CISSP Security Architecture and Engineering Practice Test 3 — 15 Questions

Question 1

A security analyst is evaluating access control models for a healthcare organization that needs to enforce both confidentiality and integrity. Which TWO models should be considered? Select two.

Accepted Answer

Bell-LaPadula. Bell-LaPadula (B) is correct because it is the classic mandatory access control model designed to enforce confidentiality through the no-read-up and no-write-down rules, which fits the healthcare requirement to protect sensitive patient data from unauthorized disclosure. Biba (C) is correct because it is the complementary integrity model that enforces no-read-down and no-write-up, preventing untrusted or lower-integrity data from corrupting higher-integrity records, which addresses the stated need to enforce integrity. Together these two models directly map to the scenario's dual requirement for confidentiality and integrity. Take-Grant (A) is not the best fit because it focuses on modeling how rights can be transferred or granted in a graph-based access control system rather than enforcing confidentiality or integrity policies. Clark-Wilson (D) is an integrity model based on well-formed transactions and separation of duties, but it does not enforce confidentiality, so it does not satisfy both requirements. Brewer-Nash (E) is the Chinese Wall model, which addresses conflict-of-interest access control rather than the general confidentiality and integrity enforcement described here.

Answer

Take-Grant

Answer

Clark-Wilson

Answer

Brewer-Nash

Question 2

A security engineer is hardening a system against side-channel attacks that exploit variations in execution time or power consumption. Which TWO mitigations are specifically designed to counter such attacks? Select two.

Accepted Answer

Constant-time algorithms. Constant-time programming ensures operations take the same time regardless of inputs, and noise injection obscures power consumption patterns.

Answer

Data Execution Prevention (DEP)

Answer

Address Space Layout Randomization (ASLR)

Answer

Input validation

Question 3

A government agency requires a security model that prevents users from reading documents classified above their clearance level and from writing classified information to lower-level systems. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model focused on confidentiality, enforcing 'no read up' (simple security property) and 'no write down' (star property). These two rules exactly match the requirement: users cannot read above their clearance and cannot write classified data to lower levels. Biba, Brewer-Nash, and Clark-Wilson address integrity or conflict-of-interest, not confidentiality.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson

Question 4

An organization requires a commercial integrity model where users cannot modify data in higher integrity levels and cannot read data from lower integrity levels. Which model should they implement?

Accepted Answer

Biba. The Biba integrity model is the classic commercial integrity model that enforces 'no write up, no read down' — users cannot modify data at a higher integrity level and cannot read data at a lower integrity level. This exactly matches the scenario described, making Biba the correct choice.

Answer

Bell-LaPadula

Answer

Clark-Wilson

Answer

Take-Grant

Question 5

Which access control model allows the data owner to determine who can access their resources, typically using Access Control Lists (ACLs)?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is defined by the property that the owner of a resource decides who can access it and with what permissions, typically by configuring Access Control Lists (ACLs) on the object. This owner-controlled discretion is the defining characteristic that separates DAC from MAC, RBAC, and ABAC. In DAC systems like Windows NTFS or Unix file permissions, the resource owner can grant or revoke access at will.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 6

A security architect is implementing a system that must prevent conflicts of interest for a consulting firm serving competing clients. Which security model is best suited for this requirement?

Accepted Answer

Brewer-Nash. The Brewer-Nash model (also called the Chinese Wall model) is specifically designed to prevent conflicts of interest by dynamically restricting access based on what a subject has already accessed. Once a consultant accesses data from one competing client, they are blocked from accessing data about that client's competitors. This dynamic, history-based access control is exactly what the scenario requires.

Answer

Take-Grant

Answer

Clark-Wilson

Answer

Graham-Denning

Question 7

A company is deploying a hypervisor to run multiple virtual servers. To minimize the risk of VM escape attacks, which type of hypervisor should they choose and what hardening measure is most effective?

Accepted Answer

Type 1 hypervisor with minimal services and regular patching. A Type 1 (bare-metal) hypervisor runs directly on the hardware with a much smaller attack surface than a Type 2 hypervisor, which sits atop a general-purpose host OS full of exploitable services. Minimizing installed services and applying regular patches further shrinks the attack surface and closes known VM-escape vulnerabilities. Together, these are the most effective mitigations for VM escape risk.

Answer

Type 2 hypervisor with regular patching

Answer

Type 2 hypervisor with host-based firewall

Answer

Type 1 hypervisor with no additional hardening

Question 8

An organization wants to implement a security mechanism that ensures all accesses are mediated and cannot be bypassed, is tamperproof, and is small enough to be verified. This describes which concept?

Accepted Answer

Reference Monitor. A reference monitor is the abstract security concept that enforces access control by mediating every access request between subjects and objects, is tamperproof, and is small enough to be verified. These three properties — complete mediation, tamperproofness, and verifiability — are the defining characteristics of a reference monitor as described in the Orange Book (TCSEC). It is the conceptual model that a security kernel implements in hardware and software.

Answer

Trusted Computing Base (TCB)

Answer

Trusted Platform Module (TPM)

Answer

Security Kernel

Question 9

Which cryptographic algorithm is an example of a symmetric stream cipher?

Accepted Answer

RC4. RC4 is a symmetric stream cipher that generates a pseudorandom keystream and XORs it with plaintext one byte at a time. It was widely used in WEP, WPA (TKIP), and SSL/TLS before being deprecated due to keystream biases. Stream ciphers encrypt data bit-by-bit or byte-by-byte, unlike block ciphers which process fixed-size blocks.

Answer

AES

Answer

3DES

Answer

RSA

Question 10

A security analyst is investigating a potential data leak via covert channels. Which of the following is an example of a timing covert channel?

Accepted Answer

Varying the spacing between keystrokes. A timing covert channel conveys information by modulating the timing of events rather than the content of messages. Varying the spacing between keystrokes encodes bits through inter-keystroke delays, which an observer can decode — this is a classic timing channel. The other options describe storage covert channels.

Answer

Modifying unused fields in network packets

Answer

Encoding data in the TCP sequence number

Answer

Writing data to a shared disk file

Question 11

A software vulnerability allows an attacker to overwrite a return address on the stack to execute arbitrary code. What mitigation technique randomizes the memory layout to prevent the attacker from predicting target addresses?

Accepted Answer

ASLR (Address Space Layout Randomization). ASLR (Address Space Layout Randomization) randomizes the base addresses of the stack, heap, and libraries each time a program runs, making it infeasible for an attacker to predict the exact address to overwrite a return pointer with. This directly defeats the return-to-libc and ROP techniques that depend on knowing target addresses. It is the canonical mitigation for memory-layout predictability.

Answer

Stack canary

Answer

Data Execution Prevention (DEP)

Answer

NX bit (No-Execute)

Question 12

A company wants to ensure that only authorized software can run on its laptops. They decide to use a hardware component that validates the boot process by measuring each component before it loads. Which technology is being used?

Accepted Answer

Trusted Platform Module (TPM). A Trusted Platform Module (TPM) is a dedicated hardware chip that performs cryptographic measurements of boot components — firmware, bootloader, and OS — storing hashes in Platform Configuration Registers (PCRs). These measurements enable a measured boot and, combined with secure boot, ensure only authorized, unmodified software loads. The question's emphasis on a hardware component validating the boot process by measuring each component maps directly to TPM's role.

Answer

Trusted Execution Environment (TEE)

Answer

Security Kernel

Answer

Hypervisor

Question 13

Which physical security concept uses natural surveillance, territorial reinforcement, and access control to deter crime in built environments?

Accepted Answer

CPTED. CPTED (Crime Prevention Through Environmental Design) is the discipline that applies natural surveillance, territorial reinforcement, and access control to the built environment to reduce crime and fear of crime. These three principles, along with maintenance and activity support, form the core CPTED framework used by security architects and urban planners. The question's three named elements map directly to CPTED's foundational principles.

Answer

TEMPEST

Answer

Faraday cage

Answer

Defense in depth

Question 14

In a PKI hierarchy, a relying party needs to verify a certificate's validity. To reduce latency and improve privacy, which mechanism allows the relying party to obtain the revocation status without contacting the CA directly for each verification?

Accepted Answer

OCSP stapling. OCSP stapling allows the certificate holder (web server) to periodically query the CA's OCSP responder and cache a signed, time-stamped OCSP response, which it then 'staples' to the TLS handshake. The relying party receives the revocation status directly from the server during the handshake, eliminating a separate round-trip to the CA and hiding the client's browsing activity from the CA. This reduces latency and improves privacy compared to traditional OCSP or CRL retrieval.

Answer

Certificate Transparency (CT) logs

Answer

Certificate pinning

Answer

Certificate Revocation List (CRL)

Question 15

A security architect is designing a system to protect against side-channel attacks that exploit electromagnetic emanations. Which TWO controls are most effective?

Accepted Answer

TEMPEST shielding. TEMPEST shielding (B) is correct because TEMPEST is the standard for reducing compromising emanations, including electromagnetic radiation from monitors, cables, and processors, that can leak data to nearby receivers; shielding enclosures and filtered power/communications lines directly mitigate this side-channel. A Faraday cage (E) is also correct because it blocks external electromagnetic fields and contains internal emissions, preventing EM leakage from being intercepted, which is the core defense against emanation-based side-channel attacks. Data encryption at rest (A) protects stored data but does not stop electromagnetic emissions from a running system. An intrusion detection system (C) monitors network or host activity for malicious behavior and does not address physical EM leakage. Time-based access controls (D) restrict when users may access resources and are irrelevant to electromagnetic side-channel exploitation.

Answer

Data encryption at rest

Answer

Intrusion detection system

Answer

Time-based access controls