CISSP practice question 1 of 35

Which of the following BEST describes a Protection Profile (PP)?

Domain Security Architecture and Engineering

Answer options

A: A document that expresses an implementation independent set of security requirements for an IT product that meets specific consumer needs. Correct answer

B: A document that is used to develop an IT security product from its security requirements definition.

C: A document that expresses an implementation dependent set of security requirements which contains only the security functional requirements.

D: A document that represents evaluated products where there is a one-to-one correspondence between a PP and a Security Target (ST).

Correct Answer:

A. A document that expresses an implementation independent set of security requirements for an IT product that meets specific consumer needs.

Explanation

A Protection Profile (PP), as defined by the Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408), is an implementation-independent document. It specifies a standard set of security requirements for a particular class of products, such as firewalls or operating systems. The PP is created to address a defined set of consumer security needs and threats, serving as a reusable template. Vendors can then develop a specific product, documented in a Security Target (ST), that claims conformance to a particular PP, demonstrating that it meets this standardized set of security requirements.

References

1. Common Criteria for Information Technology Security Evaluation. (2017). Part 1: Introduction and general model, Version 3.1, Revision 5 (ISO/IEC 15408-1:2017). Section 5.3.1, Paragraph 128, states, "A Protection Profile (PP) is an implementation-independent set of security requirements for a category of TOEs [Targets of Evaluation]... A PP is intended to be reusable and to define requirements for a category of TOEs that meet a specific set of consumer needs."

2. National Institute of Standards and Technology (NIST). (2006). An Introduction to the Common Criteria and the NIAP Evaluation and Validation Scheme (NIST Special Publication 800-23). Section 2.2, "Protection Profiles," states, "A Protection Profile (PP) is a document, typically created by a user or user community, which identifies security requirements for a class of security devices... relevant to that user for a particular purpose."

3. Bishop, M. (2005). Introduction to Computer Security. Pearson Education. Chapter 26, "Assurance," Section 26.3.2, "The Common Criteria," describes a Protection Profile as a document that "defines the security requirements and protections of a type of product." It emphasizes its role in defining a class of devices.

Question breakdown

Tests: Understand Common Criteria evaluation components (PP, ST, TOE)
Difficulty: Medium

Key idea: A Protection Profile is a reusable, implementation-independent statement of security requirements for a category of products that meets a defined set of consumer needs.

How to reach the answer

Recall that Common Criteria separates what consumers need (PP) from what a vendor claims for a specific product (ST).
The PP is written for a product class, such as firewalls, not for one implementation, so it must be implementation-independent.
Option A contains both clues: 'implementation independent' and 'specific consumer needs'.
Eliminate options that say 'implementation dependent' or describe one-to-one PP/ST mappings, because those describe the ST or misstate the relationship.

Each option

ACorrect. This matches the Common Criteria definition: an implementation-independent requirement set for a product category addressing consumer needs.
BIncorrect. Building a specific product from its requirements is the role of vendor design work and the Security Target, not the PP.
CIncorrect. A PP is implementation-independent, and it includes both functional and assurance requirements, not only functional ones.
DIncorrect. Many Security Targets can claim conformance to one PP, so there is no required one-to-one correspondence, and a PP does not represent evaluated products.

Common trap: Mixing up the PP with the Security Target, which is the implementation-specific document a vendor writes for one product.

In practice: Government buyers often require products to be evaluated against a NIAP-approved Protection Profile, and vendors cite PP conformance in their Security Target.

Remember: PP = consumer-side, implementation-independent requirements for a product class; ST = vendor-side claims for a specific TOE.

Official documentation: CISSP Certification Exam Outline

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free CISSP practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test