According to the Orange Book, which security level is the first to require a system to protect against covert
timing channels?

A.
A1

B.
B3

C.
B2

D.
B1

Explanation:
The TCSEC defines two kinds of covert channels:
Storage channels – Communicate by modifying a “storage location”
Timing channels – Perform operations that affect the “real response time observed” by the receiver
The TCSEC, also known as the Orange Book, requires analysis of covert storage channels to be classified as a
B2 system and analysis of covert timing channels is a requirement for class B3.
Incorrect Answers:
A: Level A1 requires a system to protect against covert timing channels. However, the lower level B3 also
requires it.
C: Level B2 does not require a system to protect against covert timing channels.
D: Level B1 does not require a system to protect against covert timing channels.

https://en.wikipedia.org/wiki/Covert_channel