SSCP Practice Test

 the access controls are based on the individual's role or title within the organization.

In an organization where there are frequent personnel changes, nondiscretionary
access control (also called Role Based Access Control) is useful because the
access controls are based on the individual's role or title within the organization. You can
easily configure a new employee acces by assigning the user to a role that has been
predefine. The user will implicitly inherit the permissions of the role by being a member of
that role.
These access permissions defined within the role do not need to be changed whenever a
new person takes over the role.
Another type of non-discretionary access control model is the Rule Based Access Control
(RBAC or RuBAC) where a global set of rule is uniformly applied to all subjects accessing
the resources. A good example of RuBAC would be a firewall.
This question is a sneaky one, one of the choice has only one added word to it which is
often. Reading questions and their choices very carefully is a must for the real exam.
Reading it twice if needed is recommended shon
Shon Harris in her book list the following ways of managing RBAC:
Role-based access control can be managed in the following ways:
Non-RBAC Users are mapped directly to applications and no roles are used. (No roles
being used)
Limited RBAC Users are mapped to multiple roles and mapped directly to other types of

applications that do not have role-based access functionality. (A mix of roles for
applications that supports roles and explicit access control would be used for applications
that do not support roles)
Hybrid RBAC Users are mapped to multiapplication roles with only selected rights assigned
to those roles.
Full RBAC Users are mapped to enterprise roles. (Roles are used for all access being
granted)
NIST defines RBAC as:
Security administration can be costly and prone to error because administrators usually
specify access control lists for each user on the system individually. With RBAC, security is managed at a level that corresponds closely to the organization's structure. Each user is
assigned one or more roles, and each role is assigned one or more privileges that are
permitted to users in that role. Security administration with RBAC consists of determining
the operations that must be executed by persons in particular jobs, and assigning
employees to the proper roles. Complexities introduced by mutually exclusive roles or role
hierarchies are handled by the RBAC software, making security administration easier.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 32.
and
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition McGraw-Hill.
and
http://csrc.nist.gov/groups/SNS/rbac/

It allows "write up."

Bell–LaPadula Confidentiality Model10 The Bell–LaPadula model is perhaps
the most well-known and significant security model, in addition to being one of the oldest
models used in the creation of modern secure computing systems. Like the Trusted
Computer System Evaluation Criteria (or TCSEC), it was inspired by early U.S. Department
of Defense security policies and the need to prove that confidentiality could be maintained.
In other words, its primary goal is to prevent disclosure as the model system moves from
one state (one point in time) to another.
When the strong star property is not being used it means that both the property and the
Simple Security Property rules would be applied.
The Star (*) property rule of the Bell-LaPadula model says that subjects cannot write down,
this would compromise the confidentiality of the information if someone at the secret layer
would write the object down to a confidential container for example.
The Simple Security Property rule states that the subject cannot read up which means that
a subject at the secret layer would not be able to access objects at Top Secret for example You must remember: The model tells you about are NOT allowed to do. Anything else
would be allowed. For example within the Bell LaPadula model you would be allowed to
write up as it does not compromise the security of the information. In fact it would upgrade
it to the point that you could lock yourself out of your own information if you have only a
secret security clearance.
The following are incorrect answers because they are all FALSE:
"It allows read up" is incorrect. The "simple security" property forbids read up.
"It addresses covert channels" is incorrect. Covert channels are not addressed by the Bell- LaPadula model.
"It addresses management of access controls" is incorrect. Management of access controls
are beyond the scope of the Bell-LaPadula model.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 17595-17600). Auerbach Publications. Kindle
Edition.

Because they may contain credentials.

Because scripts contain credentials, they must be stored in a protected area
and the transmission of the scripts must be dealt with carefully. Operators might need
access to batch files and scripts. The least privilege concept requires that each subject in a
system be granted the most restrictive set of privileges needed for the performance of
authorized tasks. The need-to-know principle requires a user having necessity for access
to, knowledge of, or possession of specific information required to perform official tasks or
services.
Source: WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#1 Access Control
System & Methodology (page 3)

Biometrics

The Answer: Biometrics; Biometrics are defined as an automated means of
identifying or authenticating the identity of a living person based on physiological or
behavioral characteristics.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Pages 37,38.

False Rejection Rate (FRR) or Type I Error

The percentage of valid subjects that are falsely rejected is called the False
Rejection Rate (FRR) or Type I Error.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 38