0

I'm studying for the CISSP exam and one of the practice questions in my study guide has me a bit confused. The question is:

Which of the following is NOT considered an example of data hiding?

A. Preventing an authorized reader of an object from deleting that object.  
B. Keeping a database from being accessed by unauthorized visitors. 
C. Restricting a subject at a lower classification level from accessing data at a higher classification level. 
D. Preventing an application from accessing hardware directly.

I chose D because I didn't think accessing hardware had anything to do with data itself. According to the study guide though, the correct answer is A. Explanation:

Preventing an authorized reader of an object from deleting that object is just an example of access control, not data hiding. If you can read an object, it is not hidden from you.

OK, fair enough. But I still don't understand why my chosen answer was also invalid. Can someone please help me understand?

Mike B
  • 3,458
  • 4
  • 32
  • 42
  • 2
    Could it be that by preventing access to some hardware, you do not access the data provided by that hardware? Hardware is a generic term and could mean many things. For example, preventing access to the hard drive from an application hides the data stored in that hard drive? – Ronny Apr 19 '17 at 14:37

1 Answers1

1

The question was "NOT... an example of data hiding" and in option A, you have an authorized reader of the data. Options B, C and D deal with users, or applications, that do not have permissions to view the data.

In all of these options, consider permissions in relation to the data. Permissions being the ability to read, write or modify and the only one with any of the three, (read, write, modify) is the authorized reader in option A who has read access.

You may need to shift your thinking for this test. Coming from a systems background, I failed the test the first time because I took the test with a desktop support/sysadmin mentality. Try to think from an administrative/managerial approach. I know that's easy to say because I read it a few times when I was studying for the exam.

Good luck man!

Phillip Constable
  • 11
  • 1