2 cissp ® Official Study Guide Eighth Edition

1.
Which of the following would 
not
be an asset that an organization would want to protect 
with access controls?
A.
Information
B.
Systems
C.
Devices
D.
Facilities
E.
None of the above
2.
Which of the following is true related to a subject?
A.
A subject is always a user account.
B.
The subject is always the entity that provides or hosts the information or data.
C.
The subject is always the entity that receives information about or data from an 
object.
D.
A single entity can never change roles between subject and object.
3.
Which of the following types of access control uses fences, security policies, security aware-
ness training, and antivirus software to stop an unwanted or unauthorized activity from 
occurring?
A.
Preventive
B.
Detective
C.
Corrective
D.
Authoritative
4.
What type of access controls are hardware or software mechanisms used to manage 
access to resources and systems, and provide protection for those resources and
systems?
A.
Administrative
B.
Logical/technical
C.
Physical
D.
Preventive
5.
Which of the following 
best
expresses the primary goal when controlling access to 
assets?
A.
Preserve confidentiality, integrity, and availability of systems and data.
B.
Ensure that only valid objects can authenticate on a system.
C.
Prevent unauthorized access to subjects.
D.
Ensure that all subjects are authenticated.

---

Review Questions