CISSP Security Architecture and Engineering: 87 practice questions

12 of the 87 Security Architecture and Engineering questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. Neither operation is permitted: Under the Bell-LaPadula model, which operations are permitted?

1. Both operations are permitted

   Neither operation is permitted. Bell-LaPadula restricts both upward reads and downward writes to prevent information leakage from higher classification levels.
2. Read Top Secret is permitted; write to Unclassified is denied

   This reverses the model's rules. Bell-LaPadula's simple security property explicitly prohibits reading above one's clearance level (no read up).
3. Neither operation is permitted ✓

   Bell-LaPadula enforces 'no read up' (cannot read Top Secret with Secret clearance) and 'no write down' (*-property: cannot write to Unclassified from Secret level). Both operations violate the model.
4. Read Top Secret is denied; write to Unclassified is permitted

   Writing to a lower classification (downward write) is denied under the *-property of Bell-LaPadula, because it would allow classified data to leak to a lower level.

Bell-LaPadula enforces 'no read up, no write down' — reading above clearance level and writing below classification level are both denied.

2. Biba model; integrity — its no-read-down and no-write-up: Which security model is being implemented, and what

1. Clark-Wilson model; integrity — it relies on constrained data items and transformation procedures rather than labels

   Clark-Wilson uses constrained data items (CDIs), transformation procedures (TPs), and integrity verification procedures (IVPs) — not the label-based read/write restrictions described in the scenario.
2. Brewer-Nash model; conflict of interest — it blocks information flow between directly competing client firms

   Brewer-Nash (Chinese Wall) prevents information flow between competing organizations, not the integrity-based read/write restrictions described in this scenario.
3. Bell-LaPadula model; confidentiality — its no-read-up and no-write-down rules protect classified secrets

   Bell-LaPadula uses 'no read up, no write down' rules for confidentiality. The scenario describes opposite rules (no read down, no write up), which is Biba.
4. Biba model; integrity — its no-read-down and no-write-up rules prevent the corruption of high-integrity data ✓

   Biba's simple integrity property = no read down (high integrity subject cannot read low integrity object). The *-integrity property = no write up (low integrity subject cannot write to high integrity object). Its primary focus is data integrity, not confidentiality.

Biba enforces 'no read down, no write up' to protect data integrity — the exact opposite directional rules from Bell-LaPadula.

3. Clark-Wilson model: This design most closely implements which security model, and what are its core components

1. Clark-Wilson model; using Constrained Data Items (CDIs), Transformation Procedures (TPs), and Integrity Verification Procedures (IVPs) ✓

   Clark-Wilson is the commercial integrity model. Account balances are CDIs (data whose integrity must be maintained). Authorized transaction programs are TPs (the only allowed modification mechanism). System consistency checks are IVPs. Logging supports the model's audit requirements.
2. Biba model; using integrity labels together with its no-read-down and no-write-up access control rules for subjects and objects

   Biba uses simple label-based access control (no read down, no write up). It does not specify constrained procedures, transformation rules, or integrity verification as described in the scenario.
3. Bell-LaPadula model; using hierarchical classification labels and the star property to enforce the confidentiality of data

   Bell-LaPadula is a confidentiality model for military-style classifications. It does not address authorized transaction procedures or integrity verification of data items.
4. Graham-Denning model; using its primitive rules for creating and deleting objects and transferring access rights between the subjects in a system

   Graham-Denning focuses on object and subject creation/deletion and transferring access rights. It does not define transaction-based integrity controls like CDIs and TPs.

Clark-Wilson models commercial integrity: CDIs are protected data, TPs are the only authorized modification programs, and IVPs verify consistency.

4. Reference monitor: Which concept describes this enforcement mechanism, and what are its required properties?

1. Trusted Computing Base (TCB); must include all hardware, firmware, and software

   The TCB is the totality of hardware, firmware, and software that enforces security policy. The reference monitor is a specific concept within the TCB describing the access mediation mechanism with specific properties.
2. Reference monitor; must be always invoked, tamperproof, and verifiable ✓

   The reference monitor is the abstract concept of a security enforcement mechanism that mediates all access. Its three required properties: (1) always invoked — no bypass path exists, (2) tamperproof — cannot be modified by untrusted entities, (3) small enough to be verifiable — can be formally analyzed for correctness.
3. Security kernel; must be implemented in hardware only

   The security kernel implements the reference monitor concept in software/firmware — it is not limited to hardware. The security kernel is the real-world implementation of the abstract reference monitor concept.
4. Access Control List (ACL); must define permissions for every subject-object pair

   An ACL is a data structure listing permissions, not an enforcement mechanism. The reference monitor is the mechanism that consults ACLs and enforces access decisions.

The reference monitor mediates all access and must be always invoked (no bypass), tamperproof, and small enough to be formally verified.

5. Trusted Platform Module with measured boot: Which technology provides both capabilities?

1. UEFI Secure Boot only

   UEFI Secure Boot verifies digital signatures of boot components to prevent loading unsigned code. However, it does not provide hardware-protected key storage — that requires TPM. Secure Boot and TPM are complementary but distinct technologies.
2. Hardware Security Module (HSM)

   An HSM provides cryptographic operations and key management, but it is typically a network-attached or PCIe device for enterprise key management — not a chip built into every laptop for boot integrity measurement.
3. Trusted Platform Module (TPM) with measured boot ✓

   TPM is a hardware chip that provides: (1) key storage in tamper-resistant hardware (sealed storage), (2) measured boot — records hash values of each boot component in PCR registers, enabling attestation that firmware/boot sequence has not been modified.
4. Full Disk Encryption (FDE) with pre-boot authentication

   FDE with pre-boot authentication protects data at rest but does not attest to the integrity of firmware or the boot chain — it only verifies a user password/PIN before decryption.

TPM provides hardware-based key storage and boot integrity measurement (measured boot), recording hashes of each boot stage in PCR registers for attestation.

6. Use asymmetric encryption to exchange a symmetric session: Which approach correctly balances these requirement

1. Use AES alone with a single pre-shared key that is distributed to both parties out-of-band before the session begins

   AES with a pre-shared key does not solve the authentication problem — a pre-shared key must be distributed securely in advance and cannot be verified in-session, unlike the authenticated key exchange provided by PKI/asymmetric methods.
2. Use RSA on its own to encrypt the entire 500 MB file directly, on the grounds that asymmetric encryption offers the strongest security

   RSA (asymmetric) is computationally expensive and impractical for bulk data encryption. RSA is used for key exchange and small data (signatures, key wrapping), not for encrypting megabytes of content.
3. Use Diffie-Hellman on its own to encrypt the 500 MB file directly between the web server and the connecting client

   Diffie-Hellman is a key agreement protocol, not an encryption algorithm — it cannot directly encrypt data. DH is used to derive a shared secret that is then used as a symmetric encryption key.
4. Use asymmetric encryption (RSA) to exchange a symmetric session key, then use AES to encrypt the bulk data transfer ✓

   This is the hybrid encryption model used by TLS. Asymmetric encryption solves the key exchange problem (no shared secret needed beforehand), while symmetric encryption (AES) is orders of magnitude faster for bulk data. The session key is ephemeral, discarded after the session.

Hybrid encryption uses asymmetric (RSA/DH) for key exchange and symmetric (AES) for bulk data — combining authentication with performance.

7. Vendor hashes the software: Which sequence correctly describes the signing and verification process?

1. Vendor hashes the software, encrypts the hash with their private key (signature). Customer decrypts the signature with vendor's public key, hashes the software, and compares hashes. ✓

   Digital signature creation: hash the data, encrypt the hash with the signer's PRIVATE key. Verification: decrypt the signature with the signer's PUBLIC key, independently hash the received data, compare. If hashes match, integrity is confirmed and the sender is authenticated (only the private key owner could have created the signature).
2. Vendor encrypts the entire software package with their own public key to sign it, and the customer then decrypts the whole package again using the vendor's private key to verify it

   This reverses the key roles. Public key encryption would mean only the vendor could decrypt (not the public customer). Also, digital signatures don't encrypt the whole software — they encrypt only the hash.
3. Vendor and customer first exchange a shared symmetric key, the vendor encrypts the hash of the software with that key, and the customer decrypts the hash again using the very same shared key

   Symmetric key signing provides integrity but not non-repudiation — both parties know the key, so either could have created the signature. Digital signatures require asymmetric keys so that only the signer could have produced the signature.
4. Vendor hashes the software and encrypts that hash with their own public key to produce the signature, and the customer then decrypts the resulting signature using the vendor's private key

   This is backwards. The signature is created using the PRIVATE key (only the owner has it, proving authenticity). Verification uses the PUBLIC key (anyone can verify). If the public key encrypted the signature, only the private key holder could verify — defeating the purpose of public verification.

Digital signature: hash the data, encrypt with PRIVATE key. Verification: decrypt with PUBLIC key, compare hashes. Private key signing ensures only the key owner could have signed.

8. OCSP , which asks a responder for a single certificate's: Which mechanism satisfies this requirement?

1. Key escrow, which keeps a copy of the cryptographic keys with a trusted third party so that they can be recovered later if ever needed

   Key escrow refers to storing a copy of cryptographic keys with a trusted third party for recovery purposes. It has no role in certificate revocation checking.
2. OCSP (Online Certificate Status Protocol), which asks a responder for a single certificate's revocation state in real time ✓

   OCSP allows a client to query an OCSP responder for the revocation status of a specific certificate in real time. It returns a simple Good/Revoked/Unknown response, avoiding the need to download the full CRL.
3. Certificate stapling, where the server attaches a pre-fetched OCSP response directly onto its own TLS handshake reply

   Certificate stapling (OCSP Stapling) is an optimization where the server attaches a pre-fetched OCSP response to the TLS handshake. While related to OCSP, it is the server-side optimization, not the protocol itself that checks real-time status.
4. CRL (Certificate Revocation List), a periodically published file that lists every certificate the CA has revoked

   A CRL is a periodically published list of revoked certificates. It requires downloading the entire list and does not provide real-time status — there is a latency window between revocation and CRL publication.

OCSP provides real-time certificate revocation status for individual certificates; CRL requires downloading the full revocation list periodically.

9. Rainbow table attack: Which attack is being mitigated, and why does the fix work?

1. Brute force attack; salting lengthens each stored password so that guessing every possible input value becomes far more time-consuming for an attacker

   Brute force tries all possible inputs. While salting does increase the input space slightly, the primary purpose is to defeat precomputed attacks (rainbow tables), not to add meaningful resistance to brute force. Salts are typically stored in plaintext alongside the hash.
2. Replay attack; salting guarantees that every authentication session transmits a freshly randomized credential that cannot be reused later

   Replay attacks involve capturing and reusing valid authentication tokens. Salting password hashes at storage time does not address session-based replay — nonces and timestamps mitigate replay attacks.
3. Rainbow table attack; salting makes precomputed hash tables ineffective because each unique salt produces a different hash for the same password ✓

   Rainbow tables are precomputed tables mapping hash values back to plaintext passwords. Since the tables are precomputed for unsalted hashes, adding a unique random salt (stored with the hash) forces the attacker to recompute the entire table for every unique salt — computationally infeasible at scale.
4. Dictionary attack; salting swaps the common dictionary words in a user's password out for unpredictable random characters before the value is hashed and stored

   Salting does not modify the user's password — it appends a random value before hashing. A dictionary attack can still succeed if the user's password is weak, though salting does prevent precomputed dictionary attack tables.

Salting defeats rainbow table attacks by making precomputed hash tables useless — each unique salt means the same password produces a different hash.

10. Meet-in-the-middle attack: Which attack explains this weakness, and why does Triple DES (3DES) provide better

1. Brute force attack; 3DES is stronger because chaining three independent 56-bit keys yields a 168-bit keyspace that is simply far too large for any exhaustive search to traverse in practice

   3DES with three 56-bit keys provides 168 bits total but approximately 112-bit effective security due to the same meet-in-the-middle principle. Brute force alone does not explain why 2DES's 112-bit key space collapses to 57-bit effective security.
2. Birthday attack; 3DES resists it by encrypting data in larger cipher blocks that reduce the collision probability the birthday bound relies on to recover key material

   Birthday attacks exploit hash collision probability. 2DES's weakness is specifically the meet-in-the-middle attack — the birthday attack is not the relevant vulnerability here. Both 2DES and 3DES use 64-bit DES block size, so no block-size difference exists.
3. Side-channel attack; 3DES is harder to attack because its dedicated hardware implementations are shielded to leak far less measurable timing and power information

   Side-channel attacks exploit physical implementation characteristics (timing, power consumption). The 2DES weakness described is a mathematical cryptanalytic attack on the cipher's structure, not a physical implementation flaw.
4. Meet-in-the-middle attack; 3DES resists it because the middle operation uses decryption (EDE mode), which disrupts the attack's ability to precompute matching intermediate values ✓

   Meet-in-the-middle: encrypt with all 2^56 K1 values forward, decrypt with all 2^56 K2 values backward, find matching intermediate ciphertext. Total work: 2×2^56 ≈ 2^57, not 2^112. 3DES EDE mode (Encrypt-Decrypt-Encrypt) with three keys provides approximately 112-bit effective security against meet-in-the-middle.

Meet-in-the-middle reduces 2DES's effective security to ~57 bits by attacking each DES stage independently; 3DES EDE mode provides ~112-bit effective resistance.

11. Side-channel attack: This is an example of which attack type?

1. Side-channel attack (power analysis); the private key is recovered by measuring physical power consumption during RSA operations rather than by breaking the algorithm ✓

   Side-channel attacks exploit physical implementation characteristics rather than mathematical weaknesses in the algorithm. Power analysis (Simple Power Analysis/Differential Power Analysis) measures power consumption during cryptographic operations to infer key bits from observable patterns in energy use.
2. Replay attack; previously captured authentication data from a valid RSA session is retransmitted to the reader to impersonate the legitimate user without possessing the key

   A replay attack captures and retransmits valid authentication data. The described scenario involves physical measurement of hardware during operation to extract cryptographic keys, not retransmission of captured session data.
3. Known plaintext attack; matched plaintext and ciphertext pairs are used to mathematically derive the private RSA key from the smartcard's observed outputs

   A known plaintext attack uses pairs of known plaintext and corresponding ciphertext to derive the key mathematically. The scenario involves physical measurement (power consumption), not analysis of plaintext-ciphertext pairs.
4. Chosen ciphertext attack; attacker-selected ciphertexts are decrypted by the card and the results analyzed to mathematically infer the private key bits

   A chosen ciphertext attack allows the attacker to choose ciphertexts and observe the resulting decrypted plaintexts to infer key information. This is a mathematical attack requiring oracle access, not physical power measurement.

Side-channel attacks exploit physical characteristics of implementations (power, timing, electromagnetic emissions) rather than mathematical weaknesses in the algorithm itself.

12. Address Space Layout Randomization: Which combination of mitigations is most effective against modern buffer o

1. Input length validation on every buffer write, applied as the sole defense so that oversized input is truncated before it can overflow the allocated stack buffer

   Input validation is important but insufficient alone. Off-by-one errors, integer overflows, or validation bypasses can still lead to buffer overflows. Defense in depth requires both input validation AND memory protection mechanisms.
2. Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP/NX), and stack canaries applied together to defeat classic stack-smashing exploitation ✓

   ASLR randomizes memory layout, making return addresses unpredictable. DEP/NX marks the stack as non-executable, preventing shellcode execution. Stack canaries detect stack smashing before control flow is hijacked. Together they defeat most classic buffer overflow exploitation methods.
3. Perimeter firewall rules paired with network intrusion detection systems tuned to spot and drop the exploit payloads before they ever reach the vulnerable process

   Firewalls and IDS operate at the network layer and cannot prevent in-process memory corruption. Buffer overflows execute within the process's own address space — network controls do not address this attack surface.
4. Encryption of the entire stack memory region so that any injected shellcode is rendered unintelligible to the processor unless it is first decrypted at runtime

   Encrypting stack memory is not a standard or practical mitigation — the processor must execute instructions in the stack's address space, which requires the data to be decryptable at runtime. DEP/NX (marking memory non-executable) is the correct approach.

ASLR randomizes memory layout, DEP/NX prevents executing code on the stack/heap, and stack canaries detect smashing — together they defeat most buffer overflow exploitation.

Other CISSP domains

• Security and Risk Management — 89 questions →
• Communication and Network Security — 63 questions →
• Identity and Access Management (IAM) — 63 questions →
• Software Development Security — 59 questions →
• Security Operations — 48 questions →
• All 497 CISSP questions →