Access Control Flashcards
What data structure is used to implement discretionary access control?
a. Linked list
b. 2d matrix
c. Red and black tree
d. Stack
b. 2d matrix
Which of the following is granting permission to a system entity to access a system resource?
a. Authentication
b. Authorization
c. Audit
d. Allowance
e. None of the above
b. Authorization
What kind of relationship is a role to a user in role based access control?
a. 1 to 1
b. 1 to many
c. Many to one
d. Many to many
d. Many to many (a role can have many users, many users can have many roles review chapter 4, page 146 and chapter 27)
T/F: Access control implements a security policy that verifies the credentials of a user
False (page 107)
Which entities and functions form access control?
Authentication, Authorization, and Audit
Define Authentication
Verification that the credentials of a user or other system entity are valid
Define Authorization
The granting of a right or permission to a system entity to access a system resource. This function determines who is trusted for a given purpose.
Define Audit
An independent review and examination of system records and activities in order to test for adequacy of system controls, to ensure compliance with established policy and operational procedures, to detect breaches in security, and to recommend any indicated changes in control, policy, and procedures
This policy controls access based on the identity of the requestor and on access rules (authorizations) stating what requestors are (or are not) allowed to do. This policy is termed [ ] because an entity might have access rights that permit the entity, by its own volition, to enable another entity to access some resource.
a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)
c. Discretionary Access Control (DAC)
This policy controls access based on comparing security labels (which indicate how sensitive or critical system resources are) with security clearances (which indicate system entities are eligible to access certain resources). This policy is termed [ ] because an entity that has clearance to access a resources may not, just by its own volition, enable another entity to access that resource
a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)
a. Mandatory Access Control (MAC)
This policy controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles.
a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)
d. Role Based Access Control (RBAC)
This policy controls access based on attributes of the user, the resource to be accessed, and current environmental conditions
a. Mandatory Access Control (MAC)
b. Attribute Based Access Control (ABAC)
c. Discretionary Access Control (DAC)
d. Role Based Access Control (RBAC)
b. Attribute Based Access Control (ABAC)
Which of the following is an entity capable of accessing objects. Generally, the concept of [ ] equates with that of process.
a. Subject
b. Object
c. Access Right
d. Access Matrix
a. Subject
Which of the three classes of subject have the least amount of access granted to users who are able to access the system but are not included in the categories owner and group for this resource
a. Owner
b. Group
c. World
c. World
Which of the three classes of subject may be the creator of a resource, such as a file? For system resources [ ] may belong to a system administrator. For project resources, a project administrator or leader may be assigned [ ].
a. Owner
b. Group
c. World
a. Owner
Which of the three classes of subject is described as: a named group of users may also be granted access rights, such that membership in the group is sufficient to exercise these access rights.
a. Owner
b. Group
c. World
b. Group
Which of the following is a recourse to which access is controlled? A [ ] is an entity used to contain and/or receive information. Examples include records, blocks, pages, segments, files, portions of files, directories, directory trees, mailboxes, messages and programs.
a. Subject
b. Object
c. Access Right
d. Access Matrix
b. Object
Which of the following described the way in which a subject may access an object?
a. Access Matrix
b. Capability List
c. Capability Matrix
d. Access Right
d. Access Right
This access right allows a user to view information in a system or resource. It includes the ability to copy or print.
a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create
c. Read
This access right allows a user to list the files in a directory or otherwise find the directory.
a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create
a. Search
This access right allows a user to create new files, records, or fields
a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create
f. Create
This access right allows a user to add, modify, or delete data in a system resource. It includes read access.
a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create
d. Write
This access right allows a user to delete certain system resources such as files or records
a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create
e. Delete (duh)
This access right allows a user to execute specified programs
a. Search
b. Execute
c. Read
d. Write
e. Delete
f. Create
b. Execute
What is the general approach to Discretionary Access Control (DAC) as exercised by an operating system or a database management system?
a. Access Control List
b. Access Matrix
c. Capability Control Matrix
d. Capability List
b. Access Matrix
What are the two dimensions of an access matrix?
One dimension of the matrix consists of identified subjects that may attempt data access to the resources (individual users or user groups)
The other dimension lists the objects that may be accessed. Objects may be individual data fields or records, files or databases
Key is that each entry in the matrix indicates the access rights of a particular subject for a particular object
Name and describe the two ways access control matrices can be decomposed
Access Control Lists (ACLs): for each object, an ACL lists users and their permitted access rights
Capability Tickets: specifies authorized objects and operations for a particular user. Each user has a number of tickets and may be authorized to load or give them to others
The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights include the ability to delete, stop/block, and wake these up.
a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects
a. Processes
The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights include the ability to read/write, control operation of, and block/unblock these for use.
a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects
b. Devices
The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights include the ability to read/write these. They are protected such that the default is to disallow access
a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects
c. Memory Locations or Regions
The universe of objects can be extended in multiple ways. One way is through _____ which are: access rights with respect to these have to do with the ability to grant or delete access rights of them to other objects
a. Processes
b. Devices
c. Memory Locations or Regions
d. Subjects
d. Subjects
Explain the meaning of inode in the UNIX file administration system
Is a control structure that contains the key information needed by the operating system for a particular file.
Several file names may be associated with a single inode, but an active inode is associated with exactly one file, and each file is controlled by exactly one inode.
There are four entities in an RBAC system. This one is an individual that has access to his computer system. Each individual has an associated user IDF
a. User
b. Role
c. Permission
d. Session
a. User
There are four entities in an RBAC system. This one is a named job function within the organization that controls this computer system. Typically, associated with each [ ] is a description of the authority and responsibility conferred to it, and on any user who assumes this [ ]
a. User
b. Role
c. Permission
d. Session
b. Role
There are four entities in an RBAC system. This one is an approval of a particular mode of access to one or more objects. Equivalent terms are access right, privilege, and authorization
a. User
b. Role
c. Permission
d. Session
c. Permission
There are four entities in an RBAC system. This one is a mapping between a user and an activated subset of the set of roles to which the user is assigned
a. User
b. Role
c. Permission
d. Session
d. Session
Constraints provide a means of adapting RBAC to the specifics of administrative and security policies in an organization. A constraint is a defined relationship among roles or a condition related to roles.
This RBAC constraint refers to setting a maximum number with respect to roles. One such constraint is to set a maximum number of users that can be assigned to a given role.
a. Mutually Exclusive Roles
b. Cardinality
c. Prerequisite Roles
b. Cardinality