chaps 5-10 study for final Flashcards
what is AAA?
AAA= Authentication, Authorization, Aditing
what is RBAC?
RBAC= role based access control: each role such as managers, employees etc. get parameters for access instead of using a user-access control method. -easier to cover more people.
Mandatory access control?
no ability to change rules
Discretionary Access Control
departments are allowed to alter rules
are automated password resets good and are they safe? y or y not?
no not safe, can social engineer for authentication information then pretend to be real employee to reset pword for personal gain.
TGT
Ticket granting Ticket: similar to a wrist band, allows communication to continue without re-authenticating
directory servers do what?
store info for security and employee contacts
LDAP?
Lightweight Directory Access Protocol: governs communication between directory servers and devices, including authentication servers.
AD?
microsoft organized directories
domain controller used or what?
controls the resources in a domain and is used allong with an AD active directory
what is trust when it comes to directory servers?
bi-directional (mutual)
-one way
Transitive: can trust others by learning from trusted servers.
Intransive: will not trust others, even when learned from trusted servers.
what is a metadirectory server?
connects several directory servers together.
how does one in security think about trust?
not as how much to trust but instead in terms of risk reduction or levels of risk.
In CobiT, entry must be ________.
justified
logged
Both justified and logged
Neither justified nor logged
Both justified and logged
The book recommends that passwords be at least ________ characters long.
8
Compared to access control based on individual accounts, RBAC is ________.
less prone to error
more expensive
Both less prone to error and more expensive
Neither less prone to error nor more expensive
less prone to error
Which of the following is one of the four bases for authentication credentials? Both What you know and What you have Neither What you know nor What you have What you know What you have
Both What you know and What you have
A ________ card stores authentication data.
magnetic stripe
smart
Both magnetic stripe and smart
Neither magnetic stripe nor smart
Both magnetic stripe and smart
if a provable attack packet is detected by firewall what happens?
it gets dropped.. drops packet
what is ingress filtering?
firewall examines packets entering the network from the outside.
what is egress filtering?
firewall scans ip packets that are leaving the network.
if a firewall becomes overloaded with traffic what does it do with packets?
drops packets it can not process.
