Section: Security Assessment and Testing

Explanation/Reference:
Explanation:
A lattice is a mathematical construct that is built upon the notion of a group. The most common definition of the lattice model is "a structure consisting of a finite partially ordered set together with least upper and greatest lower bound operators on the set." Two methods are commonly used for applying mandatory access control:
Rule-based (or label-based) access control: This type of control further defines specific conditions for

access to a requested object. A Mandatory Access Control system implements a simple form of rule- based access control to determine whether access should be granted or denied by matching:
- An object's sensitivity label
- A subject's sensitivity label
Lattice-based access control: These can be used for complex access control decisions involving

multiple objects and/or subjects. A lattice model is a mathematical structure that defines greatest lower- bound and least upper-bound values for a pair of elements, such as a subject and an object.
Incorrect Answers:
A: The model described in the question is a type of mandatory access control. However, the Lattice Model is specifically described in the question.
B: A discretionary model is not what is described in the question.
D: A rule model is not what is described in the question.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 381
https://en.wikipedia.org/wiki/Computer_access_control

This is an absolute best practice in the software testing field, you should always have to keep all your testing approaches with the results as part of the product documentation. This can help you in the case you have problems with some tasks or components of the software in the future, you can check back your testing and results and see if the system was making the tasks correctly and if anything changed from that environment.

Diffusion is aimed at obscuring redundancy in the plaintext by
spreading the effect of the transformation over the ciphertext. Permutation is also known as transposition and operates by rearranging the letters of the plaintext.
*Answer substitution is used to implement
confusion in a block cipher. Confusion tries to hide the relationship
between the plaintext and the ciphertext. The Caesar cipher is an
example of a substitution cipher.
* XORing is incorrect since XORing, for example, as used in a stream cipher, implements confusion and not diffusion. Similarly, nonlinear S-boxes implement substitution. In DES, for example, there are eight different S-boxes that each has an input of 6 bits and an output of 4 bits. Thus, nonlinear substitution is effected.

For a cryptographic hash function, H (m) is relatively easy to compute for a given m.
*Answer "H (m) is collision free" is a characteristic of a good cryptographic hash function, in that collision free means that for a given message, M, that produces H (M) = Z, it is computationally infeasible to find another message, M1, such that H (M1) = Z.
*Answer "The output is of fixed length" is part of the definition of a hash function since it generates a fixed-length result that is independent of the length of the input message. This characteristic is useful for generating digital signatures since the signature can be applied to the fixed-length hash that is uniquely characteristic of the message instead of to the entire message, which is usually much longer than the hash.
*Answer "H (m) is a one-way function" relates to answer "H (m) is difficult to compute for any given m" in that a one-way function is difficult or impossible to invert. This means that for a hash function H (M) = Z, it is computationally infeasible to reverse the process and find M given the hash Z and the function H.