Deck 17: Protection

Question 1

The owner right allows ___________

A) addition of new rights only
B) addition of new rights and removal of some rights
C) removal of some rights only
D) none of the above

Answer 1

B

Question 2

What is the difference between mechanisms and policies?

A) Mechanisms determine what will be done, while policies decide when it will be done
B) Mechanisms determine how something will be done, while policies decide what will be done
C) Mechanisms determine how something will be done, while policies decide why something will be done
D) Mechanisms determine what will be done, while policies decide how it will be done

Answer 2

B

Question 3

How does a lock-key mechanism work?

Answer 3

Each object has a list of unique bit patterns called locks. Similarly, each domain has a list of unique bit patterns called keys. A process executing in a domain can access an object only if that domain has a key that matches one of the locks of the object.

Question 4

The ability to copy an access right from one domain to another may be realized as follows
A) A right R is copied from domain A to domain B and R is removed from domain

A) The right R could be copied from domain B to another domain.
B) A right R is copied from domain A to domain B, but the right R could not be copied from domain A to another domain.
C) A right R is copied from domain A to domain B, but the right R could not be copied from domain B to another domain.
D) none of the above

Question 5

What capability is not used by Linux?

A) permitted
B) mapped
C) effective
D) inherited

Question 6

Which of the following is an advantage of compiler-based enforcement of access control?

A) Protection schemes are programmed as opposed to simply declared.
B) Protection requirements are dependent of the facilities provided by a particular operating system.
C) The means for enforcement needs to be provided by the designer of the subsystem.
D) Access privileges are closely related to the linguistic concept of a data type.

Question 7

Describe the idea of SIP (System Integrity Protection).

Question 8

A capability list for a domain is ____________________

A) a list of operations together with the list of processes allowed to run the operations on those objects.
B) a list of objects together with the list of processes allowed to access those objects.
C) a list of objects together with the operations allowed on those objects.
D) a list of triplet .

Question 9

Explain a confinement problem.

Question 10

Describe the idea of the sandboxing.

Question 11

Which of the following is true of the Java programming language in relation to protection?

A) When a class is loaded, the JVM assigns the class to a protection domain that gives the permissions of that class.
B) It does not support the dynamic loading of untrusted classes over a network.
C) It does not support the execution of mutually distrusting classes within the same JVM.
D) Methods in the calling sequence are not responsible for requests to access a protected resource.

Question 12

Describe domain switching.

Question 13

UNIX operating system associates a protection domain with the ____.

A) task
B) tread
C) process
D) user

Question 14

A protection domain is a collection of access rights, each of which is ___________________

A) a pair
B) a pair
C) a triplet
D) a triplet

Question 15

Object means __________

A) hardware object or software object
B) process or threat
C) software object only
D) process only

Question 16

What does compartmentalization mean?

Question 17

What are the main reasons for implementing a protection subsystem?

Question 18

________________ is not a protection mechanism.

A) System Integrity Protection
B) Intrusion Prevention
C) System-Call Filtering
D) Sandboxing

Question 19

What are the main drawbacks of the implementation of the access matrix as a global table?

Question 20

Explain the need-to-known principle.

Question 21

Rings of protection separate functions into domains and order them hierarchically.

Question 22

Android cannot provide the same level of protection as UNIX, because it is not able to separate users.

Question 23

The default set of access rights are used if no entry in the access list is found.

Question 24

Apple's systems employs capability-based protection in the form of entitlements.

Question 25

Domains cannot share access rights

Question 26

How does Linux use system-call filtering?

Question 27

root user can modify mandatory access control (MAC)

Question 28

The kernel should not run with a higher level of privileges than user processes.

Question 29

In a dynamic protection system, sometimes access rights to objects shared by different users need to be revoked.

Question 30

Role-based access control (RBAC) increases the security risk associated with superusers.

Question 31

What protection mechanism is used to ensure that operating-system distributions and patches have not be changed?

Question 32

Describe how the access matrix is implemented in MULTISC.