CAP Security Architecture & Engineering 3

Question 1

What does 'non-repudiation' provide in information system security architecture?

Accepted Answer

Assurance that an entity cannot later deny having performed a specific action or transaction

Answer

Assurance that data has not been altered in an unauthorized manner

Answer

Prevention of unauthorized access to sensitive information resources

Answer

Guarantee that authorized users can access information when required

Question 2

Which principle in secure design states that the security of a system should not depend on the secrecy of its design or implementation?

Accepted Answer

Open design

Answer

Least privilege

Answer

Fail-safe defaults

Answer

Psychological acceptability

Question 3

What is the purpose of 'tailoring' security controls during the RMF Select step?

Accepted Answer

Adjusting the baseline controls by applying scoping guidance, adding compensating controls, or specifying parameter values to match system-specific conditions

Answer

Choosing only the least expensive controls from the baseline to reduce implementation costs

Answer

Removing controls that the system owner deems unnecessary without documentation

Answer

Upgrading all controls to the High baseline regardless of the system's categorization level

Question 4

In secure system architecture, what does 'data-at-rest' protection primarily address?

Accepted Answer

Encryption and access controls for data stored on physical media, databases, or file systems

Answer

Protection of data packets as they traverse networks between endpoints

Answer

Securing data held temporarily in volatile memory during processing

Answer

Controlling real-time access permissions to live transactional databases

Question 5

Which access control model evaluates multiple attributes (user, resource, environment) dynamically to make access decisions?

Accepted Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Question 6

Under the RMF, what is the role of 'inherited controls' in a system's security architecture?

Accepted Answer

Security controls provided and managed by an external entity (common control provider) that the system leverages rather than implementing independently

Answer

Controls automatically applied to all systems without any documentation or review required

Answer

Controls carried over from a previous version of the system without re-assessment

Answer

Default controls built into commercial software that require no agency configuration

Question 7

What does the 'psychological acceptability' principle in secure system design require?

Accepted Answer

Security mechanisms must be designed to be as minimally intrusive as possible so users will comply with them naturally

Answer

Security training must be psychologically assessed to ensure employees accept policies

Answer

Security administrators must be evaluated for psychological fitness before granting privileged access

Answer

System interfaces must be designed with color psychology principles to guide secure behavior