Question 110 An authentication system adds five complex gateways that provide identical checks and create a fragile dependency chain. What design improvement is appropriate? Simplify the control path while retaining necessary independent defense layers Minimize personal-data collection at design time and restrict unnecessary telemetry Document shared-responsibility boundaries for infrastructure and customer-side identity controls Separate payment creation and approval duties across independent authorized roles Explanation Correct Answer A:Complexity adds failure modes; defense in depth is not synonymous with duplicating every mechanism. Incorrect Answers B:For the separate situation in which a new service logs full consumer profiles by default even though only aggregate counts are needed, privacy by design reduces sensitive data before it enters logs or downstream copies; here the stated problem requires simplify the control path while retaining necessary independent defense layers. C:Provider protection of facilities does not remove customer responsibility for effective account access; although this helps when a cloud workload relies on a provider's data-center encryption and assumes customer IAM is handled automatically, it leaves the current case's need to simplify the control path while retaining necessary independent defense layers unresolved. D:Segregation of duties makes unilateral fraudulent changes harder; although this helps when a finance application allows the same engineer to create and approve payments, it leaves the current case's need to simplify the control path while retaining necessary independent defense layers unresolved.
Question 111 An organization values confidentiality above integrity for a multilevel classified document repository. Which model is most closely associated with preventing read-up and write-down? Use Biba-style integrity constraints to restrict improper modification flows Apply Bell–LaPadula information-flow rules to enforce confidentiality labels Use Clark–Wilson well-formed transactions and separation-of-duty controls Use system-enforced mandatory labels rather than relying on object-owner permissions Explanation Correct Answer B:Bell–LaPadula emphasizes preventing unauthorized disclosure across security classifications. Incorrect Answers A:Biba's primary focus is preserving data integrity across trust levels; this responds to the different circumstance in which a financial ledger must prevent a lower-integrity process from corrupting high-integrity records, while the current case states that an organization values confidentiality above integrity for a multilevel classified document repository, calling for apply Bell–LaPadula information-flow rules to enforce confidentiality labels. C:The other scenario states that a system must enforce transaction integrity through certified procedures and separated roles, not just labels, where clark–Wilson applies integrity verification and controlled transformations to commercial operations; by contrast, the present case requires apply Bell–LaPadula information-flow rules to enforce confidentiality labels. D:For the separate situation in which a design team confuses mandatory access control with a file owner's discretion, mAC decisions are made by central policy on labels rather than freely delegated file ownership; here the stated problem requires apply Bell–LaPadula information-flow rules to enforce confidentiality labels.
Question 112 A financial ledger must prevent a lower-integrity process from corrupting high-integrity records. Which model addresses this? Use Clark–Wilson well-formed transactions and separation-of-duty controls Add separate integrity protections because confidentiality flow policy alone is insufficient Apply Bell–LaPadula information-flow rules to enforce confidentiality labels Use Biba-style integrity constraints to restrict improper modification flows Explanation Correct Answer D:Biba's primary focus is preserving data integrity across trust levels. Incorrect Answers A:Clark–Wilson applies integrity verification and controlled transformations to commercial operations; although this helps when a system must enforce transaction integrity through certified procedures and separated roles, not just labels, it leaves the current case's need to use Biba-style integrity constraints to restrict improper modification flows unresolved. B:This option fits a different fact pattern where a security model restricts what subjects can read based on their classification but does not guarantee that the content is accurate: confidentiality models protect secrecy; trust in record correctness requires additional controls; the current case instead requires use Biba-style integrity constraints to restrict improper modification flows. C:This option fits a different fact pattern where an organization values confidentiality above integrity for a multilevel classified document repository: bell–LaPadula emphasizes preventing unauthorized disclosure across security classifications; the current case instead requires use Biba-style integrity constraints to restrict improper modification flows.
Question 113 A system must enforce transaction integrity through certified procedures and separated roles, not just labels. Which model is relevant? Use system-enforced mandatory labels rather than relying on object-owner permissions Use Clark–Wilson well-formed transactions and separation-of-duty controls Apply Bell–LaPadula information-flow rules to enforce confidentiality labels Add separate integrity protections because confidentiality flow policy alone is insufficient Explanation Correct Answer B:Clark–Wilson applies integrity verification and controlled transformations to commercial operations. Incorrect Answers A:The other scenario states that a design team confuses mandatory access control with a file owner's discretion, where mAC decisions are made by central policy on labels rather than freely delegated file ownership; by contrast, the present case requires use Clark–Wilson well-formed transactions and separation-of-duty controls. C:This option fits a different fact pattern where an organization values confidentiality above integrity for a multilevel classified document repository: bell–LaPadula emphasizes preventing unauthorized disclosure across security classifications; the current case instead requires use Clark–Wilson well-formed transactions and separation-of-duty controls. D:Confidentiality models protect secrecy; trust in record correctness requires additional controls; this responds to the different circumstance in which a security model restricts what subjects can read based on their classification but does not guarantee that the content is accurate, while the current case states that a system must enforce transaction integrity through certified procedures and separated roles, not just labels, calling for use Clark–Wilson well-formed transactions and separation-of-duty controls.
Question 114 A design team confuses mandatory access control with a file owner's discretion. What should it choose for centrally enforced classification rules? Use system-enforced mandatory labels rather than relying on object-owner permissions Use Biba-style integrity constraints to restrict improper modification flows Add separate integrity protections because confidentiality flow policy alone is insufficient Use Clark–Wilson well-formed transactions and separation-of-duty controls Explanation Correct Answer A:MAC decisions are made by central policy on labels rather than freely delegated file ownership. Incorrect Answers B:For the separate situation in which a financial ledger must prevent a lower-integrity process from corrupting high-integrity records, biba's primary focus is preserving data integrity across trust levels; here the stated problem requires use system-enforced mandatory labels rather than relying on object-owner permissions. C:This option fits a different fact pattern where a security model restricts what subjects can read based on their classification but does not guarantee that the content is accurate: confidentiality models protect secrecy; trust in record correctness requires additional controls; the current case instead requires use system-enforced mandatory labels rather than relying on object-owner permissions. D:For the separate situation in which a system must enforce transaction integrity through certified procedures and separated roles, not just labels, clark–Wilson applies integrity verification and controlled transformations to commercial operations; here the stated problem requires use system-enforced mandatory labels rather than relying on object-owner permissions.
Question 115 A security model restricts what subjects can read based on their classification but does not guarantee that the content is accurate. What is the limitation? Apply Bell–LaPadula information-flow rules to enforce confidentiality labels Use Biba-style integrity constraints to restrict improper modification flows Add separate integrity protections because confidentiality flow policy alone is insufficient Use system-enforced mandatory labels rather than relying on object-owner permissions Explanation Correct Answer C:Confidentiality models protect secrecy; trust in record correctness requires additional controls. Incorrect Answers A:Bell–LaPadula emphasizes preventing unauthorized disclosure across security classifications; this responds to the different circumstance in which an organization values confidentiality above integrity for a multilevel classified document repository, while the current case states that a security model restricts what subjects can read based on their classification but does not guarantee that the content is accurate, calling for add separate integrity protections because confidentiality flow policy alone is insufficient. B:This option fits a different fact pattern where a financial ledger must prevent a lower-integrity process from corrupting high-integrity records: biba's primary focus is preserving data integrity across trust levels; the current case instead requires add separate integrity protections because confidentiality flow policy alone is insufficient. D:MAC decisions are made by central policy on labels rather than freely delegated file ownership; although this helps when a design team confuses mandatory access control with a file owner's discretion, it leaves the current case's need to add separate integrity protections because confidentiality flow policy alone is insufficient unresolved.
Question 116 A regulator requires a service to produce verifiable history of privileged changes. What requirement should drive control selection? Assess operational safety and select passive visibility or validated maintenance-window testing Derive confidentiality and access requirements from the data classification and threat model Define tamper-evident audit generation, retention and review criteria Map each obligation to control objectives, verification evidence and accountable owners Explanation Correct Answer C:Specific accountability objectives guide selection of logging and integrity controls. Incorrect Answers A:A control that interrupts safety-critical equipment can create more risk than it mitigates; although this helps when a plant's industrial controller cannot tolerate active packet scanning, it leaves the current case's need to define tamper-evident audit generation, retention and review criteria unresolved. B:The other scenario states that a research archive has confidential data but no defined loss scenarios, where choosing encryption products before requirements risks leaving real exposure paths open; by contrast, the present case requires define tamper-evident audit generation, retention and review criteria. D:This option fits a different fact pattern where a hospital calls any security tool 'compliant' without connecting it to evidence requirements: control suitability includes demonstrable effectiveness and compliance evidence, not product labels; the current case instead requires define tamper-evident audit generation, retention and review criteria.
Question 117 A plant's industrial controller cannot tolerate active packet scanning. What is the appropriate control-selection response? Derive confidentiality and access requirements from the data classification and threat model Trace recovery requirements to architecture capacity, failover and restoration tests Map each obligation to control objectives, verification evidence and accountable owners Assess operational safety and select passive visibility or validated maintenance-window testing Explanation Correct Answer D:A control that interrupts safety-critical equipment can create more risk than it mitigates. Incorrect Answers A:Choosing encryption products before requirements risks leaving real exposure paths open; it is relevant where a research archive has confidential data but no defined loss scenarios, whereas the current facts require assess operational safety and select passive visibility or validated maintenance-window testing to address the stated problem. B:Availability design should be justified by measurable business recovery constraints; this responds to the different circumstance in which an online retailer must protect a checkout workflow under a specified recovery-time objective, while the current case states that a plant's industrial controller cannot tolerate active packet scanning, calling for assess operational safety and select passive visibility or validated maintenance-window testing. C:This option fits a different fact pattern where a hospital calls any security tool 'compliant' without connecting it to evidence requirements: control suitability includes demonstrable effectiveness and compliance evidence, not product labels; the current case instead requires assess operational safety and select passive visibility or validated maintenance-window testing.
Question 118 An online retailer must protect a checkout workflow under a specified recovery-time objective. How should resilience controls be chosen? Define tamper-evident audit generation, retention and review criteria Trace recovery requirements to architecture capacity, failover and restoration tests Map each obligation to control objectives, verification evidence and accountable owners Assess operational safety and select passive visibility or validated maintenance-window testing Explanation Correct Answer B:Availability design should be justified by measurable business recovery constraints. Incorrect Answers A:For the separate situation in which a regulator requires a service to produce verifiable history of privileged changes, specific accountability objectives guide selection of logging and integrity controls; here the stated problem requires trace recovery requirements to architecture capacity, failover and restoration tests. C:Control suitability includes demonstrable effectiveness and compliance evidence, not product labels; although this helps when a hospital calls any security tool 'compliant' without connecting it to evidence requirements, it leaves the current case's need to trace recovery requirements to architecture capacity, failover and restoration tests unresolved. D:For the separate situation in which a plant's industrial controller cannot tolerate active packet scanning, a control that interrupts safety-critical equipment can create more risk than it mitigates; here the stated problem requires trace recovery requirements to architecture capacity, failover and restoration tests.
Question 119 A research archive has confidential data but no defined loss scenarios. What is the most defensible first engineering step? Map each obligation to control objectives, verification evidence and accountable owners Trace recovery requirements to architecture capacity, failover and restoration tests Define tamper-evident audit generation, retention and review criteria Derive confidentiality and access requirements from the data classification and threat model Explanation Correct Answer D:Choosing encryption products before requirements risks leaving real exposure paths open. Incorrect Answers A:Control suitability includes demonstrable effectiveness and compliance evidence, not product labels; although this helps when a hospital calls any security tool 'compliant' without connecting it to evidence requirements, it leaves the current case's need to derive confidentiality and access requirements from the data classification and threat model unresolved. B:Availability design should be justified by measurable business recovery constraints; it is relevant where an online retailer must protect a checkout workflow under a specified recovery-time objective, whereas the current facts require derive confidentiality and access requirements from the data classification and threat model to address the stated problem. C:For the separate situation in which a regulator requires a service to produce verifiable history of privileged changes, specific accountability objectives guide selection of logging and integrity controls; here the stated problem requires derive confidentiality and access requirements from the data classification and threat model.
Question 120 A hospital calls any security tool 'compliant' without connecting it to evidence requirements. What selection process should improve? Derive confidentiality and access requirements from the data classification and threat model Map each obligation to control objectives, verification evidence and accountable owners Assess operational safety and select passive visibility or validated maintenance-window testing Assess fire detection and suppression options against occupancy and equipment hazards Explanation Correct Answer B:Control suitability includes demonstrable effectiveness and compliance evidence, not product labels. Incorrect Answers A:Choosing encryption products before requirements risks leaving real exposure paths open; although this helps when a research archive has confidential data but no defined loss scenarios, it leaves the current case's need to map each obligation to control objectives, verification evidence and accountable owners unresolved. C:A control that interrupts safety-critical equipment can create more risk than it mitigates; although this helps when a plant's industrial controller cannot tolerate active packet scanning, it leaves the current case's need to map each obligation to control objectives, verification evidence and accountable owners unresolved. D:Suppression choices must consider safety, local codes and damage to critical systems; although this helps when a fire-control proposal uses water suppression without evaluating energized equipment and people, it leaves the current case's need to map each obligation to control objectives, verification evidence and accountable owners unresolved.
