls are security controls provided by an organizational entity (e.g., a data center team) and inherited by multiple information systems, reducing duplicated implementation effort.

Question 4

In the Biba Integrity Model, what does the 'simple integrity axiom' (no read down) state?

Accepted Answer

A subject cannot read objects at a lower integrity level than its own

Answer

The simple integrity axiom prevents a subject from reading data at a lower integrity level, protecting the subject from contamination by less-trusted data.

Question 5

What is the significance of 'security categorization' as the first step of the RMF for security architecture decisions?

Accepted Answer

It determines the potential impact (Low, Moderate, High) of a breach of confidentiality, integrity, or availability, driving control baseline selection

Answer

Security categorization using FIPS 199 determines the system's impact level, which in turn determines the appropriate baseline of security controls from NIST SP 800-53B.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Security Architecture & Engineering 2