CISSP Security Architecture and Engineering Practice Question
A security analyst is investigating a potential data leak via covert channels. Which of the following is an example of a timing covert channel?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Varying the spacing between keystrokes
A timing covert channel uses variations in timing (e.g., response time) to encode information, rather than storing data in shared resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modifying unused fields in network packets
Why it's wrong here
Modifying unused fields within network packets constitutes a storage covert channel because the information is encoded by altering a specific, albeit often ignored, part of a data structure. The secret data is "stored" by changing the state of these fields, which are then transmitted. This method relies on the recipient being able to read and interpret the modified state of these fields, effectively using them as a temporary storage medium across the network.
- ✗
Encoding data in the TCP sequence number
Why it's wrong here
Encoding data within the TCP sequence number field represents a storage covert channel because the sequence number is a stateful component of a TCP connection. Information is conveyed by manipulating the numerical value of this field, which is maintained and tracked by both communicating endpoints. The secret data is "stored" within the sequence number's value, leveraging a legitimate protocol field to carry unauthorized information through its persistent state.
- ✗
Writing data to a shared disk file
Why it's wrong here
Writing data to a shared disk file is a quintessential example of a storage covert channel. In this scenario, the information is explicitly "stored" on a persistent medium accessible to both the sender and receiver. The covert communication occurs by encoding data directly into the file's content or metadata, which the receiver can then read, bypassing standard security controls designed for direct communication channels.
- ✓
Varying the spacing between keystrokes
Why this is correct
Varying the spacing between keystrokes is a classic example of a timing covert channel. The secret information is not stored in any persistent state or modified data field, but rather conveyed through the temporal relationship between events. By subtly altering the inter-event delay, such as the time between keystrokes, the sender encodes data that the receiver can decode by observing these timing variations.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Covert channel
A covert channel is a hidden communication path that allows data to be transferred in ways that violate a system's security policy, often by using resources not intended for communication.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.