NSTISSC Security Model MCQs

The NSTISSC Security Model is best described as a:

• Linear security lifecycle model

• Risk assessment framework

• 3×3×3 multidimensional information security framework

• Encryption-based security architecture

Which of the following is NOT one of the three core dimensions of the NSTISSC Security Model?

• CIA Triad

• Information States

• Security Solutions

• Threat Classification

In the NSTISSC model, which information state refers to data actively being used by applications?

• Storage

• Transmission

• Processing

• Archiving

Encrypting student records stored in a university database primarily addresses which NSTISSC cell?

• Integrity – Storage – Education

• Availability – Storage – Technology

• Confidentiality – Storage – Technology

• Confidentiality – Transmission – Policy

Which solution dimension focuses on awareness, training, and user behavior?

• Policy

• Technology

• Education

• Risk Management

Why does the NSTISSC Security Model require addressing all 27 cells?

• To comply with ISO standards

• To reduce hardware costs

• To ensure no security gaps exist across all dimensions

• To simplify system architecture

Training staff to prevent data entry errors mainly supports which security objective during processing?

• Confidentiality

• Availability

• Integrity

• Non-repudiation

Implementing disaster recovery plans to ensure continuous access to online portals mainly addresses:

• Confidentiality – Processing – Policy

• Integrity – Transmission – Technology

• Availability – Transmission – Policy/Technology

• Integrity – Storage – Education

Which combination best represents a policy-based control in the NSTISSC model?

• Firewalls and IDS

• Encryption algorithms

• Security awareness workshops

• Access control rules and disaster recovery policies

A security program that focuses only on technology solutions but ignores education and policy will most likely:

• Fully comply with NSTISSC requirements

• Be cost-effective and secure

• Improve confidentiality only

• Leave critical security gaps unaddressed