CISSP Security Architecture and Engineering Practice Test 2 — 15 Questions

Question 1

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Covert timing channels modulate the timing of events to signal information. Covert storage channels write data to a shared resource that the other process can read.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 2

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

Accepted Answer

Card reader at building entrance. Layered physical security includes perimeter fencing, building access controls (e.g., card readers), and internal secure areas (e.g., server cages).

Answer

Antivirus software

Answer

Intrusion detection system on the network

Question 3

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula enforces no read up (simple security property) and no write down (*-property) to ensure confidentiality.

Answer

Brewer-Nash

Answer

Clark-Wilson

Answer

Biba

Question 4

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

Accepted Answer

Confidentiality. The described model is the Bell-LaPadula model, which enforces confidentiality. In Bell-LaPadula, subjects can read objects at or below their security level (read down) and write to objects at or above their level (write up). This prevents unauthorized access to higher classified information, ensuring confidentiality.

Answer

Integrity

Answer

Accountability

Answer

Availability

Question 5

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Accepted Answer

Clark-Wilson. Clark-Wilson model defines well-formed transactions and separation of duties to maintain commercial integrity.

Answer

Biba

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 6

Which access control model allows the owner of a resource to grant or deny access to other users?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) enables resource owners to control access.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 7

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) considers multiple attributes for access decisions.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 8

A security team is investigating a vulnerability where an attacker can intercept and modify data as it moves between processes within a CPU's secure enclave. Which technology is designed to protect against such attacks by creating a trusted execution environment?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel SGX provides a TEE that isolates code and data in enclaves, protecting from other processes.

Answer

Trusted Platform Module (TPM)

Answer

Measured Boot

Answer

Secure Boot

Question 9

Which cryptographic algorithm is a symmetric block cipher widely used for encrypting sensitive data, with key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with standard key sizes of 128, 192, and 256 bits.

Answer

RSA

Answer

RC4

Answer

ECC

Question 10

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

Accepted Answer

OCSP Stapling. OCSP stapling allows a TLS server to present a signed OCSP response from the CA, reducing load on the CA and providing timely revocation status.

Answer

Certificate Transparency Logs

Answer

Certificate Pinning

Answer

Self-Signed Certificates

Question 11

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

Accepted Answer

Disabling all unnecessary hypervisor services and applying security patches. Keeping the hypervisor patched and minimized reduces attack surface and addresses known vulnerabilities that could be exploited for VM escape.

Answer

Using Type 2 hypervisor only

Answer

Using VLANs to isolate VM traffic

Answer

Enabling VM snapshots for quick recovery

Question 12

A software developer is concerned about buffer overflow vulnerabilities. Which combination of mitigations makes it most difficult for an attacker to exploit a stack-based buffer overflow?

Accepted Answer

Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). Data Execution Prevention (DEP) prevents code execution on the stack, and Address Space Layout Randomization (ASLR) randomizes memory addresses, making it harder to predict target addresses.

Answer

Using a privileged account to run the application

Answer

Disabling stack protection

Answer

Stack canaries and NOP sleds

Question 13

Which type of covert channel uses the timing of events or operations to transmit information?

Accepted Answer

Timing channel. Timing channels manipulate the timing of events to encode data, while storage channels use shared resources.

Answer

Emanations channel

Answer

Side channel

Answer

Storage channel

Question 14

A security architect is designing a physical security system for a data center. Which of the following is an example of a layered physical control at the perimeter?

Accepted Answer

Fencing around the property. Fencing is a perimeter control that provides a physical barrier around the facility.

Answer

Biometric access to server room

Answer

Locked server cabinets

Answer

CCTV in the lobby

Question 15

A security analyst is evaluating access control models for a healthcare organization that needs to enforce both confidentiality and integrity. Which TWO models should be considered? Select two.

Accepted Answer

Bell-LaPadula. Bell-LaPadula enforces confidentiality; Biba enforces integrity. Together they address both requirements.

Answer

Take-Grant

Answer

Clark-Wilson

Answer

Brewer-Nash