SOW4141 CHAPTER 8 COMPLETE STUDY
GUIDE WITH SOLVED QUESTIONS
◉ The Information Technology Infrastructure Library provides
guidance in the development and implementation of an
organizational InfoSec governance structure.
a. True
b. False.
Answer: False
◉ Separation of duties is the principle by which members of the
organization can access the minimum amount of information for the
minimum amount of time necessary to perform their required
duties.
a. True
b. False.
Answer: False
◉ Lattice-based access control specifies the level of access each
subject has to each object, if any.
a. True
b. False.
Answer: True
,◉ Under the Clark-Wilson model, internal consistency means that
the system is consistent with similar data at the organization's
competitors.
a. True
b. False.
Answer: False
◉ The principle of limiting users' access privileges to the specific
information required to perform their assigned tasks is known as
minimal access.
a. True
b. False.
Answer: False
◉ In information security, a framework or security model
customized to an organization, including implementation details, is
known as a template. __________.
Answer: False - blueprint
◉ In information security, a specification of a model to be followed
during the design, selection, and initial and ongoing implementation
of all subsequent security controls is known as a blueprint. __________.
Answer: False - framework
,◉ The information security principle that requires significant tasks
to be split up so that more than one individual is required to
complete them is called isolation of duties. __________.
Answer: False - separation
◉ The Information Technology Infrastructure Library (ITIL) is a
collection of policies and practices for managing the development
and operation of IT infrastructures. __________.
Answer: False - methods
◉ A security monitor is a conceptual piece of the system within the
trusted computer base that manages access controls—in other
words, it mediates all access to objects by subjects. __________.
Answer: False - reference
◉ The data access principle that ensures no unnecessary access to
data exists by regulating members so they can perform only the
minimum data manipulation necessary is known as required
privilege. __________.
Answer: False - least
◉ The principle of limiting users' access privileges to the specific
information required to perform their assigned tasks is known as
need-to-know. __________.
, Answer: True
◉ In a lattice-based access control, a restriction table is the row of
attributes associated with a particular subject (such as a user).
__________.
Answer: False - capabilities
◉ A security clearance is an access control model in which each user
of an information asset is assigned an authorization level that
identifies the level of classified information he or she is cleared to
access. __________.
Answer: True
◉ Dumpster exploitation is an information attack that involves
searching through a target organization's trash and recycling bins
for sensitive information. __________.
Answer: False - diving
◉ In information security, a framework or security model
customized to an organization, including implementation details, is a
_________.
a. security standard b. methodology
c. security policy d. blueprint.
Answer: d
GUIDE WITH SOLVED QUESTIONS
◉ The Information Technology Infrastructure Library provides
guidance in the development and implementation of an
organizational InfoSec governance structure.
a. True
b. False.
Answer: False
◉ Separation of duties is the principle by which members of the
organization can access the minimum amount of information for the
minimum amount of time necessary to perform their required
duties.
a. True
b. False.
Answer: False
◉ Lattice-based access control specifies the level of access each
subject has to each object, if any.
a. True
b. False.
Answer: True
,◉ Under the Clark-Wilson model, internal consistency means that
the system is consistent with similar data at the organization's
competitors.
a. True
b. False.
Answer: False
◉ The principle of limiting users' access privileges to the specific
information required to perform their assigned tasks is known as
minimal access.
a. True
b. False.
Answer: False
◉ In information security, a framework or security model
customized to an organization, including implementation details, is
known as a template. __________.
Answer: False - blueprint
◉ In information security, a specification of a model to be followed
during the design, selection, and initial and ongoing implementation
of all subsequent security controls is known as a blueprint. __________.
Answer: False - framework
,◉ The information security principle that requires significant tasks
to be split up so that more than one individual is required to
complete them is called isolation of duties. __________.
Answer: False - separation
◉ The Information Technology Infrastructure Library (ITIL) is a
collection of policies and practices for managing the development
and operation of IT infrastructures. __________.
Answer: False - methods
◉ A security monitor is a conceptual piece of the system within the
trusted computer base that manages access controls—in other
words, it mediates all access to objects by subjects. __________.
Answer: False - reference
◉ The data access principle that ensures no unnecessary access to
data exists by regulating members so they can perform only the
minimum data manipulation necessary is known as required
privilege. __________.
Answer: False - least
◉ The principle of limiting users' access privileges to the specific
information required to perform their assigned tasks is known as
need-to-know. __________.
, Answer: True
◉ In a lattice-based access control, a restriction table is the row of
attributes associated with a particular subject (such as a user).
__________.
Answer: False - capabilities
◉ A security clearance is an access control model in which each user
of an information asset is assigned an authorization level that
identifies the level of classified information he or she is cleared to
access. __________.
Answer: True
◉ Dumpster exploitation is an information attack that involves
searching through a target organization's trash and recycling bins
for sensitive information. __________.
Answer: False - diving
◉ In information security, a framework or security model
customized to an organization, including implementation details, is a
_________.
a. security standard b. methodology
c. security policy d. blueprint.
Answer: d
