Cs 6238 Final Exam Questions With Correct Answers Latest Update 2026

CS 6238 FINAL EXAM QUESTIONS WITH CORRECT ANSWERS LATEST UPDATE 2026 - Answers discretionary access control 1 of 2 owner decides who can access data does not meet need of many organizations (information flow problem) - Answers discretionary access control 2 of 2 controlling who can gain access to data is not possible ___ can - Answers mandatory access control a of b organization ___ control how info is shared - Answers mandatory access control b of b address information flow problem - Answers mandatory access control what should MAC do? we have to add some meta-data (labels) that captures the nature of the info contained in the object - Answers mandatory access control what should MAC do? Labels: How sensitive? What is the info about? What kind of info does a user in a certain function/role needs to access? - Answers mandatory access control Label = (sensitivity level, compartment) a compartment could be a SET - Answers mandatory access control labels can come in many different types used to be "Who can write and who can read" e.g. maybe a doctor can write. labels - Answers mandatory access control what is most important different between MAC and DAC? A: ___, labels have diff parts, eg. (a) how sensitive info is and (b) what TOPICS does it relate to - Answers mandatory access control What does "comparing labels" mean?e.g. one lable can DOMINATE or be stronger than other labels. - Answers mandatory access control comparing labels L1 and L2 L1 = (l1,C1), L2 = (l2,C2) C1 is a Set and C2 is a Set - Answers mandatory access control comparing labels when you have sets it means that ordering is ONLY PARTIAL ordering -- partial..mustaque draws a Venn diagram with two circles to demonstrate the concept Whne you have set you are always goig to have what;s called a PARTIAL SET - Answers mandatory access control comparing labels L1 = L2 iff l1 = l2 and C1=C2 contains - Answers mandatory access control comparing labels how do we know if L1 is stronger or dominates L2? A: L1 L2 if l1 = and C1 ___ C2 or can be written C1 C2 dominates - Answers mandatory access control comparing labels " " is called ___ - Answers mandatory access control comparing labels how do we know if L1 is stronger or dominates L2? 1 L1 = L2 2 L1 L2 3 L1 L2 if l1 = l2 and C1 "C" C2 4 If L1L2 and L1 not L2 and L1 not L2 then the two labels are not ordered C1 and C2... mustaque draws (again) a Venn diagram with two circles to demonstrate the concept partial ordering - Answers mandatory access control comparing labels generally we are interested in Labels and a relation induced on them that defines a LATTICE (another way about the ________ (POSET) that I am talking about least upper bound - Answers mandatory access control comparing labels Lattice -- poset + ___ (LUB) + greatest lower band (GLB) ordered - Answers mandatory access control e.g. we label it two simple integers Label -- (i,j) if you look at two elements or two label values. what is the relationship bet the two? A: neither one dominates the other. so the are not _____ lub - Answers mandatory access control e.g. we label it two simple integers Label -- (i,j) ,,,,,,,,,,,,,,,,(1,2),,,,,,,,,,,,(2,1) what is upper bound? Label -- (i,j) ,,,,,,,,,,,,,,,,,,,,,,,,,(2,2) ( _________ ) Hint: Least is "UP" ,,,,,,,,,,,,,,,,(1,2),,,,,,,,,,,,(2,1) - Answers mandatory access control so what is LUB (L1, L2)? A: LUB (L1, L2) = L1 and LUB(L1, L2) = L2 and if there is label L3 s.t. L3 = L1 and L3 = L2 then L3 = LUB( L1, L2) ask question what label dominates all these? that is the LEAST part. Find me the one that has the smallest label that serves as an upper bound lub, glb - Answers mandatory access control e.g. we label it two simple integers Label -- (i,j) ,,,,,,,,,,,,,,,,(1,2),,,,,,,,,,,,(2,1) what is the greatest lower bound? Label -- (i,j) ,,,,,,,,,,,,,,,,,,,,,,,,,(2,2) ( ____________ ) Hint: Least is "UP" ,,,,,,,,,,,,,,,,(1,2),,,,,,,,,,,,(2,1) ,,,,,,,,,,,,,,,,,,,,,,,,,,(1,1) (__________) Hint: Least is "UP" vice versa forward channel - Answers mandatory access control this week is MAC, next Tuesday is an SELinux outside Guest speaker, the following Thursday mustaque will cover ______________ which is a way to get around MAC labels - Answers mandatory access control so if I ask you what is the difference in going from DAC to MAC? A: ________ - Answers mandatory access control Labels are the fundamental difference between DAC and MAC. Depending on who you are the labels can LOOK DIFFERENT, the users will be We will first talk about concern for CONFIDENTIALLY confidentiality - Answers mandatory access control start with ______ MAC where Confidentiality named for the guys who designed it Bell La Padula model developed for a DoD conference for this you need SECURITY CLEARANCE classification - Answers mandatory access control Data Labeling is hardest problem is commercial environment People have CLEARANCES information has __________ These can go through: Top Secret (TS) Secret (S) Confidential (C) Public or Unclassified (U) Are these fully ordered? TS most sensitive I can say: *TS S C U* geography - Answers mandatory access control How about compartments? Compartments can be ________, Economic, Political info e.g. Information is about SOMETHING Documents contain info about different topics need to know - Answers mandatory access control DO compartments make sense for what user? A: What is the nature of the information that you: "_________" access rules - Answers mandatory access control we are ready to define the rule that we are going to have for MAC strictly guided by the Confidentiality rules: 1 of 2 ________ (one for read, one for write) 1 - READ - simple security requirement Subject S can read object O if label of S dominates label of O (also called the READ DOWN RULE) "you can't read up, you can only read down" This says. e.g. top secret user can read everything in the system write - Answers mandatory access control we are ready to define the rule that we are going to have for MAC strictly guided by the Confidentiality rules: 2 of 2 ACCESS RULES (one for read, one for write) 2 -____________ - start/confinement property - S can write O if S's label is dominated by the label of O (also called WRITE UP RULE) why does this make sense? A: anyone can claim to write top secret documents object owner - Answers mandatory access control so before i get into details, remember two of the requirements were: 1. it is not you but who you work for. someone can mandate the way information is to be shared. it gave ALL POWER TO _________________ 2. information Float. We want to prevent information float e.g. info flow Secret, ------------- Unclassified -- Unclassified User Object ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Object O1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,O2 ..so we need... e.g. ,,,,,,,,,,,,,,,,,,,,,,,,,,,,Unclassified ,,,,,,,,,,,,,,,,,,,,,,,,,,,,User ,,,,,,,,,,,,,,,,,,,,,,,,,,,,S1 Secret, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Unclassified -- Unclasd User Object ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Object O1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,O2 ,,,,,,,,,,,,,,,,,,,,,,,,,,,Secret ,,,,,,,,,,,,,,,,,,,,,,,,,,,Subject ,,,,,,,,,,,,,,,,,,,,,,,,,,, S2 - Answers mandatory access control e.g. ,,,,,,,,,,,,,,,,,,,,,,,,,,,,Unclassified ,,,,,,,,,,,,,,,,,,,,,,,,,,,,User ,,,,,,,,,,,,,,,,,,,,,,,,,,,,S1 Secret, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Unclassified -- Unclasd User Object ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Object O1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,O2 ,,,,,,,,,,,,,,,,,,,,,,,,,,,Secret ,,,,,,,,,,,,,,,,,,,,,,,,,,,Subject ,,,,,,,,,,,,,,,,,,,,,,,,,,, S2 Does this address information flow? A: trusted user - Answers mandatory access control a of b declassification must be done by what is called a ____________. TRUSTED USER = rules do not apply to you tranquility principle - Answers mandatory access control b of b __________ a subject cannot change security class of an Active Object TOCTOU problem that we discussed before - Answers mandatory access control lecture TWO BLP -- READ DOWN / WRITE UP U1 ----------- U2 TS ,,,,,,,,,,,,,,,,,,,,,,,,unclassified - Answers mandatory access control lecture TWO BLP -- READ DOWN / WRITE UP does NOT ADDRESS INTEGRity It is not looking a tthe content It is looking at the LABELS - Answers mandatory access control lecture TWO How can we apply this model for INTEGRITY? A: BIBA Model - Answers mandatory access control lecture TWO what kinds of rules would make sense for INTEGRITY? integrity is a quality of information (E.g. trusted newspaper) HIGH MED LOW -- Write Down, Read UP biba for HIGH, the Input has to be HIGH QUALITY, Hi integrity level - Answers mandatory access control lecture TWO What if you want both Confidentiality AND Integrity? A: Read/ Write ONLY at your __________ wrong - Answers mandatory access control lecture TWO def: Trusted User - "does no ___________" blp - Answers mandatory access control lecture TWO SELinux allows you to implement _________ if you'd like to classified - Answers mandatory access control lecture TWO 90% of the work at GTRI is _______ - Answers mandatory access control lecture TWO if a company does not need MAC then this type of control does not make sense - Answers mandatory access control lecture TWO WHen MAC ------ -- LAbels ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,User,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,DATA ,,,,,,,,,,,,,,,,,Titles, Roles etc.,,,,,,,,,,,,,proprietary, public, fin, health labels - Answers mandatory access control lecture TWO MAC REQUIRES SOME KIND OF ________ - Answers mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based Access Control) Users -- have permissions versus Users -- Roles -- Permissions permissions - Answers mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based Access Control) part 2 Basic RBAC + Generalizations Users ------- Roles --------- Permissions ,,,,,,,,,,,, Session /,,,,,,,,,,,,,,,,,,,,,,,,,,,, U = set of users R = set of Roles P = set of __________ S = set of sessions - Answers mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based Access Control) part 3 Access Control Policy -- PA and UA ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,PA C[underline] R x P ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,UA C[underline] U x R e.g. (user, role (alice, manager) what role does a user have in order to do what they need to do role - Answers mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based Access Control) part 4 What happens at execution time? at execution time ,,,,,,user: S-- U ,,,,,,role: S-- 2^R the point is: do not limit a session to a single ________ permissios - Answers mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based Access Control) part 5 What are the Permissions that a certain session S has to have? ____________(S) = U,,,,,,,,,,,,,{ P | (P,r) E (PA} ,,,,,,,,,,,,,,,,,,,,,,,,,,r E Roles (s) E = "belongs to" | = "such that???" so any permission that is r that belongs to S, that is a set of resources we have access to basic - Answers mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based Access Control) part 6 ___________ RBAC = RBAC-0 (said RBAC zero) groups - Answers mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based Access Control) part 7 Do not talk about anything unless you talk about how you want to implement it. DId we not see something like this before HINT: in DAC? A: _____________!!; Groups and Roles are Related