Security Models & Secure Design Practice Questions

Answers and explanations appear when you work through the set above.

1. A system processes classified reports and must prevent a user cleared for Secret data from reading Top Secret data or writing Secret data derived from a Top Secret report. Which model BEST expresses these confidentiality rules?

   • Biba
   • Bell-LaPadula
   • Clark-Wilson
   • Brewer-Nash

2. A laboratory wants analysts to avoid contaminating trusted measurements with data from unvalidated sources. Which model and rule combination is MOST appropriate?

   • Bell-LaPadula, no read up
   • Brewer-Nash, dynamic exclusion of competing clients
   • Biba, no read down and no write up
   • Graham-Denning, creation and deletion of subjects

3. An auditor requires that financial records can be changed only through approved programs, with separation between the person who initiates a change and the person who certifies it. Which model BEST fits this requirement?

   • Brewer-Nash
   • Bell-LaPadula
   • Biba
   • Clark-Wilson

4. A consulting firm serves competing clients. After an attorney views one client's merger documents, the firm must prevent that attorney from accessing the competing client's related documents. Which security model is the BEST match?

   • Brewer-Nash
   • Biba
   • Clark-Wilson
   • Bell-LaPadula

5. During a security architecture review, which property is MOST important for the component that mediates every subject's access to an object?

   • It must expose a large administrative interface so every exception can be configured
   • It must depend on application developers to invoke it for sensitive requests
   • It must be tamper-resistant, always invoked, and small enough to analyze
   • It must run all user applications in the most privileged processor ring

6. A kernel design places device drivers in a less privileged ring than the core kernel and requires controlled transitions for privileged operations. What security benefit is the architect seeking?

   • Mandatory conflict-of-interest enforcement between business clients
   • Isolation limiting damage from compromised components
   • Confidentiality enforcement based on classification labels alone
   • Cryptographic key storage that survives operating-system replacement

7. A procurement team is comparing Common Criteria products. Which statement BEST describes what increasing from EAL2 to EAL4 generally indicates?

   • The product automatically provides stronger encryption algorithms
   • The product has passed a universal penetration test against every threat
   • The product is guaranteed to be free of vulnerabilities
   • The product has undergone more independently assessed assurance activities

8. A security manager wants a layered architecture in which compromise of one control does not immediately expose sensitive data. Which design principle BEST supports this objective?

   • Independent preventive, detective, and corrective layers
   • Open design, withholding implementation details from independent reviewers to keep control mechanisms confidential
   • Least privilege, giving each service broad access to reduce failures
   • Single sign-on as a replacement for every other security safeguard

9. An organization needs to protect a server's private signing keys while also measuring the boot state and isolating a sensitive computation from the host operating system. Which mapping is MOST accurate?

   • TPM for high-volume key custody, HSM for boot measurements, secure enclave for firewall routing
   • TPM for conflict-of-interest policy; HSM for financial integrity labels; enclave for transaction certification
   • TPM: platform measurements and protected small secrets; HSM: dedicated key operations; enclave: isolated code and data
   • TPM for user authorization, HSM for ring transitions, secure enclave for audit retention