CAS-001 · Question #421
An administrator is trying to categorize the security impact of a database server in the case of a security event. There are three databases on the server. - Current Financial Data = High level of…
The correct answer is B. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)}. Per FIPS 199, the aggregate security category for a system is determined by taking the highest impact level for each security objective across all information types it processes.
Question
An administrator is trying to categorize the security impact of a database server in the case of a security event. There are three databases on the server.
- Current Financial Data = High level of damage if data is disclosed.
Moderate damage if the system goes offline
- Archived Financial Data = No need for the database to be online. Low
damage for integrity loss
- Public Website Data = Low damage if the site goes down. Moderate
damage if the data is corrupted Given these security categorizations of each database, which of the following is the aggregate security categorization of the database server?
Options
- ADatabase server = {(Confidentiality HIGH),(Integrity High),(Availability High)}
- BDatabase server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)}
- CDatabase server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Low)}
- DDatabase server = {(Confidentiality Moderate),(Integrity Moderate),(Availability Moderate)}
How the community answered
(37 responses)- A3% (1)
- B70% (26)
- C8% (3)
- D19% (7)
Why each option
Per FIPS 199, the aggregate security category for a system is determined by taking the highest impact level for each security objective across all information types it processes.
Availability HIGH is not supported by any of the three databases; the highest availability impact listed is Moderate for Current Financial data.
Applying the high-water mark principle from FIPS 199: Confidentiality reaches HIGH from the Current Financial data. Integrity reaches MODERATE from the Public Website data (moderate damage if corrupted), which is higher than Low for Archived data. Availability reaches MODERATE from the Current Financial data (moderate damage if offline), which is higher than the Low ratings for the other two databases. This yields C=HIGH, I=MODERATE, A=MODERATE.
Availability LOW is incorrect because Current Financial data carries a Moderate availability impact, which must propagate to the aggregate rating.
Confidentiality MODERATE is incorrect because Current Financial data has a HIGH confidentiality impact, which sets the aggregate confidentiality level to HIGH.
Concept tested: FIPS 199 aggregate security categorization high-water mark
Source: https://csrc.nist.gov/publications/detail/fips/199/final
Topics
Community Discussion
No community discussion yet for this question.