Protect and Secure Systems and Data Flashcards

Which security model states that access decisions must be based on need-to-know in addition to security clearance?

Answer: Bell-LaPadula model

The Bell-LaPadula model enforces confidentiality by requiring both a valid security clearance and a need-to-know before a subject can access an object.

An incident responder finds that ransomware encrypted files on a file server. Which data protection control would have MOST reduced recovery time?

Answer: Immutable offline backups

Immutable offline backups cannot be modified or deleted by ransomware, allowing rapid recovery without paying a ransom.

A developer implements input validation to prevent SQL injection. This control is an example of:

Answer: Preventive control

Input validation stops malicious data from reaching the database layer before harm occurs, making it a preventive control.

Which protocol provides certificate status in real time without requiring clients to download a full CRL?

Answer: OCSP (Online Certificate Status Protocol)

OCSP allows a client to query a responder for the revocation status of a specific certificate in real time, without processing an entire CRL.

An organization classifies data as Public, Internal, Confidential, and Restricted. Which classification level would MOST likely require encryption in transit and at rest?

Answer: Restricted

Restricted data carries the highest sensitivity and regulatory risk, requiring the strongest controls including encryption both in transit and at rest.

A penetration tester is asked to evaluate the effectiveness of security controls without any prior knowledge of the target environment. This engagement type is called:

Answer: Black-box testing

Black-box testing simulates an external attacker with no prior knowledge, testing defenses as seen from outside the organization.

Which endpoint protection feature uses behavioral analysis to detect malware that has never been seen before?

Answer: Heuristic/behavioral analysis

Heuristic and behavioral analysis monitors how code acts at runtime, enabling detection of novel or obfuscated malware that lacks known signatures.