Information Security MCQs with Answers
Practice important Information Security MCQs with answers and explanations.
Chapter: 21
Q421:
What is a key feature of Mandatory Access Control (MAC)?
A. Access is controlled by system mechanisms, not by user identity
B. Access is based on the identity of the subject and object
C. Access permissions are set by the owner of the object
D. Access is controlled by the creator of the information
Correct Answer:
A
Chapter: 21
Q422:
In the given examples, what does the rule-based control (MAC) refer to?
A. The law allowing a court to access driving records without permission
B. The owner's ability to control access based on identity
C. The creator's control over the dissemination of information
D. The user's discretion in granting or denying access to files
Correct Answer:
A
Chapter: 21
Q423:
Which type of policy would address a situation where a customer's account balance is exposed?
A. Confidentiality policy
B. Integrity policy
C. Availability policy
D. Commercial policy
Correct Answer:
A
Chapter: 21
Q424:
What might a security policy ensure regarding transactions?
A. All transactions must be well-formed and consistent
B. Transactions must be completed within a specific timeframe
C. Transactions must be encrypted during transmission
D. Transactions must be logged for auditing purposes
Correct Answer:
A
Chapter: 21
Q425:
What is an example of an access control mechanism that bases access on the creator of the information?
A. Originator Controlled Access Control (ORCON)
B. Discretionary Access Control (DAC)
C. Mandatory Access Control (MAC)
D. Role-Based Access Control (RBAC)
Correct Answer:
A
Chapter: 21
Q426:
How does a military security policy differ from a confidentiality policy?
A. A military security policy may also address integrity, while a confidentiality policy focuses solely on confidentiality
B. A military security policy deals with data tampering, while a confidentiality policy does not
C. A military security policy is less concerned with confidentiality compared to a commercial policy
D. A military security policy sets service parameters, while a confidentiality policy does not
Correct Answer:
A
Chapter: 22
Q427:
What does data confidentiality aim to protect against?
A. Unintended or unauthorized access
B. Unintended data modification
C. Unintentional data deletion
D. Unauthorized data transmission
Correct Answer:
A
Chapter: 22
Q428:
Which model is commonly used for confidentiality policies in military/government areas?
A. Biba’s Integrity Policy
B. Model
C. Low Water Mark Policy
D. Bell-LaPadula Model
Correct Answer:
B
Chapter: 22
Q429:
Which policy is designed to prevent unauthorized disclosure of information?
A. Integrity policy
B. Confidentiality policy
C. Access Control policy
D. Hybrid policy
Correct Answer:
B
Chapter: 22
Q430:
Which of the following is a known confidentiality policy model?
A. Chinese Wall Model
B. Role-Based Access Control (RBAC)
C. Bell-LaPadula Model
D. LOCUS Integrity Policy Model
Correct Answer:
C
Chapter: 22
Q431:
What does the Biba’s Integrity Policy Model focus on?
A. Confidentiality of information
B. Accuracy and unaltered data representation
C. Access control rules
D. Information flow restrictions
Correct Answer:
B
Chapter: 22
Q432:
What is the main focus of integrity policies?
A. Accuracy and unchanged data representation
B. Unauthorized access prevention
C. Information flow control
D. Confidentiality of sensitive information
Correct Answer:
A
Chapter: 22
Q433:
Which hybrid model combines both confidentiality and integrity?
A. Chinese Wall Model
B. Role-Based Access Control (RBAC)
C. Originator Controlled Access Control (ORCON)
D. LOCUS Integrity Policy Model
Correct Answer:
A
Chapter: 22
Q434:
What is the purpose of the "Publish" step in developing information systems security policies?
A. To check whether the policy is followed
B. To publish the policy document
C. To design the policy
D. To evaluate the policy’s effect
Correct Answer:
B
Chapter: 22
Q435:
What does the "Monitor compliance" step involve?
A. Publishing the policy document
B. Evaluating the policy’s effect
C. Checking adherence to the policy
D. Amending and updating the policy
Correct Answer:
C
Chapter: 22
Q436:
Which stakeholder sets security goals and provides resources?
A. Security experts
B. Users
C. Management
D. System/network administrators
Correct Answer:
C
Chapter: 22
Q437:
What is the role of auditors in relation to security policies?
A. Designing and updating the policy
B. Implementing security controls
C. Setting security goals
D. Monitoring and checking compliance
Correct Answer:
D
Chapter: 22
Q438:
What does the "Evaluate" step in policy development assess?
A. The adherence to the policy
B. The design and implementation of the policy
C. The policy's effectiveness and impact
D. The updates required for the policy
Correct Answer:
C
Chapter: 22
Q439:
In which step is the policy document actually created and shared?
A. Design
B. Implement
C. Publish
D. Review
Correct Answer:
C
Chapter: 22
Q440:
Which step involves checking if the policy is still relevant and up-to-date?
A. Enforce
B. Review
C. Design
D. Monitor compliance
Correct Answer:
B