CSC2570 - Exam Review (Part 2)

Question 1

In the Biba model, the * (star) integrity property determines what permission?

Accepted Answer

Write Access (No Write-Up)

Question 2

A conflict of interest occurs when an individual's judgment may be impaired by biases or loyalty to opposing parties.

Accepted Answer

True

Question 3

Which of the following are advantages of MAC as opposed to DAC? Select all that apply:

Accepted Answer

MAC permissions are easier to conceptualize than in DAC., MAC is more centralized than DAC.

Question 4

Discretionary Access Control (DAC) is implemented using a capabilities list (CL).

Accepted Answer

False

Question 5

Which access control scheme determines permissions via the assignment of roles?

Accepted Answer

Role-Based Access Control (RBAC)

Question 6

If Anthony can read unsanitized data from Standard Oil only, which of these CDs can he write to? Select all that apply.

Accepted Answer

Standard Oil

Question 7

In CISS, Record A can be accessed by S1, S2, S5, & S8. Which of the following records could Record A be appended to?

Accepted Answer

Record C [ACL: S2, S8], Record E [ACL: S1, S2, S5, S8]

Question 8

RBAC suffers from scalability issues; once roles are determined, it is difficult to add new subjects to the system.

Accepted Answer

False

Question 9

In which access control scheme does the owner of a resource have direct control over permissions to that resource?

Accepted Answer

Discretionary Access Control (DAC)

Question 10

A user creates TP_X and certifies it for CDI_Y. That user then executes TP_X on CDI_Y. Does Clark-Wilson allow this?

Accepted Answer

False

Question 11

In the Biba model, the simple integrity property determines what permission?

Accepted Answer

Read Access (No Read-Down)

Question 12

Which access control scheme is a centralized, high-security implementation often used by government and military?

Accepted Answer

Mandatory Access Control (MAC)

Question 13

In the Bell-LaPadula (BLP) model, the * (star) security property determines what permission?

Accepted Answer

Write Access (No Write-Down)

Question 14

In CISS, who has the authority to add new subjects to a record's access control list (ACL)?

Accepted Answer

Responsible Clinician

Question 15

In the Bell-LaPadula (BLP) model, the simple security property determines what permission?

Accepted Answer

Read Access (No Read-Up)

Question 16

In the Chinese Wall model, permissions are static; they are set by a central authority and do not change over time.

Accepted Answer

False

Question 17

Which of the following is used to modify data in such a way that it remains in a valid state?

Accepted Answer

Transformation Procedure (TP)

Question 18

If Jo can read sanitized data from Standard Oil, which of these CDs could he choose to read next? Select all that apply.

Accepted Answer

Shell Oil, Standard Oil, Bank of the West, Bank of America

Question 19

If Susan can read unsanitized data from Standard Oil, which of these CDs could she read next? Select all that apply.

Accepted Answer

Bank of the West, Bank of America, Standard Oil

Question 20

Permissions in ABAC may be determined by which of the following? Select all that apply:

Accepted Answer

Context, Action, Object, Subject

Question 21

In the Bell-LaPadula (BLP) model, ( Secret [NUC, US] ) dom ( Secret [NUC] ) is a valid dominance relationship.

Accepted Answer

True

Question 22

Which of the following represents data that is subject to integrity controls?

Accepted Answer

Constrained Data Item (CDI)

Question 23

In the Bell-LaPadula (BLP) model, ( Top Secret [NUC, US] ) dom ( Secret [NUC, EUR] ) is a valid dominance relationship.

Accepted Answer

False

Question 24

The Chinese Wall model is primarily concerned with controlling access to sanitized data.

Accepted Answer

False

Question 25

ABAC is more dynamic than the other schemes discussed, as it is based on attributes that may change frequently.

Accepted Answer

True

Question 26

In CISS, when can medical records be deleted? Choose the best answer.

Accepted Answer

When the appropriate condition is met.

Question 27

Which of the following is the correct format for an allowed relation in the Clark-Wilson model?

Accepted Answer

( user_ID, TP, [CDI_X... CDI_Y] )

Question 28

In RBAC, large organizations may experience "role explosion" in which the number of roles becomes unmanageable.

Accepted Answer

True

Question 29

A well-formed transaction occurs when the system moves from a valid state to an invalid state.

Accepted Answer

False

Question 30

Which access control scheme uses a variety of different characteristics to determine permissions at the time of access?

Accepted Answer

Attribute-Based Access Control (ABAC)

CSC2570 - Exam Review (Part 2)

Questions 30

CSC2570 - Exam Review (Part 2)

Questions 30