IT-INFOSEC32 FINAL EXAMINATION PART 1

Which design principle suggests that every program and user should operate using the minimum set of privileges necessary?

• Complete Mediation

• Least Privilege

• Economy of Mechanism

• Fail-safe Defaults

What is the core philosophy behind Security Design Principles?

• Complexity and Restriction

• Simplicity and Openness

• Simplicity and Restriction

• Automation and Exclusion

The principle of "Fail-safe Defaults" means access decisions should be based on:

• Exclusion rather than permission

• Permission rather than exclusion

• User identity only

• The history of previous access

Which principle states that every access to every object must be checked for authority?

• Least Privilege

• Open Design

• Complete Mediation

• Separation of Privilege

"Economy of Mechanism" advises designers to:

• Use the cheapest hardware available

• Keep the design as simple and small as possible

• Reuse as many common mechanisms as possible

• Focus only on economic impacts of security

Which principle suggests that a protection mechanism requiring "two keys" is more robust than one?

• Complete Mediation

• Least Common Mechanism

• Separation of Privilege

• Work Factor

The "Open Design" principle implies that:

• Security should not depend on the secrecy of the design

• All users should have access to the source code

• The system should have no passwords

• The design must be published in a public journal

Which principle emphasizes that the human interface should be easy to use so users apply protection correctly?

• Work Factor

• Psychological Acceptability

• Compromise Recording

• Least Common Mechanism

"Least Common Mechanism" aims to:

• Maximize shared channels between users

• Minimize the amount of mechanism common to more than one user

• Use only the least expensive security tools

• Ensure all users use the same password

What does the "Work Factor" principle involve?

• Measuring how many hours employees work on security

• Comparing the cost of circumventing security with an attacker's resources

• Increasing the speed of the system's processors

• Reducing the amount of manual labor in security audits