WGU C706 PA Study Guide – Questions With Applicable
Solutions
On-Site Assessment Accurate Answer:- Visit the site of the organization
to interview personnel and observe their operating habits.
Document Exchange and Review Accurate Answer:- Investigate the
means by which datasets and documentation are exchanged as well as the
formal processes by which they perform assessments and reviews.
Process/Policy Review Accurate Answer:- Request copies of their
security policies, processes/procedures, and documentation of incidents and
responses for review.
Third-Party Audit Accurate Answer:- Having an independent third-
party auditor, as defined by the American Institute of Certified Public
Accountants (AICPA), can provide an unbiased review of an entity's security
infrastructure, based on Service Organization Control (SOC) reports. See
Chapter 15 for details on SOC reports.
Complete Mediation Accurate Answer:- Every access to every object
must be checked for authority
Identification of the entity making the access request
Verification that the request has not changed since its initiation
Application of the appropriate authorization procedures
Reexamination of previously authorized requests by the same entity
Economy of mechanism Accurate Answer:- This promotes simple and
comprehensible design and implementation of protection mechanisms, so that
unintended access paths do not exist or can be readily identified and
eliminated. (Smallest and simplest designs as possible)
Open Design Accurate Answer:- According to this principle, the security
architecture and design of a system should be made publicly available.
, The design of a security mechanism should be open rather than secret
Least common mechanism Accurate Answer:- In systems with multiple
users, mechanisms allowing resources to be shared by more than one user
should be minimized.
The design should minimize the functions shared by different users, providing
mutual security
Leveraging existing components Accurate Answer:- A security design
principle that ensures that the attack surface is not increased and no newer
vulnerabilities are introduced because existing components of
code/functionality are reused (leveraged) when architecting software.
Reviewing the state and settings of the extant security mechanisms and
ensuring that they are operating at their optimum design points will greatly
improve the security posture of an information system
Psychological acceptability Accurate Answer:- This refers to the ease of
use and intuitiveness of the user interface that controls and interacts with the
access control mechanisms. The user must be able to understand the user
interface and use it without having to interpret complex instructions.
What type of functional security requirement involves receiving, processing,
storing, transmitting, and delivering in report form? Accurate Answer:-
Primary dataflow
Which nonfunctional security requirement provides a way to capture
information correctly and a way to store that information to help support
later audits? Accurate Answer:- Logging
Sensitivity Accurate Answer:- Sensitivity refers to the quality of
information, which could cause harm or damage if disclosed.
Discretion Accurate Answer:- Discretion is an act of decision where an
operator can influence or control disclosure in order to minimize harm or
damage.
Solutions
On-Site Assessment Accurate Answer:- Visit the site of the organization
to interview personnel and observe their operating habits.
Document Exchange and Review Accurate Answer:- Investigate the
means by which datasets and documentation are exchanged as well as the
formal processes by which they perform assessments and reviews.
Process/Policy Review Accurate Answer:- Request copies of their
security policies, processes/procedures, and documentation of incidents and
responses for review.
Third-Party Audit Accurate Answer:- Having an independent third-
party auditor, as defined by the American Institute of Certified Public
Accountants (AICPA), can provide an unbiased review of an entity's security
infrastructure, based on Service Organization Control (SOC) reports. See
Chapter 15 for details on SOC reports.
Complete Mediation Accurate Answer:- Every access to every object
must be checked for authority
Identification of the entity making the access request
Verification that the request has not changed since its initiation
Application of the appropriate authorization procedures
Reexamination of previously authorized requests by the same entity
Economy of mechanism Accurate Answer:- This promotes simple and
comprehensible design and implementation of protection mechanisms, so that
unintended access paths do not exist or can be readily identified and
eliminated. (Smallest and simplest designs as possible)
Open Design Accurate Answer:- According to this principle, the security
architecture and design of a system should be made publicly available.
, The design of a security mechanism should be open rather than secret
Least common mechanism Accurate Answer:- In systems with multiple
users, mechanisms allowing resources to be shared by more than one user
should be minimized.
The design should minimize the functions shared by different users, providing
mutual security
Leveraging existing components Accurate Answer:- A security design
principle that ensures that the attack surface is not increased and no newer
vulnerabilities are introduced because existing components of
code/functionality are reused (leveraged) when architecting software.
Reviewing the state and settings of the extant security mechanisms and
ensuring that they are operating at their optimum design points will greatly
improve the security posture of an information system
Psychological acceptability Accurate Answer:- This refers to the ease of
use and intuitiveness of the user interface that controls and interacts with the
access control mechanisms. The user must be able to understand the user
interface and use it without having to interpret complex instructions.
What type of functional security requirement involves receiving, processing,
storing, transmitting, and delivering in report form? Accurate Answer:-
Primary dataflow
Which nonfunctional security requirement provides a way to capture
information correctly and a way to store that information to help support
later audits? Accurate Answer:- Logging
Sensitivity Accurate Answer:- Sensitivity refers to the quality of
information, which could cause harm or damage if disclosed.
Discretion Accurate Answer:- Discretion is an act of decision where an
operator can influence or control disclosure in order to minimize harm or
damage.
