Which of the following are required for Life-Cycle Assurance?

Question

Options

• ASystem Architecture and Design specification.
• BSecurity Testing and Covert Channel Analysis.
• CSecurity Testing and Trusted distribution.
• DConfiguration Management and Trusted Facility Management.

• A
  3% (1)
• B
  6% (2)
• C
  88% (30)
• D
  3% (1)

Explanation

In the TCSEC (Orange Book) framework, assurance requirements are divided into two categories: Operational Assurance and Life-Cycle Assurance. Life-Cycle Assurance specifically includes Security Testing, Design Specification and Verification, Configuration Management, and Trusted Distribution. Option C lists Security Testing and Trusted Distribution - both are genuine Life-Cycle Assurance components. Option D is a trap: while Configuration Management is a Life-Cycle Assurance requirement, Trusted Facility Management belongs to Operational Assurance, making D incorrect as a pair. Option B's Covert Channel Analysis is an Operational Assurance requirement, and Option A's System Architecture specification is also under Operational Assurance.

No community discussion yet for this question.