Access Control Flashcards
A preliminary step in managing resources is
A. Conducting a risk analysis
B. Defining who can access a given system or information
C. Performing a business impact analysis
D. Obtaining top management support
B. Defining who can access a given system or information
Which best describes access controls?
A. Access controls are a collection of technical controls that permit access to authorized users, systems, and applications.
B. Access controls help protect against threats and vulnerabilities by reducing exposure to unauthorized activities and providing access to information and systems to only those who have been approved.
C. Access control is the employment of encryption solutions to protect authentication information during logon.
D. Access controls help protect against vulnerabilities by controlling unauthorized access to systems and information by employees, partners, and customers.
B. Access controls help protect against threats and vulnerabilities by reducing exposure to unauthorized activities and providing access to information and systems to only those who have been approved.
\_\_\_\_\_\_\_ requires that a user or process be granted access to only those resources necessary to perform assigned functions A. Discretionary access control B. separation of duties C. Least privilege D. Rotation of duties
C. Least privilege
What are the seven main categories of access control?
A. Detective, corrective, monitoring, logging, recovery, classification, and directive
B. Directive, deterrent, preventative, detective, corrective, compensating, recovery
C. authorization, identification, factor, corrective, privilege, detective, directive
D. identification, authentication, authorization, detective, corrective, recovery, directive,
B. Directive, deterrent, preventative, detective, corrective, compensating, recovery
What are the 3 types of access control?
A. administrative, physical, technical
B. identification, authentication, authorization
C. mandatory, discretionary, least privilege
D. access, management, monitoring
A. administrative, physical, technical
Which approach revolutionized the cracking of passwords? A. brute force B. rainbow table C. memory tabling D one-time hashing
B. rainbow table
What best describes 2-factor authentication? A. hard token and smart card B. username and pin C. password and pin D. pin and hard token
D. pin and hard token
A potential vulnerability of the kerberos authentication server is
A. single point of failure
B. asymmetric key compromise
C. use of dynamic passwords
D. limited lifetimes for authentication credentials.
A. single point of failure
In mandatory access control the system controls access and the owner determines A. validation B. need to know C. consensus D. verification
B. need to know
Which is the least significant issue when considering biometrics? A. resistance to counterfeiting B. technology type C. user acceptance D. reliability and accuracy
B. technology type
Which is a fundamental disadvantage of biometrics? A. revoking credentials B. encryption C. communications D. Placement
A. revoking credentials
role based access control A. is unique to mandatory access control B. is independent of owner input C. is based on job functions D. can be compromised by inheritance
C. is based on job functions
Identity management is
A. another name for access controls
B. technologies and processes intended to offer greater efficiency in the management of a diverse user and technical environment
C. Technologies and processes focused on the provisioning and decommissioning of user credentials.
D. Technologies and processes used to establish trust relationships with disparate systems.
B. technologies and processes intended to offer greater efficiency in the management of a diverse user and technical environment
A disadvantage of single sign on is
A. consistent time-out enforcement across platforms
B. A compromised password exposes all authorized resources
C. Use of multiple passwords to remember
D. password change control
B. technologies and processes intended to offer greater efficiency in the management of a diverse user and technical environment
Which of the following is incorrect when considering privilege management?
A. privileges associated with each system, service, or application, and the defined roles within the organization to which they are needed should be identified and clearly documented.
B. Privileges should be managed based on least privilege. Only rights required to perform a job should be provided to a user, group, or role.
C. An authorization process and a record of all privileges allocated should be maintained. Privileges should not be granted until the authorization process is complete and validated.
D. Any privileges that are needed for intermittent job functions should be assigned to multiple user accounts, as opposed to those for normal system activity related to the job function.
D. Any privileges that are needed for intermittent job functions should be assigned to multiple user accounts, as opposed to those for normal system activity related to the job function.
Threat modeling is the process of
A. determining which threats to neutralize first.
B. developing access controls which will compensate for vulnerabilities.
C. a risk assessment approach in which decisions are based on risk and value.
D. scenario analysis targeted towards determining the best approach for threat elimination.
C. a risk assessment approach in which decisions are based on risk and value.
When reviewing user entitlement the security professional must be most aware of
A. identity management and disaster recovery capability.
B. business or organization processes and access aggregation
C. The organizational tenure of the user requesting entitlement
D. Automated processes which grant user access to resources.
B. business or organization processes and access aggregation
Which formula represents ALE or annual loss exposure? A. ALE = SLE x ARO B. SLE = ARO x ALE C. SLE = ARO x EF D. ALE = EF x SLE
A. ALE = SLE x ARO
In constructing a continuous monitoring system, numerous feeds from several systems must be correlated and analyzed. Which of the following best provides this capability?
A. IPS
B. Identity management and access control system
C. IDS
D. Security Information and event management SIEM.
D. Security Information and event management SIEM.
A guard dog patrolling the perimeter of a data center is what type of control? A. recovery B. administrative C. logical D. physical
D. physical
Define access controls
the collection of mechanisms, processes that work together to protect the assets of an organization.
3 core security principles
confidentiality
integrity
availability
define defense in depth
practice of applying multiple layers of security protection
7 categories of access control
directive deterrent preventative compensating detective corrective recovery
define directive control
designed to specify acceptable rules of behavior within an organization
define deterrent control
designed to discourage people from violating security directives
define preventative control
implemented to prevent a security incident
define compensating control
implemented to substitute for the loss of primary control
define detective control
designed to signal a warning when a security control has been breached
define corrective control
implemented to remedy circumstance, mitigate damage
