Certified Information Systems Security Professional CISSP (CISSP) — Questions 451–525

Penetration testing is a highly effective and common method for proactively assessing an organization's security posture by simulating real-world attacks. Ethical hackers attempt to exploit identified vulnerabilities in systems, applications, and networks to determine the extent to which an attacker could compromise assets. This hands-on approach provides valuable insights into the effectiveness of existing security controls and the potential impact of a successful breach.

Formatting a removable drive prepares it for data storage by creating a file system, but this process does not automatically encrypt the data written to it. Encryption, such as using Windows' BitLocker To Go, is a distinct security measure that must be explicitly enabled by the user after formatting. This separate step involves generating and managing cryptographic keys to protect the data at rest, ensuring confidentiality even if the physical device is compromised.

Volatility is an open-source framework specifically designed for memory forensics, enabling investigators to extract and analyze digital artifacts from volatile memory (RAM) dumps. It allows for the examination of running processes, open network connections, loaded kernel modules, and user activity, which are crucial for incident response, malware analysis, and understanding the runtime state of a compromised system. Its capabilities are centered on analyzing live system memory rather than persistent storage.

A Security Information and Event Management (SIEM) system aggregates and correlates security event data from various sources, including network devices, servers, applications, and intrusion detection systems. By analyzing these logs in real-time for anomalous patterns, policy violations, and known attack signatures, SIEM can effectively detect sophisticated unauthorized access attempts and ongoing breaches that might otherwise go unnoticed.

The data custodian is responsible for the operational implementation and maintenance of security controls and safeguards for information assets. This includes tasks such as data backup, system patching, access control enforcement, and ensuring data integrity and availability according to the policies established by the data owner. They act as the 'hands-on' technical and administrative staff who manage the data on a day-to-day basis.

Address Space Layout Randomization (ASLR) is an effective defense that randomizes the memory locations of program components, such as the stack, heap, and libraries. By making these addresses unpredictable, ASLR prevents attackers from reliably targeting specific memory addresses with malicious payloads during a buffer overflow attack. This significantly increases the difficulty of executing successful shellcode or return-oriented programming (ROP) exploits.

The Ticket Granting Ticket (TGT) serves as a crucial credential, issued by the Authentication Server (AS), that the client presents to the Ticket Granting Service (TGS). It contains the user's identity and a session key, encrypted with the TGS's secret key, proving the user has been successfully authenticated by the AS. This allows the TGS to trust the client's request for service tickets without requiring re-authentication to the AS for each new service.

Log retention requirements explicitly define the mandatory duration for which security logs must be stored and maintained by an organization. These requirements are typically driven by legal obligations (e.g., GDPR, HIPAA), industry regulations (e.g., PCI DSS), compliance frameworks, or internal corporate policies for forensic investigations, auditing, and historical analysis. They directly address the "how long" aspect of log management, ensuring data availability for specified periods.

Implementing a private repository that mirrors approved open-source libraries establishes a controlled and trusted software supply chain, preventing direct reliance on potentially compromised public sources. Enforcing signature verification confirms the authenticity of the package's origin, while hash checks guarantee the integrity of the content, ensuring no unauthorized modifications or malicious injections have occurred. This proactive approach effectively blocks compromised or malicious packages from entering the development environment.

Virtual machine escape is a critical security vulnerability where an attacker breaks out of the confines of a guest operating system to gain unauthorized access to the hypervisor or other virtual machines. This breach compromises the fundamental isolation provided by the hypervisor, potentially allowing an attacker to control the host system or access sensitive data across multiple tenants. It represents a severe failure of the hypervisor's security mechanisms, making it a top concern for cloud providers.

The primary objective of asset classification is to assign a sensitivity level to information assets, such as 'Confidential' or 'Public,' based on the potential impact of their compromise. This classification directly dictates the specific security controls—like encryption, access restrictions, or data handling procedures—that must be applied to protect the asset effectively. By aligning controls with sensitivity, organizations ensure resources are allocated efficiently to safeguard their most critical information.

OCSP stapling significantly improves the efficiency and privacy of certificate revocation checks. Instead of each client directly querying the Certificate Authority's (CA) OCSP responder, the web server periodically fetches a signed OCSP response from the CA and "staples" it to its own certificate during the TLS handshake. This reduces the load on CA infrastructure, minimizes client-side latency, and enhances user privacy by preventing the CA from logging individual client queries.

Under HIPAA, a cloud provider storing or processing Protected Health Information (PHI) is considered a Business Associate. Before any PHI can be legally shared or stored with such a provider, a signed Business Associate Agreement (BAA) is a mandatory contractual requirement. This agreement legally obligates the cloud provider to comply with HIPAA's Security and Privacy Rules, safeguarding PHI and outlining their responsibilities, permitted uses, disclosures, and breach notification procedures.

This is the most appropriate solution as it adheres to the principle of least privilege and just-in-time (JIT) access. By temporarily assigning an existing, appropriate role with an explicit expiration date, the user gains only the necessary permissions for the required duration, automatically revoking access once the task is complete. This minimizes the window of potential misuse and maintains strong access control governance.

This rule correctly permits inbound HTTP traffic from the internet to the specified web server. The 'Outside' interface is the proper entry point for external traffic, and 'Source any' allows requests from any public IP address. Directing traffic to destination 10.0.0.10 on Port 80 precisely targets the web server for standard HTTP communication, fulfilling the requirement.

Non-root user reduces privilege escalation risk.

This option directly corresponds to PCI DSS Requirement 4: 'Encrypt transmission of cardholder data across open, public networks.' This foundational requirement mandates the use of strong cryptography and security protocols, such as TLS 1.2 or higher, to protect cardholder data during transit over untrusted networks, preventing interception and unauthorized disclosure. It is one of the 12 high-level requirements.

Correct. The logistics provider is a data processor processing data on behalf of the controller.

VLANs provide the crucial capability to logically segment a network into distinct broadcast domains, irrespective of the physical location of the connected devices. This means that devices belonging to the same logical group or department can be physically distributed across different switches or geographical areas, yet still reside on their dedicated VLAN, simplifying network management and policy enforcement.

The fundamental value proposition of a SIEM system lies in its capacity to aggregate disparate security event data from numerous sources and identify meaningful relationships between them. Event correlation allows the SIEM to detect complex attack patterns, anomalous behaviors, and potential security incidents that would be invisible when examining individual log entries in isolation. This capability transforms raw data into actionable intelligence, enabling proactive threat detection and efficient incident response by linking seemingly unrelated events into a coherent narrative.

The data owner holds ultimate accountability for the data, making them responsible for determining its classification level, such as "confidential," based on its business value, sensitivity, and regulatory compliance requirements. This classification dictates the necessary security controls and handling procedures. Furthermore, the data owner ensures that the data is appropriately labeled to communicate its sensitivity to all users and systems, thereby guiding its protection throughout its lifecycle.

Network segmentation is a classic example of risk mitigation, as it directly reduces the potential impact and likelihood of a successful attack spreading across an entire network. By isolating critical systems or sensitive data into separate segments, a breach in one area is contained, preventing lateral movement and significantly diminishing the overall damage. This proactive control implements safeguards to lower the risk exposure to an acceptable level.

'CN' stands for Common Name, which is a fundamental attribute type used in LDAP Distinguished Names (DNs) to identify the most specific or common name of an entry within its immediate parent container. This attribute is widely employed for various object classes, such as users (e.g., "cn=John Doe"), groups, servers, or other resources, providing a human-readable identifier for the directory object. It forms a crucial part of the Relative Distinguished Name (RDN) for many entries.

An authenticated scan provides the most comprehensive view because it operates with legitimate user credentials, allowing it to log into target systems and inspect their internal configurations, patch levels, installed software, and user permissions directly. This privileged access enables the scanner to identify vulnerabilities that are only detectable from within the operating system or application, such as missing security updates, insecure registry settings, or weak file permissions, offering a true internal security posture assessment.

Degaussing is a highly effective method for destroying data on magnetic storage media by exposing the hard drive to a powerful magnetic field that randomizes the magnetic domains on the platters. This process completely erases all data, rendering it unreadable and unrecoverable, as the original magnetic patterns that represented the data are irreversibly scrambled. It is a robust method for purging sensitive information from hard drives, ensuring complete data sanitization.

This fundamental GDPR right allows data subjects to request the deletion or removal of their personal data without undue delay under specific circumstances. These conditions include when the data is no longer necessary for the purpose for which it was collected, when consent is withdrawn, or when the data has been unlawfully processed. However, this right is not absolute and can be overridden by legal obligations or public interest considerations.

Labeling evidence immediately upon collection with essential details such as the date, time, and the name of the collector is a fundamental step in establishing a robust chain of custody. This initial documentation provides an irrefutable starting point for the evidence's lifecycle, clearly identifying when and by whom it was first secured. Accurate labeling ensures that each piece of evidence can be uniquely identified and tracked throughout the entire forensic process, preventing mix-ups and disputes over its origin.

Cloud-based Disaster Recovery (DR) leverages the scalability and elasticity of cloud infrastructure to provide a highly agile recovery environment. Continuous data replication ensures that data changes are synchronized almost instantaneously to the cloud DR site, achieving a near-zero Recovery Point Objective (RPO). When a disaster strikes, virtual machines and services can be rapidly provisioned and spun up in the cloud, effectively meeting demanding Recovery Time Objectives (RTOs) with minimal downtime.

Restricted data represents the highest level of sensitivity within an organization's classification scheme, indicating that unauthorized disclosure would cause severe, potentially catastrophic, damage to the organization, its operations, or its stakeholders. This classification mandates the most stringent security controls, including robust encryption, strict need-to-know access, multi-factor authentication, and continuous monitoring, to ensure maximum protection against compromise. It typically applies to highly confidential intellectual property, top-secret strategic plans, or critical national security information.

The Data Link layer (Layer 2) is responsible for node-to-node data transfer and error correction from the physical layer, handling frame synchronization, flow control, and error checking. ARP (Address Resolution Protocol) operates at this layer, resolving Layer 3 IP addresses to Layer 2 MAC addresses within a local network segment to enable direct communication. ARP spoofing exploits this protocol by sending forged ARP messages, associating the attacker's MAC address with the IP address of another legitimate host, thereby redirecting traffic at the local network level.

Applying output encoding, specifically HTML entity encoding for HTML contexts, is the most effective and robust solution for preventing stored Cross-Site Scripting (XSS). This process transforms malicious characters (like <, >, &, ", ') into their safe, non-executable representations before rendering them in the browser. By ensuring that user-supplied data is treated as data, not executable code, the browser interprets the encoded script as harmless text, thereby neutralizing the XSS payload.

This option directly reflects a core aspect of data minimization, which dictates that organizations should only collect personal data that is absolutely essential and directly pertinent to achieving a clearly defined, legitimate purpose. By restricting initial data acquisition to the minimum required, it prevents unnecessary accumulation, reduces the potential attack surface, and mitigates privacy risks associated with holding excessive or irrelevant data.

This statement is correct and highlights a fundamental distinction. OAuth 2.0 is an authorization framework, primarily concerned with granting delegated access to protected resources without sharing user credentials. Conversely, OpenID Connect (OIDC) is an authentication protocol built on OAuth 2.0, specifically designed to verify the identity of an end-user and obtain basic profile information, issuing an ID Token for this purpose.

When serialized objects are transmitted or stored, an attacker might tamper with the serialized data to inject malicious code or alter object properties. Applying a cryptographic integrity check, such as a Hash-based Message Authentication Code (HMAC), to the serialized object ensures that any unauthorized modification to the data will be detected prior to deserialization. If the integrity check fails, the system can reject the object, preventing the execution of manipulated or malicious payloads embedded within the serialized stream. This effectively prevents the deserialization of tampered objects.

Simultaneous Authentication of Equals (SAE) is the foundational key exchange mechanism for WPA3-Personal, replacing the less secure Pre-Shared Key (PSK) handshake used in WPA2-Personal. SAE employs a robust password-authenticated key exchange (PAKE) protocol that establishes a strong cryptographic key without directly exposing the shared secret. This design provides crucial protection against offline dictionary attacks and ensures forward secrecy, meaning past session traffic remains confidential even if the shared password is later compromised.

Key generation is a fundamental element because it establishes the symmetric encryption keys used to protect the confidentiality and integrity of all subsequent application data exchanged during the secure session. During the TLS/SSL handshake, cryptographic primitives like Diffie-Hellman or RSA are employed to securely derive these shared secret keys. This process ensures that only the communicating parties can encrypt and decrypt the session's traffic, making secure communication possible.

This option effectively combines 'something you know' (password) with 'something you have' (the mobile phone receiving the OTP), satisfying the criteria for multifactor authentication. SMS-based one-time passcodes are highly accessible and cost-effective, leveraging existing employee mobile devices without requiring additional hardware purchases or complex infrastructure deployment, making it an ideal, low-barrier solution for a small business.

This option correctly identifies the core problem. A mother's maiden name is a classic example of a "shared secret" – information known to both the user and the system, but not truly secret from others. Such data is highly susceptible to social engineering attacks or public record searches, making it an ineffective and weak form of authentication for verifying a user's identity, especially when a user cannot log in and requires a reset or unlock.

A packet filter firewall operates at the network and transport layers (L3/L4) of the OSI model, making decisions solely based on static rules applied to IP addresses, port numbers, and protocols found in packet headers. It is inherently stateless, meaning it does not maintain information about ongoing connections, treating each packet individually without regard for its relationship to previous or subsequent packets. This simplicity allows for high performance but offers limited security context, as it cannot dynamically permit return traffic or detect complex attacks.

A primary benefit of an API Gateway is its ability to serve as a centralized enforcement point for critical security and operational policies. By handling authentication and authorization at the gateway, individual backend services do not need to implement these mechanisms redundantly, simplifying development and ensuring consistent policy application. Similarly, rate limiting prevents abuse and denial-of-service attacks by controlling the number of requests an API can receive within a given timeframe, all managed efficiently from a single location.

Network segmentation is a critical security control that logically separates different parts of a network. By creating distinct segments for sensitive data and systems, organizations can significantly limit the exposure of critical assets to unauthorized access or malicious activity. This isolation restricts lateral movement for attackers, ensuring that a compromise in one segment does not automatically grant access to highly protected resources in another.

For Level 1 merchants and service providers, an annual on-site assessment by a Qualified Security Assessor (QSA) is a mandatory component of PCI DSS compliance validation. The QSA conducts a thorough review of the organization's Cardholder Data Environment (CDE), policies, procedures, and technical controls to ensure adherence to all applicable PCI DSS requirements, culminating in a Report on Compliance (ROC). This external validation is a cornerstone of the standard's assurance model.

Audit logs meticulously record system events, user activities, and changes, often including source IP, user ID, and a precise timestamp. When properly secured against tampering, these immutable records serve as irrefutable evidence of who performed what action and when, making it difficult for an individual to deny their involvement in a specific event. This comprehensive logging provides a verifiable trail for accountability.

Filtering malicious HTTP traffic is the core and primary purpose of a Web Application Firewall (WAF). A WAF inspects incoming HTTP/HTTPS requests and outgoing responses at the application layer (Layer 7) for signatures and behaviors indicative of common web attacks, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. By analyzing the content, headers, and parameters, the WAF can block or alert on malicious requests before they reach the web application, thereby protecting it from exploitation.

Using a specialized forensic tool to capture the contents of RAM is the correct action because Random Access Memory (RAM) holds the most volatile and transient data on a system. This includes active processes, network connections, open files, encryption keys, and potentially malicious code that resides only in memory. Such a capture creates a memory dump, which is essential for a thorough forensic analysis, as this critical evidence would be irrevocably lost upon system shutdown or power interruption. This method directly addresses the need to preserve highly ephemeral data.

The primary purpose of a Change Advisory Board (CAB) is to evaluate, prioritize, and authorize proposed changes to IT services and infrastructure, ensuring they align with organizational goals and minimize adverse impacts. The CAB meticulously reviews change requests, assessing potential risks, resource requirements, and dependencies before granting approval. Furthermore, it provides oversight throughout the change lifecycle, monitoring implementation progress and reviewing post-implementation reports to confirm successful deployment and address any unforeseen issues.

If the authorization server, often influenced by user consent or policy, did not include a specific required scope within the issued access token, the resource server will deny the request. Upon receiving the token, the resource server inspects its claims, including the 'scope' claim, and determines that the token does not possess the necessary permissions to perform the requested operation, resulting in a 403 Forbidden response. This indicates the user is authenticated but not authorized for that specific action.

Public is the lowest level of commercial data classification, designated for information that can be freely disclosed to the general public without causing harm to the organization. Examples include marketing materials, press releases, and public product brochures, which require no confidentiality controls but still demand integrity protections to prevent unauthorized modification.

The Brewer-Nash model, also known as the Chinese Wall policy, is specifically designed to prevent conflicts of interest within organizations. It dynamically restricts a subject's access to information based on their past access history, ensuring that once a subject accesses data related to one company within a conflict-of-interest class, they cannot access data related to any competing company in that same class. This model is crucial in environments like financial services to maintain ethical conduct and prevent insider trading.

Tampering specifically refers to the unauthorized modification or alteration of data, whether in transit or at rest, within an application or system. For an online banking application, this could manifest as an attacker changing transaction amounts, recipient details, account balances, or system logs, directly compromising the integrity of financial data and operational processes. This threat directly targets the trustworthiness and accuracy of information, making it a primary concern for financial systems.

A Security Orchestration, Automation, and Response (SOAR) platform integrates various security tools and systems to automate and orchestrate incident response workflows. It ingests alerts from SIEMs and other sources, applies predefined playbooks to analyze incidents, and automatically executes actions such as blocking IP addresses, isolating endpoints, enriching data, or creating tickets. This capability significantly reduces manual effort, accelerates response times, and standardizes incident handling procedures within a SOC by automating repetitive tasks.

DTP can be exploited to negotiate a trunk, enabling hopping.

The double-tagging attack relies on the switch stripping an outer, attacker-controlled tag when it matches the native VLAN of a trunk port, then forwarding the frame based on the inner, malicious tag. By disabling the native VLAN and explicitly tagging all traffic on trunk links, including the management VLAN, the switch will not strip any untagged frames. This ensures all frames are treated consistently with their explicit VLAN tags, preventing the outer tag from being silently removed and the inner malicious tag from being processed.

Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk to an acceptable level. Compensating controls are alternative security measures deployed when primary controls are not feasible or effective, providing an equivalent level of protection. This approach allows the organization to continue critical business operations while addressing the identified vulnerability, making it a practical and responsible strategy when direct remediation is not immediately possible or too disruptive.

SP-initiated SSO occurs when a user attempts to access a protected resource directly from a Service Provider (SP). The SP detects the unauthenticated request, generates a SAML authentication request, and redirects the user's browser to the Identity Provider (IdP) along with this request. After the IdP authenticates the user, it creates a SAML assertion and redirects the user's browser back to the SP, allowing the user to access the requested resource without re-authenticating directly to the SP.

Reporting is the formal, final phase of a penetration testing engagement where the tester documents discovered vulnerabilities, methodology, and risk ratings. This deliverable translates technical findings into actionable remediation steps for both executive and technical stakeholders, marking the official conclusion of the active assessment.

Conducting a gap analysis is the foundational first step in security integration during a merger. It systematically identifies discrepancies between the merging entities' current security postures, policies, controls, and compliance requirements. This comprehensive assessment provides the critical data needed to understand the combined risk landscape and inform the development of a unified, effective security strategy.

This option correctly leverages the cloud provider's Key Management Service (KMS) for robust encryption key management, including automatic rotation which satisfies the 90-day policy requirement without manual intervention. Storing the KMS key in a separate account and region from the database enhances security through strong separation of duties and blast radius containment. Furthermore, using a certificate from a trusted third-party Certificate Authority (CA) for TLS ensures strong authentication and encryption for external connections, meeting compliance standards like PCI DSS.

Tier 3 analysts, often comprising threat hunters, malware reverse engineers, and digital forensics experts, possess the most advanced technical skills within a SOC. They are uniquely equipped to conduct deep-dive forensic examinations, including advanced memory forensics, file system analysis, and complex artifact reconstruction, utilizing specialized tools and methodologies. This tier is essential for uncovering sophisticated attack techniques, attributing threats, and developing proactive defenses based on expert-level forensic insights.

The Advanced Encryption Standard (AES) is a widely adopted symmetric block cipher, encrypting data in fixed-size blocks of 128 bits using the same secret key for both encryption and decryption. It supports key lengths of 128, 192, or 256 bits, offering robust security against brute-force attacks. As a highly efficient and secure algorithm, AES is the standard for protecting sensitive government and commercial data, making it the correct answer for a symmetric block cipher.

A Trusted Platform Module (TPM) provides a hardware root of trust by securely storing cryptographic keys and performing integrity measurements. During the secure boot process, the TPM measures each boot component (firmware, bootloader, kernel) before it executes, extending these measurements into Platform Configuration Registers (PCRs). These PCR values are then compared against known good hashes (golden measurements) stored securely within the TPM or a trusted repository, ensuring that only authorized and untampered software loads.

SAML 2.0 (Security Assertion Markup Language) is an XML-based standard specifically designed for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It is widely adopted for enterprise single sign-on (SSO) scenarios, enabling users to authenticate once with an IdP and gain seamless access to multiple SPs without re-entering credentials. Its robust support for both IdP-initiated and SP-initiated flows makes it a strong choice for cross-domain SSO implementations.

Geographical diversity, specifically avoiding the same seismic zone, is a paramount consideration for a disaster recovery site. This ensures that a single catastrophic event, such as a major earthquake, cannot simultaneously disable both the primary and recovery data centers. Such separation is fundamental to maintaining business continuity and data availability, as it prevents the loss of both operational and recovery capabilities from a single, widespread natural disaster.

A vulnerability scan systematically identifies known security weaknesses and misconfigurations in systems, applications, and networks by passively probing for indicators of potential vulnerabilities. This method is non-intrusive, does not attempt to exploit findings, and therefore minimizes the risk of service disruption, making it an ideal, low-impact approach for regularly assessing the presence of security flaws and the general effectiveness of baseline controls.

SQL injection is a code injection technique that exploits vulnerabilities in an application's database layer, specifically when user-supplied input is directly concatenated into SQL queries without proper sanitization or parameterization. This allows an attacker to modify the intended SQL query structure, enabling unauthorized data access, modification, deletion, or even execution of administrative commands on the database server. It directly targets the database query logic.

After successfully exploiting a vulnerability, the next logical and critical step in a penetration test is to conduct post-exploitation activities and attempt lateral movement. Post-exploitation involves maintaining access, escalating privileges, and gathering information from the compromised system, while lateral movement aims to pivot to other systems within the network. These actions are essential for determining the true impact of the initial compromise, identifying additional vulnerabilities, and mapping the potential blast radius of an attacker, thereby providing a comprehensive security assessment.

This option correctly defines the Recovery Time Objective (RTO) as the maximum acceptable downtime of 4 hours, meaning services must be restored within this period. Simultaneously, the Recovery Point Objective (RPO) of 15 minutes specifies that the maximum tolerable data loss is 15 minutes, ensuring recent data is preserved. These values precisely align with the assumed business requirements for both service availability and data integrity, making it the optimal disaster recovery strategy.

Implementing mutual TLS (mTLS) and identity-based access policies is the most robust approach for securing microservices in a service mesh. mTLS ensures strong, bidirectional cryptographic authentication between services, verifying both the client's and server's identities using certificates for every connection. Coupled with identity-based access policies, this enables fine-grained authorization decisions based on verified service identities, enforcing the principle of least privilege and establishing a zero-trust environment within the mesh.

Disabling unnecessary hypervisor services significantly reduces the attack surface by removing potential entry points and unneeded code that could harbor vulnerabilities. Concurrently, applying security patches promptly addresses known flaws and exploits, preventing attackers from leveraging publicly disclosed weaknesses in the hypervisor software. This proactive combination of hardening and continuous vulnerability management is critical for maintaining the integrity and security of the virtualization layer, directly mitigating risks like VM escape.

Transfer is a valid risk response strategy where the risk is shifted to a third party, such as through insurance or outsourcing.

Implementing parameterized queries at the application layer combined with modifying existing stored procedures to properly utilize parameters creates a robust, defense-in-depth strategy against SQL injection. This approach eliminates injection vulnerabilities at both the application and database levels. Monitoring performance post-implementation is crucial to identify any potential bottlenecks introduced by the changes before a full production rollout, ensuring system stability and efficiency.

The Bell-LaPadula model is a state-machine model primarily designed to enforce confidentiality, particularly in military and government systems. It operates on the principles of 'no read up' (Simple Security Property) and 'no write down' (*-property), ensuring that subjects can only access information at or below their security clearance level and cannot write information to a lower security level. This prevents unauthorized disclosure of classified information by strictly controlling information flow.