Good day,<br><br>I totally agree with what you were told at the review seminar as far as the real exam is concerned. On the real exam you ALWAYS answer ALL of the questions. Even if you have to completely guess. You are not penalize for the wrong answer.<br>
<br>In this case you try to identify the best of the bad answers but do not spent too much time on coming up with answer to bad questions. Just ensure you DO KNOW what is the best answer and you will be fine for the exam. If you run into a strange question on the exam there are a form you can fill out to report the question that you disagree.<br>
<br>Do take care<br><br>Clement<br><br><br><div class="gmail_quote">On Mon, Sep 7, 2009 at 14:53, <span dir="ltr"><<a href="mailto:An.Dang@do.treas.gov">An.Dang@do.treas.gov</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Clement,<br>
<br>
Thank you for the information. If we run into "bad" questions like this ... Which I don't doubt... should we leave the answer blank or go with the "best" answer and darken in the best guestimate.<br>
<br>
I was told to circle in something is better than leaving it blank at the Review Seminar.<br>
<br>
Thanks.<br>
<div class="im"><br>
<br>
----- Original Message -----<br>
From: <a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a> <<a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a>><br>
To: <a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a> <<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a>><br>
</div><div class="im">Sent: Mon Sep 07 09:49:53 2009<br>
Subject: cisspstudy Digest, Vol 15, Issue 11<br>
<br>
Send cisspstudy mailing list submissions to<br>
<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
</div><div class="im"> <a href="http://cccure.org/mailman/listinfo/cisspstudy_cccure.org" target="_blank">http://cccure.org/mailman/listinfo/cisspstudy_cccure.org</a><br>
</div><div class="im">or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:cisspstudy-request@cccure.org">cisspstudy-request@cccure.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:cisspstudy-owner@cccure.org">cisspstudy-owner@cccure.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of cisspstudy digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
</div> 1. Re: Bell-Lapadula? (Clement Dupuis)<br>
2. Re: Bell-Lapadula? (gerritsjs)<br>
3. Re: Bell-Lapadula? (gerritsjs)<br>
4. Re: Bell-Lapadula? (Clement Dupuis)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Mon, 7 Sep 2009 06:25:39 -0400<br>
<div class="im">From: Clement Dupuis <<a href="mailto:clement.dupuis@cccure.com">clement.dupuis@cccure.com</a>><br>
</div>To: The CISSP Study Mailing list <<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a>><br>
<div class="im">Subject: Re: [Cisspstudy] Bell-Lapadula?<br>
</div>Message-ID:<br>
<<a href="mailto:959788640909070325h1ef07924n33a15ea186a67fe@mail.gmail.com">959788640909070325h1ef07924n33a15ea186a67fe@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<div class="im"><br>
With info this time:<br>
<br>
A system state is defined to be "secure" if the only permitted access modes<br>
of subjects to objects are in accordance with a security<br>
</div>policy<<a href="http://en.wikipedia.org/wiki/Security_policy" target="_blank">http://en.wikipedia.org/wiki/Security_policy</a>>.<br>
<div class="im">To determine whether a specific access mode is allowed, the clearance of a<br>
subject is compared to the classification of the object (more precisely, to<br>
the combination of classification and set of compartments, making up<br>
the *security<br>
level*) to determine if the subject is authorized for the specific access<br>
mode. The clearance/classification scheme is expressed in terms of a<br>
lattice. The model defines two mandatory access<br>
</div>control<<a href="http://en.wikipedia.org/wiki/Mandatory_access_control" target="_blank">http://en.wikipedia.org/wiki/Mandatory_access_control</a>>(MAC)<br>
rules and one discretionary<br>
access control <<a href="http://en.wikipedia.org/wiki/Discretionary_access_control" target="_blank">http://en.wikipedia.org/wiki/Discretionary_access_control</a>>(DAC)<br>
<div class="im">rule with three security properties:<br>
<br>
<br>
Take care<br>
<br>
Clement<br>
</div><div class="im">-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
</div>URL: <<a href="http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/32503f89/attachment-0001.html" target="_blank">http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/32503f89/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Mon, 7 Sep 2009 06:44:42 -0700<br>
From: "gerritsjs" <<a href="mailto:gerritsjs@gmail.com">gerritsjs@gmail.com</a>><br>
To: "'The CISSP Study Mailing list'" <<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a>><br>
<div class="im">Subject: Re: [Cisspstudy] Bell-Lapadula?<br>
</div>Message-ID: <<a href="mailto:4aa50e4e.1d1d640a.422b.ffff9d6f@mx.google.com">4aa50e4e.1d1d640a.422b.ffff9d6f@mx.google.com</a>><br>
Content-Type: text/plain; charset="us-ascii"<br>
<div class="im"><br>
So what is the best answer, or there are many?<br>
<br>
<br>
<br>
_____<br>
<br>
From: <a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a> [mailto:<a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a>]<br>
On Behalf Of Clement Dupuis<br>
Sent: Monday, September 07, 2009 3:26 AM<br>
To: The CISSP Study Mailing list<br>
Subject: Re: [Cisspstudy] Bell-Lapadula?<br>
<br>
<br>
<br>
With info this time:<br>
<br>
A system state is defined to be "secure" if the only permitted access modes<br>
of subjects to objects are in accordance with a security<br>
</div><<a href="http://en.wikipedia.org/wiki/Security_policy" target="_blank">http://en.wikipedia.org/wiki/Security_policy</a>> policy. To determine whether<br>
<div class="im">a specific access mode is allowed, the clearance of a subject is compared to<br>
the classification of the object (more precisely, to the combination of<br>
classification and set of compartments, making up the security level) to<br>
determine if the subject is authorized for the specific access mode. The<br>
clearance/classification scheme is expressed in terms of a lattice. The<br>
model defines two mandatory access control<br>
</div><<a href="http://en.wikipedia.org/wiki/Mandatory_access_control" target="_blank">http://en.wikipedia.org/wiki/Mandatory_access_control</a>> (MAC) rules and one<br>
discretionary access control<br>
<<a href="http://en.wikipedia.org/wiki/Discretionary_access_control" target="_blank">http://en.wikipedia.org/wiki/Discretionary_access_control</a>> (DAC) rule with<br>
<div class="im">three security properties:<br>
<br>
<br>
Take care<br>
<br>
Clement<br>
<br>
<br>
<br>
<br>
</div><div class="im">-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
</div>URL: <<a href="http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/792a3d08/attachment-0001.html" target="_blank">http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/792a3d08/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Mon, 7 Sep 2009 06:46:37 -0700<br>
From: "gerritsjs" <<a href="mailto:gerritsjs@gmail.com">gerritsjs@gmail.com</a>><br>
To: "'The CISSP Study Mailing list'" <<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a>><br>
<div class="im">Subject: Re: [Cisspstudy] Bell-Lapadula?<br>
</div>Message-ID: <<a href="mailto:4aa50ec1.0e36640a.094f.ffff845a@mx.google.com">4aa50ec1.0e36640a.094f.ffff845a@mx.google.com</a>><br>
Content-Type: text/plain; charset="us-ascii"<br>
<div class="im"><br>
What do you then define a system to be in a 'secure' state?<br>
<br>
<br>
<br>
_____<br>
<br>
</div><div class="im">From: <a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a> [mailto:<a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a>]<br>
On Behalf Of Clement Dupuis<br>
Sent: Monday, September 07, 2009 3:26 AM<br>
To: The CISSP Study Mailing list<br>
Subject: Re: [Cisspstudy] Bell-Lapadula?<br>
<br>
<br>
<br>
With info this time:<br>
<br>
A system state is defined to be "secure" if the only permitted access modes<br>
of subjects to objects are in accordance with a security<br>
</div><<a href="http://en.wikipedia.org/wiki/Security_policy" target="_blank">http://en.wikipedia.org/wiki/Security_policy</a>> policy. To determine whether<br>
<div class="im">a specific access mode is allowed, the clearance of a subject is compared to<br>
the classification of the object (more precisely, to the combination of<br>
classification and set of compartments, making up the security level) to<br>
determine if the subject is authorized for the specific access mode. The<br>
clearance/classification scheme is expressed in terms of a lattice. The<br>
model defines two mandatory access control<br>
</div><<a href="http://en.wikipedia.org/wiki/Mandatory_access_control" target="_blank">http://en.wikipedia.org/wiki/Mandatory_access_control</a>> (MAC) rules and one<br>
discretionary access control<br>
<<a href="http://en.wikipedia.org/wiki/Discretionary_access_control" target="_blank">http://en.wikipedia.org/wiki/Discretionary_access_control</a>> (DAC) rule with<br>
<div class="im">three security properties:<br>
<br>
<br>
Take care<br>
<br>
Clement<br>
<br>
<br>
<br>
<br>
</div><div class="im">-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
</div>URL: <<a href="http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/7f0cb639/attachment-0001.html" target="_blank">http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/7f0cb639/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Mon, 7 Sep 2009 09:49:48 -0400<br>
<div class="im">From: Clement Dupuis <<a href="mailto:clement.dupuis@cccure.com">clement.dupuis@cccure.com</a>><br>
</div>To: The CISSP Study Mailing list <<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a>><br>
<div class="im">Subject: Re: [Cisspstudy] Bell-Lapadula?<br>
</div>Message-ID:<br>
<<a href="mailto:959788640909070649o6a5de8b5m86cf0abe8fccd047@mail.gmail.com">959788640909070649o6a5de8b5m86cf0abe8fccd047@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<div class="im"><br>
There is NO best answer.<br>
<br>
It is a bad questions<br>
<br>
Take care<br>
<br>
Clement<br>
<br>
</div>Cl?ment Dupuis, CD<br>
<div><div></div><div class="h5">CISSP, GCFW, GCIA, Security+, CEH, ECSA, LPT, CCSA, CCSE, MBNS, MBIS, MBHS,<br>
ACE<br>
----------------------------------------------------------------------------------------------<br>
In real life:<br>
Senior Security Specialist and Instructor<br>
Security University<br>
>> Call me to get the best CISSP training <<<br>
----------------------------------------------------------------------------------------------<br>
In Cyberspace:<br>
President/Security Evangelist/Chief Learning Officer (CLO)<br>
The CCCure Family of Portals<br>
----------------------------------------------------------------------------------------------<br>
Business: 407 479 3903<br>
Fax: 407 264 8396<br>
<br>
Maintainer of :<br>
The CISSP and SSCP Open Study Guides Web Site<br>
<a href="http://www.cccure.org" target="_blank">http://www.cccure.org</a><br>
<br>
The Professional Security Testers Warehouse<br>
<a href="http://www.professionalsecuritytesters.org" target="_blank">http://www.professionalsecuritytesters.org</a><br>
<br>
Knowledge sharing and giving back to the community<br>
<br>
<br>
On Mon, Sep 7, 2009 at 09:44, gerritsjs <<a href="mailto:gerritsjs@gmail.com">gerritsjs@gmail.com</a>> wrote:<br>
<br>
> So what is the best answer, or there are many?<br>
><br>
><br>
> ------------------------------<br>
><br>
> *From:* <a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a> [mailto:<br>
> <a href="mailto:cisspstudy-bounces@cccure.org">cisspstudy-bounces@cccure.org</a>] *On Behalf Of *Clement Dupuis<br>
> *Sent:* Monday, September 07, 2009 3:26 AM<br>
> *To:* The CISSP Study Mailing list<br>
> *Subject:* Re: [Cisspstudy] Bell-Lapadula?<br>
><br>
><br>
><br>
> With info this time:<br>
><br>
><br>
> A system state is defined to be "secure" if the only permitted access modes<br>
</div></div>> of subjects to objects are in accordance with a security policy<<a href="http://en.wikipedia.org/wiki/Security_policy" target="_blank">http://en.wikipedia.org/wiki/Security_policy</a>>.<br>
<div class="im">> To determine whether a specific access mode is allowed, the clearance of a<br>
> subject is compared to the classification of the object (more precisely, to<br>
> the combination of classification and set of compartments, making up the *security<br>
> level*) to determine if the subject is authorized for the specific access<br>
> mode. The clearance/classification scheme is expressed in terms of a<br>
</div>> lattice. The model defines two mandatory access control<<a href="http://en.wikipedia.org/wiki/Mandatory_access_control" target="_blank">http://en.wikipedia.org/wiki/Mandatory_access_control</a>>(MAC) rules and one discretionary<br>
> access control <<a href="http://en.wikipedia.org/wiki/Discretionary_access_control" target="_blank">http://en.wikipedia.org/wiki/Discretionary_access_control</a>>(DAC) rule with three security properties:<br>
<div class="im">><br>
><br>
> Take care<br>
><br>
> Clement<br>
><br>
><br>
><br>
> _______________________________________________<br>
> cisspstudy mailing list<br>
> <a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a><br>
> <a href="http://cccure.org/mailman/listinfo/cisspstudy_cccure.org" target="_blank">http://cccure.org/mailman/listinfo/cisspstudy_cccure.org</a><br>
><br>
><br>
</div><div class="im">-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
</div>URL: <<a href="http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/b6888594/attachment.html" target="_blank">http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20090907/b6888594/attachment.html</a>><br>
<br>
------------------------------<br>
<div class="im"><br>
_______________________________________________<br>
cisspstudy mailing list<br>
<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a><br>
<a href="http://cccure.org/mailman/listinfo/cisspstudy_cccure.org" target="_blank">http://cccure.org/mailman/listinfo/cisspstudy_cccure.org</a><br>
<br>
<br>
</div>End of cisspstudy Digest, Vol 15, Issue 11<br>
******************************************<br>
<div><div></div><div class="h5">_______________________________________________<br>
cisspstudy mailing list<br>
<a href="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</a><br>
<a href="http://cccure.org/mailman/listinfo/cisspstudy_cccure.org" target="_blank">http://cccure.org/mailman/listinfo/cisspstudy_cccure.org</a><br>
</div></div></blockquote></div><br>