Access Control Flashcards

1
Q

What data structure is used to implement discretionary access control?

a. Linked list
b. 2d matrix
c. Red and black tree
d. Stack

A

b. 2d matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following is granting permission to a system entity to access a system resource?

a. Authentication
b. Authorization
c. Audit
d. Allowance
e. None of the above

A

b. Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What kind of relationship is a role to a user in role based access control?

a. 1 to 1
b. 1 to many
c. Many to one
d. Many to many

A

d. Many to many (a role can have many users, many users can have many roles review chapter 4, page 146 and chapter 27)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

T/F: Access control implements a security policy that verifies the credentials of a user

A

False (page 107)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which entities and functions form access control?

A

Authentication, Authorization, and Audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Authentication

A

Verification that the credentials of a user or other system entity are valid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define Authorization

A

The granting of a right or permission to a system entity to access a system resource. This function determines who is trusted for a given purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define Audit

A

An independent review and examination of system records and activities in order to test for adequacy of system controls, to ensure compliance with established policy and operational procedures, to detect breaches in security, and to recommend any indicated changes in control, policy, and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This policy controls access based on the identity of the requestor and on access rules (authorizations) stating what requestors are (or are not) allowed to do. This policy is termed [ ] because an entity might have access rights that permit the entity, by its own volition, to enable another entity to access some resource.

a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)

A

c. Discretionary Access Control (DAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This policy controls access based on comparing security labels (which indicate how sensitive or critical system resources are) with security clearances (which indicate system entities are eligible to access certain resources). This policy is termed [ ] because an entity that has clearance to access a resources may not, just by its own volition, enable another entity to access that resource

a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)

A

a. Mandatory Access Control (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

This policy controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles.

a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)

A

d. Role Based Access Control (RBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

This policy controls access based on attributes of the user, the resource to be accessed, and current environmental conditions

a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)

A

b. Attribute Based Access Control (ABAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which of the following is an entity capable of accessing objects. Generally, the concept of [ ] equates with that of process.

a. Subject
b. Object
c. Access Right
d. Access Matrix

A

a. Subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the three classes of subject have the least amount of access granted to users who are able to access the system but are not included in the categories owner and group for this resource

a. Owner
b. Group
c. World

A

c. World

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of the three classes of subject may be the creator of a resource, such as a file? For system resources [ ] may belong to a system administrator. For project resources, a project administrator or leader may be assigned [ ].

a. Owner
b. Group
c. World

A

a. Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the three classes of subject is described as: a named group of users may also be granted access rights, such that membership in the group is sufficient to exercise these access rights.

a. Owner
b. Group
c. World

A

b. Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following is a recourse to which access is controlled? A [ ] is an entity used to contain and/or receive information. Examples include records, blocks, pages, segments, files, portions of files, directories, directory trees, mailboxes, messages and programs.

a. Subject
b. Object
c. Access Right
d. Access Matrix

A

b. Object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following described the way in which a subject may access an object?

a. Access Matrix
b. Capability List
c. Capability Matrix
d. Access Right

A

d. Access Right

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

This access right allows a user to view information in a system or resource. It includes the ability to copy or print.

a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create

A

c. Read

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

This access right allows a user to list the files in a directory or otherwise find the directory.

a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create

A

a. Search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

This access right allows a user to create new files, records, or fields

a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create

A

f. Create

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

This access right allows a user to add, modify, or delete data in a system resource. It includes read access.

a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create

A

d. Write

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

This access right allows a user to delete certain system resources such as files or records

a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create

A

e. Delete (duh)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

This access right allows a user to execute specified programs

a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create

A

b. Execute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the general approach to Discretionary Access Control (DAC) as exercised by an operating system or a database management system?

a. Access Control List
b. Access Matrix
c. Capability Control Matrix
d. Capability List

A

b. Access Matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the two dimensions of an access matrix?

A

One dimension of the matrix consists of identified subjects that may attempt data access to the resources (individual users or user groups)

The other dimension lists the objects that may be accessed. Objects may be individual data fields or records, files or databases

Key is that each entry in the matrix indicates the access rights of a particular subject for a particular object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Name and describe the two ways access control matrices can be decomposed

A

Access Control Lists (ACLs): for each object, an ACL lists users and their permitted access rights

Capability Tickets: specifies authorized objects and operations for a particular user. Each user has a number of tickets and may be authorized to load or give them to others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights include the ability to delete, stop/block, and wake these up.

a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects

A

a. Processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights include the ability to read/write, control operation of, and block/unblock these for use.

a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects

A

b. Devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights include the ability to read/write these. They are protected such that the default is to disallow access

a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects

A

c. Memory Locations or Regions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights with respect to these have to do with the ability to grant or delete access rights of them to other objects

a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects

A

d. Subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Explain the meaning of inode in the UNIX file administration system

A

Is a control structure that contains the key information needed by the operating system for a particular file.

Several file names may be associated with a single inode, but an active inode is associated with exactly one file, and each file is controlled by exactly one inode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

There are four entities in an RBAC system. This one is an individual that has access to his computer system. Each individual has an associated user IDF

a. User
b. Role
c. Permission
d. Session

A

a. User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

There are four entities in an RBAC system. This one is a named job function within the organization that controls this computer system. Typically, associated with each [ ] is a description of the authority and responsibility conferred to it, and on any user who assumes this [ ]

a. User
b. Role
c. Permission
d. Session

A

b. Role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

There are four entities in an RBAC system. This one is an approval of a particular mode of access to one or more objects. Equivalent terms are access right, privilege, and authorization

a. User
b. Role
c. Permission
d. Session

A

c. Permission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

There are four entities in an RBAC system. This one is a mapping between a user and an activated subset of the set of roles to which the user is assigned

a. User
b. Role
c. Permission
d. Session

A

d. Session

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Constraints provide a means of adapting RBAC to the specifics of administrative and security policies in an organization. A constraint is a defined relationship among roles or a condition related to roles.

This RBAC constraint refers to setting a maximum number with respect to roles. One such constraint is to set a maximum number of users that can be assigned to a given role.

a. Mutually Exclusive Roles
b. Cardinality
c. Prerequisite Roles

A

b. Cardinality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Constraints provide a means of adapting RBAC to the specifics of administrative and security policies in an organization. A constraint is a defined relationship among roles or a condition related to roles.

This RBAC constraint refers to roles such that a user can be assigned to only one role in the set

a. Mutually Exclusive Roles
b. Cardinality
c. Prerequisite Roles

A

a. Mutually Exclusive Roles

39
Q

Constraints provide a means of adapting RBAC to the specifics of administrative and security policies in an organization. A constraint is a defined relationship among roles or a condition related to roles.

This RBAC constraint refers to dictating a user can only be assigned to a particular role if it is already assigned to some other specified role.

a. Mutually Exclusive Roles
b. Cardinality
c. Prerequisite Roles

A

c. Prerequisite Roles

40
Q

T/F: The main obstacle to adoption of ABAC is the concern about the performance impact. Its evaluation is predicated on both resource and user properties for each access.

A

True

41
Q

What are the 3 key elements to an ABAC model?

A

Attributes: defined for entities in a configuration
Policy Model: defines the ABAC policies
Architecture Model: applies to policies which enforce access control

42
Q

There are three types of attributes for ABAC Model. This one is defined as: an active entity (e.g. a user, an application, a process, or a device) which causes information to flow among objects or changes the system state

a. Subject Attributes
b. Object Attributes
c. Environmental Attributes

A

a. Subject Attributes

43
Q

There are three types of attributes for ABAC Model. This one is defined as: a resource. Is a passive information system-related entity (e.g. devices, files, records, tables, processes, programs, networks, domains) containing or receiving information

a. Subject Attributes
b. Object Attributes
c. Environmental Attributes

A

b. Object Attributes

44
Q

There are three types of attributes for ABAC Model. This one is defined as: the operational, technical, and even situational environment or context in which the information access occurs.

a. Subject Attributes
b. Object Attributes
c. Environmental Attributes

A

c. Environmental Attributes

45
Q

T/F: Privileges in ABAC are a set of rules and relationships which govern allowable behavior within an organization, based on the privileges of subjects and how resources or objects are to be protected under which environment conditions.

A

False. Defined is a policy in ABAC.

46
Q

T/F: Policy in ABAC represent the authorized behavior of a subject (also called rights, authorizations, or entitlements).

A

False. This is the definition for privileges in ABAC

47
Q

This is a comprehensive approach to managing and implementing digital identities, credentials, and access control.

a. ICAM
b. Identity Management
c. RBAC
d. Privilege Management

A

a. ICAM (Identity, Credential, and Access Management)

48
Q

This is concerned with assigning attributes to a digital identity and connecting that digital identity to an individual or NPE. The goal is to establish a trustworthy digital identity that is independent of a specific application or context.

a. ICAM
b. Identity Management
c. RBAC
d. Privilege Management

A

b. Identity Management

49
Q

List the elements of identity lifecycle management.

A

a. Mechanisms, policies, procedures for protecting PII
b. Controlling access to identity data
c. Techniques for sharing authoritative identity data with applications which need it
d. Revocation of an enterprise identity

50
Q

This is an object or data structure which authoritatively binds an identity to a token possessed and controlled by a subscriber

a. Privilege
b. User
c. Role
d. Credential

A

d. Credential

51
Q

There are three supporting elements which are needed for an enterprise-wide access control facility. This one is the element concerned with defining rules for a resource which requires access control.

a. Resource Management
b. Privilege Management
c. Policy Management

A

a. Resource Management

52
Q

There are three supporting elements which are needed for an enterprise-wide access control facility. This one is the element concerned with establishing and maintaining the entitlement attributes that comprise an individual’s access profile.

a. Resource Management
b. Privilege Management
c. Policy Management

A

b. Privilege Management

53
Q

There are three supporting elements which are needed for an enterprise-wide access control facility. This one is the element concerned with governing what is allowable and not allowed in an access transaction.

a. Resource Management
b. Privilege Management
c. Policy Management

A

c. Policy Management

54
Q

Multiple Selection: What are the requirements of a trusted computing base (TCB)?

a. User Experience
b. Tamper Proof
c. Reliability
d. Complete Mediation
e. Correctness

A

b. Tamper-Proof: untrusted code should not be able to tamper with code or data which make up the TCB
d. Complete Mediation: TCB must be a reference monitor. Every reference from a resource that needs to be protected must go through the TCB. There should be no way to bypass this.
e. Correctness: since we put all our trust in the TCB, it must be correct.

55
Q

Which Type of control is based on the identity of the requestor and the access rules state what a requestor can or cannot do?

A) Mandatory Access Control (MAC)
B) Role-based access control (RBAC)
C) Discretionary access control (DAC)
D) Attribute-based access control (ABAC)

A

Answer C

This policy is termed discretionary because an entity might have access rights that permit the entity, by its own volition, to enable another entity to access some resource.

Source: Book Chapter 4.2 Page 131

56
Q

T/F: Access Control Lists make it easy to look up who all the users are that can access a resource, and the type of access they have for that resource.

A

Answer True

Source: Book Chapter 4.3 Page 111

57
Q

What does each entry of an access matrix indicate?

A. Access rights of a particular object for a particular subject.
B. Access rights of a particular subject for a particular object.
C. Access rights of a particular subject for a particular directory.
D. Access rights of a particular object for a particular group.

A

Answer B

Source: Book pg. 111

58
Q

T/F: DAC is a concept that evolved out of requirements for military information security.

A

Answer False

DAC is the traditional method for implementing access control, MAC was created out of military necessity.

Source: Book, Ch 4, Pg. 109

59
Q

T/F: One problem with DAC is that it is not possible to control information flow.

A

Answer True

Source: Mandatory Access Control Lecture

60
Q

T/F: DAC is popular with corporations because it reflects how they treat their data.

A

Answer False

Employers mandate explicit policies on who can share what.

Source: Mandatory Access Control Lecture

61
Q

An access control mechanism mediates between a user (or a process executing on behalf of a user) and system resources, such as:

a) firewalls
b) routers
c) applications
d) a & b only
f) All of the above

A

f) All of the above

ch. 4, p. 108 of text

62
Q

Which of the following is granting permission to a system entity to access a system resource?

A) Authentication
B) Authorization
C) Audit
D) Allowance
E) None of the Above
A

Answer B

Authorization determines who is trusted for a given purpose

Source: Book Chapter 4.1 Page
130

63
Q

T/F: Access control implements a security policy that verifies the credentials of a user.

A

Answer False.

Access control implements a security policy that specifies who or what may have access to each specific system resource, and the type of access that is permitted in each instance.

Source: Book pg. 107

64
Q

Under Mandatory Access Control (MAC), what two properties provide confidentiality:

A) Read Up, Write Down
B) No Read Up, No Write Down
C) Read Up, No Write Down
D) No Read Up, Write Down

A

Answer B) No Read Up, No Write Down

No read up: A subject can only read an object of less or equal security level
No write down: A subject can only write into an object of greater or equal security level.

ch. 27, p. 27-2 text

65
Q

T/F: A subject is said to have a security clearance of a given level and an object is said to have a security classification of a given level.

A

Answer True

Source: Book Chapter 27 Page 27-4

66
Q

For the Bell-Lapadula Model (BLP), the properties needed for the confidentiality form of MAC are:

  1. ds-property and *-property
  2. ss-property and *-property
  3. ss-property and ds-property
  4. None of the above
A

Answer 2. (Chapter 27.1)

ss-property (simple security property): no read up
*-property (star property): no write down

The ds-property is a provision made by BLP for DAC but must be consistent with MAC rules.

67
Q

T/F: Other MAC models such as Bell and La Padua (BLP Model) is focused on Integrity, and BIBA model is focused on Confidentiality.

A

Answer False

BLP focuses on Confidentiality and BIBA focuses on Integrity

Source: P1:L6 MAC slides | Other MAC models

68
Q

T/F: Examples of BLP model classifications are High, Medium, and Low.

A

Answer False. Examples are Top Secret, Secret, Confidential

Source: P1:L6 MAC slides | Other MAC models

69
Q

T/F: MAC cannot be employed with other access control policies, such as DAC, RBAC, and ABAC.

A

Answer False

All four access policies (DAC, MAC, RBAC, and ABAC) are not mutually exclusive

Source: Book, Ch. 4, Pg. 109

70
Q

______ is based on the roles that users assume in a system rather than a user’s identity.

A. DAC
B. MAC
C. RBAC
D. ABAC

A

Answer C

Source: Book pg. 120

71
Q

What aspect of an established RBAC system is likely to change infrequently?

A) The set of resources and the specific access rights associated with a particular role.
B) The set of roles in the system.
C) The set of users.
D) A & B
E) None of the above.
A

Answer D

Source: Book. Ch 4, Pg 120

72
Q

The RBAC prerequisite role can be used for the following:

A) A way to increase the difficulty of collusion among individuals of different skills or divergent job functions to thwart security policies.
B) For structuring the implementation of the least privilege concept.
C) As a risk mitigation technique for a sensitive or powerful permission.
D) None of the above

A

Answer B

Source: Book, Ch 4, Pg 125

73
Q

How does ABAC model controls access?

A

ABAC evaluates attributes of subject/object and access control rule defining allowable operation in a given environment

Source: book p. 127

74
Q

In the Attribute-Based Access Control (ABAC) model: current date and time, the current virus/hacker activities, and the network’s security level are known as ____

A) Object attributes
B) Subjects attributes
C) Environment attributes
D) Access Right
E) None of the Above
A

Answer C

environments describe the operational, technical, and even situational environment or context in which the information access occurs

Source: Book Chapter 4.6 Page 149

75
Q

In a(n) _____ model, authorizations can be defined that express conditions on properties of both the resource and the subject.

A. DAC
B. MAC
C. RBAC
D. ABAC

A

Answer D

Source: Book pg. 126

76
Q

The strength of the ABAC approach is its ________ and ________.

A. strictness, performance
B. flexibility, expressive power
C. extensibility, ease of use
D. None of the above

A

Answer B

Source: Book pg. 126

77
Q

T/F: Access Control Lists may have default entry that should always follow the rule of least privilege

A

Answer True

Source: book p.111

78
Q

T/F: The columns of an Access Control Matrix are Access Control Lists.

A

Answer True

The matrix may be decomposed by columns, yielding access control lists (ACLs) (see Figure 4.2b). Decomposition by rows yields capability lists (see Figure 4.2c).

Source: Book chapter 4.3 page 133

79
Q

In Unix, a user (U) can run with the permission of the file creator (C) under what condition(s)?

a) U has execute privileges
b) C has read, write, and execute permissions
c) Set User ID
d) Set Group ID
e) a & c
f) all of the above

A

Answer E

80
Q

Multiple Choice: What contents exist inside of a file’s inode?

a) Environmental Variables
b) Answer Owner ID
c) Group ID
d) User ID
e) 12 protection bits

A

Answer b), c), e)

81
Q

What is an inode (index node)?

A.) An inode is part of a linked list design for memory storage
B.) An inode is a special directory only to bee seen by root
C.) An inode is a control structure that contains information needed by the OS for a file.
D.) An inode is a user permission for a given user group.

A

Answer C

Page 117

82
Q

T/F: An inode contains all information about a file.

A

Answer False

inode’s don’t contain the file name and actual data

83
Q

The concept of inheritance enables one role to implicitly include access rights associated with a subordinate role. What role-based access control makes use of this concept?

A

Answer: Role Hierarchy

Source: book p.124

84
Q

What is the initial requirement for performing user authentication?

A.) User must be registered within the system.
B.) A token must be verified
C.) A digital signature needs to be authenticated
D.) A multi factor system has to be in place

A

Answer A

Page 65

85
Q

What are examples of static vs dynamic biometric recognition?

A.) Dynamic biometric could be a fingerprint and Static could be a voice pattern
B.) Dynamic can be face recognition and static could be fingerprint
C.) Dynamic is when you have an electronic keycard and static is a fingerprint
D.) Static biometric is a fingerprint and dynamic biometric is a voice pattern

A

Answer D

Page 66

86
Q

The means for authenticating a user can be summarized in general terms by four things. What are the four things?

A.) Something the user knows, possesses, is and does.
B.) Something the user knows, possesses, is and wants
C.) Something the user can see, knows, wants and doesn’t have
D.) something the user knows, is, wants and does

A

Answer A

Page 66

87
Q

Bad person Eve walks up to the system and says she is Alice, and successfully logs in as Alice. This authentication outcome is a:

A.) False negative
B.) False positive

A

Answer B

P1:L4 Authentication (Authentication Goals video slide)

88
Q

A ________ is a set of programs installed on a system to maintain covert access to that system with administrator or root privileges, while hiding evidence of its presence to the greatest extent possible

A

Answer Rootkit

Source: Book Page 212

89
Q

A rootkit can be classified into which of the following characteristics:

A.) Persistent
B.) Memory Based
C.) User Mode
D.) Kernel Mode
E.) Virtual Machine based
F.) External Mode
G.) All of the above
A

Answer G

Source: Book page 312

90
Q

A rootkit can be classified into _______ this is when the rootkit intercepts calls to APIs and modifies the returned results.

A.) Memory based
B.) User Mode
C.) Kernel Mode
D.) External mode

A

Answer B.) User Mode

Source Book page 212

91
Q

What type of rootkit can not survive a reboot and why not?

A.) Kernel Mode and because there is no user intervention
B.) Persistent and because the firewall flushes the rootkit out
C.) Memory based and there is no persistent code
D.) External Mode and because it is located in the BIOS

A

Answer C

Page 212: The book says “Memory based rootkits have no persistent code and therefore can not survive a reboot”

92
Q

Which of the following are valid defenses against Client Attacks on a user authentication system?

I. Use passwords and pins with high entropy
II. Protect the password database
III. Implement a challenge-response protocol
IV. Limit authentication attempts

a. I and II
b. I and IV
c. II and IV
d. II and III
e. I, II, and IV

A

Answer: B (I and IV)

93
Q

T/F: The three A’s of access control are Authentication, Authorization, and Allowance

A

False. Third “A” is Audit