Which one of the following statements is untrue?

A.
A security model is a collection of requirements

B.
A security architecture is made up of computer security components

C.
A security model embodies security principles

D.
A security architecture embodies procedures

Explanation:
Security procedures are operational controls. A security architecture
only embodies the conceptual security components. The principles behind how these
components are implemented are included, but not the specific procedures used to
implement them. All other statements are true.