CISSP-ISSEP · Question #191
Which of the following rated systems of the Orange book has mandatory protection of the TCB?
The correct answer is B. B-rated. B-rated systems are explicitly defined in the Orange Book (TCSEC) as the "Mandatory Protection" division, where the system itself enforces access control through security labels rather than leaving it to user discretion - this is Mandatory Access Control (MAC). The B division (B1
Question
Which of the following rated systems of the Orange book has mandatory protection of the TCB?
Options
- AC-rated
- BB-rated
- CD-rated
- DA-rated
How the community answered
(60 responses)- A2% (1)
- B87% (52)
- C8% (5)
- D3% (2)
Explanation
B-rated systems are explicitly defined in the Orange Book (TCSEC) as the "Mandatory Protection" division, where the system itself enforces access control through security labels rather than leaving it to user discretion - this is Mandatory Access Control (MAC). The B division (B1, B2, B3) requires the TCB to enforce mandatory policies that users cannot override.
C-rated systems use Discretionary Access Control (DAC), where resource owners control access - making it discretionary, not mandatory. D-rated is the lowest tier (Minimal Protection) with effectively no security requirements met. A-rated is "Verified Protection," which builds on B-level mandatory controls but adds formal mathematical verification - the mandatory protection concept originates at B, not A.
Memory tip: Think B = "Be Mandatory" and C = "Choice" (discretionary). The letters go up in trust: D (none) → C (your choice) → B (must obey) → A (prove it mathematically).
Topics
Community Discussion
No community discussion yet for this question.