Which of the following classes is the first level (lower) defined in the TCSEC (Orange Book) as mandatory
protection?

A.
B

B.
A

C.
C

D.
D

Explanation:
The U.S. Department of Defense developed the Trusted Computer System Evaluation Criteria (TCSEC), which
was used to evaluate operating systems, applications, and different products. These evaluation criteria are
published in a book known as the Orange Book.
TCSEC provides a classification system that is divided into hierarchical divisions of assurance levels:
A:
Verified protection
B:
Mandatory protection
C:
Discretionary protection
D:
Minimal protection
Classification A represents the highest level of assurance, and D represents the lowest level of assurance.
Level B: Mandatory Protection: Mandatory access control is enforced by the use of security labels. The
architecture is based on the Bell-LaPadula security model, and evidence of reference monitor enforcement
must be available.
Incorrect Answers:
B: Level A is defined as verified protection, not mandatory protection.
C: Level C is defined as discretionary protection, not mandatory protection.
D: Level D is defined as minimal security, not mandatory protection.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 392, 395