CISSP Security Architecture and Engineering Practice Question
A security analyst is investigating a potential covert timing channel in a system. Which of the following characteristics best describes this type of channel?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It modulates the time between events to encode information
A covert timing channel uses the timing of events (e.g., response times) to transmit information, bypassing security controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It requires high bandwidth to be effective
Why it's wrong here
Covert timing channels inherently operate by subtly altering observable temporal characteristics of a shared system resource, such as CPU cycles or network packet inter-arrival times. This method prioritizes stealth over throughput, making them typically low-bandwidth communication mechanisms. Requiring high bandwidth would make such channels easily detectable due to significant resource consumption or unusual traffic patterns, thus defeating their covert nature and making them ineffective for clandestine data exfiltration.
- ✓
It modulates the time between events to encode information
Why this is correct
A covert timing channel encodes information by precisely modulating the temporal relationship between observable events within a shared system. This involves a sender manipulating the timing of an action, like delaying a process or altering packet transmission intervals, which a receiver then observes and decodes based on the temporal variations. For example, a short delay might represent a '0' bit, while a longer delay signifies a '1' bit, transmitting data without using explicit storage or direct communication channels.
- ✗
It uses storage locations not normally accessible to the sender and receiver
Why it's wrong here
This statement accurately describes a covert storage channel, not a timing channel. A storage channel operates by writing information to a shared resource's storage location, such as a temporary file, a shared memory segment, or a specific field in a system log, that is accessible to both the sender and receiver. The sender modifies the state of this storage, and the receiver detects the change to infer the transmitted data, without relying on temporal modulation.
- ✗
It uses encryption to hide the content of the communication
Why it's wrong here
Encryption is a cryptographic technique designed to protect the confidentiality and integrity of data by transforming it into an unreadable format, thereby hiding its content from unauthorized parties. However, encryption does not conceal the *existence* of the communication itself, nor does it inherently create a covert channel. Covert channels, by contrast, aim to hide the fact that communication is occurring at all, often by embedding data within legitimate-looking traffic or system behavior.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.