a. Physical security
b. Network monitors
c. Software testing
d. Quality assurance
26. c. Software testing is a last line-of-defense because it is the last step to ensure proper functioning of security controls. After testing, the system is implemented and ready to operate in the real world.
The other three choices provide first lines-of-defense. Physical security with security guards and keys and locks can prevent threats.
Network monitors can protect against spoofing. Quality assurance programs can improve quality in products and processes through upfront planning.
27. From a security viewpoint, which of the following acts like a first line-of-defense?
a. Remote server
b. Web server
c. Firewall
d. Secure shell program
27. c. A firewall can serve as a first line-of-defense but by no means can it offer a complete security solution. A combination of controls is needed to supplement the firewall’s protection mechanism.
The other three choices cannot act like a first line-of-defense. Both remote server and Web server are often the targets for an attacker. A secure shell program replaces the unsecure programs such as rlogin, rsh, rcp, Telnet, and rdist commands with a more secure version that adds authentication and encryption mechanisms to provide for greater security.
28. Normal information can be reliably sent through all the following ways except:
a. Increasing the bandwidth for a covert channel
b. Using error correcting code
c. Using a hamming code
d. Introducing page faults at random
28. a. Increasing the bandwidth can make a covert channel noisy as one of the goals is to reduce its bandwidth. Covert channels are not only difficult to find, but also difficult to block. Normal information cannot be reliably sent through covert channels.
The other three choices can send normal information reliably because they use an error correcting code (e.g., hamming code) or introducing page faults at random (i.e., modulating paging rates between 0 and 1).
29. Covert channel analysis is not meaningful for which of the following?
a. Cross-domain systems
b. Multilevel secure systems
c. Multilayer systems
d. Multiple security level systems
29. c. Multilayer systems are distributed systems requiring cooperating elements distributed physically and logically across the network layers. Covert channel analysis is not meaningful for distributed systems because they are not the usual targets for covert storage and timing channels.
The other three choices are good candidates for covert channel analysis and should be tested on all vendor-identified covert channel targets.
30. All the following are factors favoring acceptability of a covert channel except:
a. Floating label
b. Low bandwidth
c. Fixed label
d. Absence of application software
30. c. A fixed label contains a subject’s maximum security label, which dominates that of the floating label. Hence, a fixed label does not favor acceptability of a covert channel. The other three choices favor a covert channel.
31. From an information security viewpoint, a Security-in-Depth strategy means which of the following?
a. User training and awareness
b. Policies and procedures
c. Layered protections
d. Redundant equipment
31. c. By using multiple, overlapping protection approaches, the failure or circumvention of any individual protection approach does not leave the system unprotected. Through user training and awareness, well-crafted policies and procedures, and redundancy of protection mechanisms, layered protections enable effective security of IT assets to achieve an organization’s security objectives. The other three choices are part of the layered protections.
32. Time-to-exploitation metric can be used to determine the presence of which of the following?
a. Memory channel
b. Communications channel
c. Covert channel
d. Exploitable channel
32. c. Time-to-exploitation metric is measured as the elapsed time between when the vulnerability is discovered and the time it is exploited. Covert channels are usually exploitable. The other three choices are a part of the covert channel.
33. All the following are outside the scope of the Common Criteria (CC) except:
a. Evaluation scheme
b. Evaluation methodology
c. Evaluation base
d. Certification processes
33. c. The evaluation base, consisting of an assessment of a protection profile (PP), a security target (ST), or a target of evaluation (TOE) against defined criteria, is within the scope of the Common Criteria (CC).
The evaluation scheme, evaluation methodology, and certification processes are the responsibility of the evaluation authorities that run evaluation schemes and are outside the scope of the CC. The CC for IT security evaluation is the new standard for specifying and evaluating the security features of computer products and systems globally. The CC is intended to replace previous security criteria used in North America and Europe with a standard that can be used everywhere in the world effectively since early 1999.
34. Which of the following cannot be initiated by untrusted software?
a. Trusted channel
b. Overt channel
c. Security-compliant channel
d. Exploitable channel
34. a. A trusted channel cannot be initiated by untrusted software due to its design. The other three choices are not as trustworthy as the trusted channel due to their design.
An overt channel is a path within a computer system or network designed for the authorized data transfer. A security-compliant channel enforces the network policy. An exploitable channel is a covert channel intended to violate the security policy.
35. Countermeasures against emanation attacks include which of the following?
1. High watermark policy
2. Information label
3. Control zones
4. White noise
a. 1 and 2
b. 1 and 3
c. 2 and 3
d. 3 and 4
35. d. Control zones and white noise are countermeasures against emanation attacks. A control zone is the space surrounding equipment processing sensitive information that is under sufficient physical and technical control to prevent an unauthorized entry or compromise. White noise is a distribution of uniform spectrum of random electrical signals so that an intruder cannot decipher real data from random (noise) data due to use of constant bandwidth.
A high watermark policy is used to maintain an upper bound on fused data. An information label results from a floating label. The high watermark policy, information label, and floating label are part of a covert channel.