WGU, Information Security and Assurance
(C725), SET III UPDATED ACTUAL
Exam Questions and CORRECT
ANSWERS
A job title: Have access to information resources in accordance with the owner-defined
controls and access rules. - CORRECT ANSWER✔✔- Users
One purpose of a security awareness program is to modify which of the following?
A. Employees' attitudes and behaviors
B. Management's approach
C. Attitudes of employees toward sensitive data
D. Corporate attitudes about safeguarding data - CORRECT ANSWER✔✔- A. Employees'
attitudes and behaviors
Explanation:
Because people are the weakest link in any security-related process, it's crucial that a security
program address user education, awareness, and training on policies and procedures that
affect them.
The totality of protection mechanisms within a computer system, including hardware,
firmware, and software. It consists of one or more components that together enforce a unified
security policy over a product or system - CORRECT ANSWER✔✔- Trusted Computing
Base (TCB)
A software model that mediates all access from any subject (user or other device) to any
object (resource, data, and so forth);
it cannot be bypassed.It mediates accesses to objects by subjects. In principle, it should be:
,Complete, to mediate every access
Isolated from modification by other system entities (objects and processes)
Verifiable, doing only what it's programmed to do and not being susceptible to circumvention
by malicious acts or programmer error - CORRECT ANSWER✔✔- reference monitor
a.k.a. abstract machine
Implementation of a reference monitor for a specific hardware base, such as Sun Solaris, Red
Hat Linux, or Mac OS X. - CORRECT ANSWER✔✔- security kernel
The TCB, reference monitor, and security kernel are essential for military- and government-
grade information technology (IT) security to prevent unauthorized access or threats to the
integrity of programs, operating systems, or data.
T or F
In "The ring of trust" Trust in a system moves from the outside to the inside in a
unidirectional mode. - CORRECT ANSWER✔✔- True
T or F
Multics was the first operating system to provide a hierarchical file system - CORRECT
ANSWER✔✔- True
Which of the following terms best defines the sum of protection mechanisms inside the
computer, including hardware, firmware, and software?
A . Trusted system
B .Security kernel
C. Trusted computing base
, D. Security perimeter - CORRECT ANSWER✔✔- C. Trusted computing base
Explanation:
The Trusted Computing Base (TCB) is the totality of protection mechanisms within a
computer system, including hardware, firmware, and software.
A TCB practice in which a design objective in which each process has its own distinct
address space for its application code and data. Such a design makes it possible to prevent
each process from accessing another process's data. This prevents data or information leakage
and prevents modification of the data while in memory. - CORRECT ANSWER✔✔- Process
isolation
A TCB practice in which a process (program) have no more privilege than what it really
needs to perform its functions. Any modules that require supervisor or root access (that is,
complete system privileges) are embedded in the operating system kernel. The kernel handles
all requests for system resources and mediates the access from external modules to privileged
modules when required. - CORRECT ANSWER✔✔- The principle of least privilege
A TCB practice in which specifically relates to the segmentation of memory into protected
segments. The kernel allocates the required amount of memory for the process to load its
application code, its process data, and its application data. The system prevents user
processes from accessing another process's allocated memory. It also prevents user processes
from accessing system memory. - CORRECT ANSWER✔✔- Hardware segmentation
A TCB practice in which process operation that is divided into layers by function. Each layer
deals with a specific activity. The lower (outer) layers perform basic tasks, whereas the higher
(inner) layers perform more complex or protected tasks. - CORRECT ANSWER✔✔-
Layering
A TCB practice in which a process that defines a specific set of permissible values for an
object and the operations that are permissible on that object. This involves ignoring or
separating implementation details to concentrate on what is important to maintain security. -
CORRECT ANSWER✔✔- Abstraction
A TCB practice in which a mechanism used to ensure that information available at one
processing level is not available in another, regardless of whether it is higher or lower. It is
(C725), SET III UPDATED ACTUAL
Exam Questions and CORRECT
ANSWERS
A job title: Have access to information resources in accordance with the owner-defined
controls and access rules. - CORRECT ANSWER✔✔- Users
One purpose of a security awareness program is to modify which of the following?
A. Employees' attitudes and behaviors
B. Management's approach
C. Attitudes of employees toward sensitive data
D. Corporate attitudes about safeguarding data - CORRECT ANSWER✔✔- A. Employees'
attitudes and behaviors
Explanation:
Because people are the weakest link in any security-related process, it's crucial that a security
program address user education, awareness, and training on policies and procedures that
affect them.
The totality of protection mechanisms within a computer system, including hardware,
firmware, and software. It consists of one or more components that together enforce a unified
security policy over a product or system - CORRECT ANSWER✔✔- Trusted Computing
Base (TCB)
A software model that mediates all access from any subject (user or other device) to any
object (resource, data, and so forth);
it cannot be bypassed.It mediates accesses to objects by subjects. In principle, it should be:
,Complete, to mediate every access
Isolated from modification by other system entities (objects and processes)
Verifiable, doing only what it's programmed to do and not being susceptible to circumvention
by malicious acts or programmer error - CORRECT ANSWER✔✔- reference monitor
a.k.a. abstract machine
Implementation of a reference monitor for a specific hardware base, such as Sun Solaris, Red
Hat Linux, or Mac OS X. - CORRECT ANSWER✔✔- security kernel
The TCB, reference monitor, and security kernel are essential for military- and government-
grade information technology (IT) security to prevent unauthorized access or threats to the
integrity of programs, operating systems, or data.
T or F
In "The ring of trust" Trust in a system moves from the outside to the inside in a
unidirectional mode. - CORRECT ANSWER✔✔- True
T or F
Multics was the first operating system to provide a hierarchical file system - CORRECT
ANSWER✔✔- True
Which of the following terms best defines the sum of protection mechanisms inside the
computer, including hardware, firmware, and software?
A . Trusted system
B .Security kernel
C. Trusted computing base
, D. Security perimeter - CORRECT ANSWER✔✔- C. Trusted computing base
Explanation:
The Trusted Computing Base (TCB) is the totality of protection mechanisms within a
computer system, including hardware, firmware, and software.
A TCB practice in which a design objective in which each process has its own distinct
address space for its application code and data. Such a design makes it possible to prevent
each process from accessing another process's data. This prevents data or information leakage
and prevents modification of the data while in memory. - CORRECT ANSWER✔✔- Process
isolation
A TCB practice in which a process (program) have no more privilege than what it really
needs to perform its functions. Any modules that require supervisor or root access (that is,
complete system privileges) are embedded in the operating system kernel. The kernel handles
all requests for system resources and mediates the access from external modules to privileged
modules when required. - CORRECT ANSWER✔✔- The principle of least privilege
A TCB practice in which specifically relates to the segmentation of memory into protected
segments. The kernel allocates the required amount of memory for the process to load its
application code, its process data, and its application data. The system prevents user
processes from accessing another process's allocated memory. It also prevents user processes
from accessing system memory. - CORRECT ANSWER✔✔- Hardware segmentation
A TCB practice in which process operation that is divided into layers by function. Each layer
deals with a specific activity. The lower (outer) layers perform basic tasks, whereas the higher
(inner) layers perform more complex or protected tasks. - CORRECT ANSWER✔✔-
Layering
A TCB practice in which a process that defines a specific set of permissible values for an
object and the operations that are permissible on that object. This involves ignoring or
separating implementation details to concentrate on what is important to maintain security. -
CORRECT ANSWER✔✔- Abstraction
A TCB practice in which a mechanism used to ensure that information available at one
processing level is not available in another, regardless of whether it is higher or lower. It is
