CISSP Practice Question: Drag and drop the steps for implementing…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Define labels, Step 2: Assign clearances, Step 3: Assign classifications, Step 4: Configure monitor, Step 5: Test.

  Why this is correct

  This is the correct order because labels must be defined first as the foundation, then clearances and classifications are assigned to subjects and objects respectively, the monitor is configured to enforce the policy, and finally testing validates the implementation.

• ✗

  Step 1: Assign clearances, Step 2: Define labels, Step 3: Assign classifications, Step 4: Configure monitor, Step 5: Test.

  Why it's wrong here

  Defining security labels is the foundational first step in implementing Mandatory Access Control (MAC), as these labels establish the entire security hierarchy and categories (e.g., Top Secret, Secret, Confidential). Attempting to assign clearances to subjects before these fundamental labels are defined is logically impossible, as there would be no established security attributes for the clearances to reference. Without a predefined security lattice, the system lacks the necessary framework to categorize and manage access levels effectively.

• ✗

  Step 1: Define labels, Step 2: Assign classifications, Step 3: Assign clearances, Step 4: Configure monitor, Step 5: Test.

  Why it's wrong here

  This is incorrect because classifications (for objects) should be assigned after clearances (for subjects) typically, or at least the order is not critical, but the given explanation suggests clearances before classifications; more importantly, the correct order from the explanation is clearances then classifications.

• ✗

  Step 1: Define labels, Step 2: Assign clearances, Step 3: Assign classifications, Step 4: Test, Step 5: Configure monitor.

  Why it's wrong here

  The security monitor, often embodying the principles of a Reference Monitor, is the critical enforcement mechanism in a Mandatory Access Control (MAC) system. It mediates all access attempts between subjects and objects, ensuring that assigned clearances and classifications are strictly adhered to. Performing testing before this monitor is fully configured and operational would be futile, as there would be no active mechanism to enforce the MAC policy and thus no meaningful results regarding policy compliance or security posture could be obtained.

Go deeper

Related to this question