Mandatory access control

With mandatory access control (MAC), the authorization of a subject's
access to an object is dependant upon labels, which indicate the subject's clearance, and
the classification or sensitivity of the object. Label-based access control is not defined.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control
systems (page 33).

A workstation or system that generates a random challenge string that the user enters
into the token when prompted along with the proper PIN.

.

Challenge-response tokens are:
- A workstation or system generates a random challenge string and the owner enters the
string into the token along with the proper PIN.
- The token generates a response that is then entered into the workstation or system.
- The authentication mechanism in the workstation or system then determines if the owner
should be authenticated.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 37.
Also: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne,
2002, chapter 4: Access Control (pages 136-137).

Accuracy

Accuracy is the most critical characteristic of a biometric identifying
verification system.
Accuracy is measured in terms of false rejection rate (FRR, or type I errors) and false
acceptance rate (FAR or type II errors).
The Crossover Error Rate (CER) is the point at which the FRR equals the FAR and has
become the most important measure of biometric system accuracy.
Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management
Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 1, Biometric Identification
(page 9).

Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or
steal printed or electronic information?

Physical security and environmental security are part of operational controls,
and are measures taken to protect systems, buildings, and related supporting
infrastructures against threats associated with their physical environment. All the questions
above are useful in assessing physical and environmental protection except for the one
regarding processes that ensuring that unauthorized individuals cannot access information,
which is more a production control.
Source: SWANSON, Marianne, NIST Special Publication 800-26, Security Self-
Assessment Guide for Information Technology Systems, November 2001 (Pages A-21 to
A-24).

User can be authenticated by what he knows.

As this is not a characteristic of Biometrics this is the rigth choice for this
question. This is one of the three basic way authentication can be performed and it is not
related to Biometrics. Example of something you know would be a password or PIN for example.
Please make a note of the negative 'FALSE' within the question. This question may seem
tricky to some of you but you would be amazed at how many people cannot deal with
negative questions. There will be a few negative questions within the real exam, just like
this one the keyword NOT or FALSE will be in Uppercase to clearly indicate that it is
negative.
Biometrics verifies an individual’s identity by analyzing a unique personal attribute or
behavior, which is one of the most effective and accurate methods of performing
authentication (one to one matching) or identification (a one to many matching).
A biometric system scans an attribute or behavior of a person and compares it to a
template store within an authentication server datbase, such template would be created in
an earlier enrollment process. Because this system inspects the grooves of a person’s
fingerprint, the pattern of someone’s retina, or the pitches of someone’s voice, it has to be
extremely sensitive.
The system must perform accurate and repeatable measurements of anatomical or
physiological characteristics. This type of sensitivity can easily cause false positives or
false negatives. The system must be calibrated so that these false positives and false
negatives occur infrequently and the results are as accurate as possible.
There aretwo types of failures in biometric identification:
False Rejection also called False Rejection Rate (FRR) — The system fail to recognize a
legitimate user. While it could be argued that this has the effect of keeping the protected
area extra secure, it is an intolerable frustration to legitimate users who are refused access
because the scanner does not recognize them.
False Acceptance or False Acceptance Rate (FAR) — This is an erroneous recognition,
either by confusing one user with another or by accepting an imposter as a legitimate user.
Physiological Examples:
Unique Physical Attributes:
Fingerprint (Most commonly accepted)
Hand Geometry
Retina Scan (Most accurate but most intrusive)Iris Scan
Vascular Scan
Behavioral Examples:
Repeated Actions
Keystroke Dynamics
(Dwell time (the time a key is pressed) and Flight time (the time between "key up" and the
next "key down").
Signature Dynamics
(Stroke and pressure points)
EXAM TIP:
Retina scan devices are the most accurate but also the most invasive biometrics system
available today. The continuity of the retinal pattern throughout life and the difficulty in
fooling such a device also make it a great long-term, high-security option. Unfortunately,
the cost of the proprietary hardware as well the stigma of users thinking it is potentially
harmful to the eye makes retinal scanning a bad fit for most situations.
Remember for the exam that fingerprints are the most commonly accepted type of
biometrics system.
The other answers are incorrect:
'Users can be authenticated based on behavior.' is incorrect as this choice is TRUE as it
pertains to BIOMETRICS.
Biometrics systems makes use of unique physical characteristics or behavior of users.
'User can be authenticated based on unique physical attributes.' is also incorrect as this
choice is also TRUE as it pertains to BIOMETRICS. Biometrics systems makes use of
unique physical characteristics or behavior of users.
'A biometric system's accuracy is determined by its crossover error rate (CER)' is also
incorrect as this is TRUE as it also pertains to BIOMETRICS. The CER is the point at which
the false rejection rates and the false acceptance rates are equal. The smaller the value of
the CER, the more accurate the system.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third  Edition ((ISC)2 Press) (Kindle Locations 25353-25356). Auerbach Publications. Kindle
Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 25297-25303). Auerbach Publications. Kindle
Edition.

Preventive

Password management is an example of preventive control.
Proper passwords prevent unauthorized users from accessing a system.
There are literally hundreds of different access approaches, control methods, and
technologies, both in the physical world and in the virtual electronic world. Each method
addresses a different type of access control or a specific access need.
For example, access control solutions may incorporate identification and authentication
mechanisms, filters, rules, rights, logging and monitoring, policy, and a plethora of other
controls. However, despite the diversity of access control methods, all access control
systems can be categorized into seven primary categories.
The seven main categories of access control are:
1. Directive: Controls designed to specify acceptable rules of behavior within an
organization
2. Deterrent: Controls designed to discourage people from violating security directives                               3. Preventive: Controls implemented to prevent a security incident or information breach                      4. Compensating: Controls implemented to substitute for the loss of primary controls and
mitigate risk down to an acceptable level
5. Detective: Controls designed to signal a warning when a security control has been
breached
6. Corrective: Controls implemented to remedy circumstance, mitigate damage, or restore
controls
7. Recovery: Controls implemented to restore conditions to normal after a security incident
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 1156-1176). Auerbach Publications. Kindle 4. Compensating: Controls implemented to substitute for the loss of primary controls and
mitigate risk down to an acceptable level
5. Detective: Controls designed to signal a warning when a security control has been
breached
6. Corrective: Controls implemented to remedy circumstance, mitigate damage, or restore
controls
7. Recovery: Controls implemented to restore conditions to normal after a security incident
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 1156-1176). Auerbach Publications. Kindle 4. Compensating: Controls implemented to substitute for the loss of primary controls and
mitigate risk down to an acceptable level
5. Detective: Controls designed to signal a warning when a security control has been
breached
6. Corrective: Controls implemented to remedy circumstance, mitigate damage, or restore
controls
7. Recovery: Controls implemented to restore conditions to normal after a security incident
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 1156-1176). Auerbach Publications. Kindle Edition.

Capacitance detectors

Capacitance detectors monitor an electrical field surrounding the object
being monitored. They are used for spot protection within a few inches of the object, rather
than for overall room security monitoring used by wave detectors. Penetration of this field
changes the electrical capacitance of the field enough to generate and alarm. Wave pattern
motion detectors generate a frequency wave pattern and send an alarm if the pattern is
disturbed as it is reflected back to its receiver. Field-powered devices are a type of
personnel access control devices. Audio detectors simply monitor a room for any abnormal
sound wave generation and trigger an alarm.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 10: Physical
security (page 344).

Public Key

There is no such component within kerberos environment. Kerberos uses
only symmetric encryption and does not make use of any public key component.
The other answers are incorrect because :
Symmetric key cryptography is a part of Kerberos as the KDC holds all the users' and
services' secret keys.
Authentication service (AS) : KDC (Key Distribution Center) provides an authentication
service
Principals : Key Distribution Center provides services to principals , which can be users ,
applications or network services.
References: Shon Harris , AIO v3 , Chapter - 4: Access Control , Pages : 152-155.

The item's classification and category set

A Sensitivity label must contain at least one classification and one category
set.
Category set and Compartment set are synonyms, they mean the same thing. The
sensitivity label must contain at least one Classification and at least one Category. It is
common in some environments for a single item to belong to multiple categories. The list of
all the categories to which an item belongs is called a compartment set or category set.
The following answers are incorrect:
the item's classification. Is incorrect because you need a category set as well.
the item's category. Is incorrect because category set and classification would be both be
required.
The item's need to know. Is incorrect because there is no such thing. The need to know is
indicated by the catergories the object belongs to. This is NOT the best answer.
Reference(s) used for this question:
OIG CBK, Access Control (pages 186 - 188)
AIO, 3rd Edition, Access Control (pages 162 - 163)
AIO, 4th Edittion, Access Control, pp 212-214.
Wikipedia - http://en.wikipedia.org/wiki/Mandatory_Access_Control

 C1

C1 involves discretionary protection, C2 involves controlled access protection, B1 involves labeled security protection and B2 involves structured protection.
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.