Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

► CISSP CBK > Chapter 1 - Access Control > Flashcards

Chapter 1 - Access Control Flashcards

1
Q

Access Controls encompass all operational levels of an organization.

A

Facilities; Support Systems; Information Systems; and Personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

C-I-A

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Two Philosophies for Access Control

A

Allow by Default and Deny by Default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Defense in Depth Strategy

A

Applying multiple layers of security protection between an information resource and a potential attacker.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Three step process for determining access controls

A
  1. Defining Resources 2. Determining Users 3. Specifying the Users use of the resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Consistent Access Control Strategy

A

Simplicity is the key to an effective security system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Separation of Duties

A

Primary Objective is the prevention of fraud and errors. Distributing tasks and associated privileges for a specific process among multiple people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Processes

A

Collection of tasks that must be performed to achieve an objective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Applicabililtiy of Separation of Duties

A

Sensitivity of the function under consideration; and the elements within a function are prone to abuse, which are easily segmented, and what skills are available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Least privilege

A

User is given no more access priviliege than necessary to perform a job, task, or function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Need to know

A

Defines the minimum needed to know to perform job function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Compartmentalization

A

Seperating groups of people and information such that each group is isolated and information does not flow between groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security domain

A

Area where common process and security control work to separate all entities involved in these processes from other entities or security domains.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Information Classification

A

Objective is to group an organization’s information assets by levels of sensitivity and criticality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Information Classification Program

A
  1. Determine objectives 2. Establish organizational support 3. Develop policy and supporting procedures 4. Develop process flows and procedures 5. Develop tools to support 6. Identify process and application owners 7. Identify information owners and delgates 8. Distribute standard templates 9. Classify information and applications 10. Develop auditing procedures 11. Load classification information into a central repository 12. Train users. 13. Periodically review and update information classifications.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Access Control System Requirements

A

Reliability, Transparency, Scalability, Integrity, Maintainability, Authentication Data Security, and Auditability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Main Categories of Access Control

A
  1. Directive - apply rules 2. Deterrent - discourage violations 3. Preventitive - prevent incident 4. Compensating - mitigate risk 5. Detective - signal warning when breached 6. Corrective - remedy circumstance 7. Recovery - restore conditions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Access Control Types

A
  1. Administrative Controls - define roles, responsibilities, policies, and administrative functions. 2. Logical (Technical) controls - electronic hardware and software solutions implemented to control access to information and information networks. 3. Physical Controls - protect physical environment - locks, gates, guards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Major Groups of Administrative Controls

A
  1. Policies and Procedures 2. Personnel Security, evaluation and clearances 3. Security policies 4. Monitoring 5. User management 6. Privilege management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

BCP/DRP

A

Business continuity plan/disaster recovery plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RADIUS

A

Remote Authentication Dial In User Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Major Groups of Logical Controls

A
  1. Network Access 2. Remote Access 3. System Access 4. Application Access 5. Malware Control 6. Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Discretionary Access Controls (DACS)

A

Controls placed on data by the owner of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Mandatory Access Controls (MACS)

A

Controls determined by the system and based primarily on organizational policy. Data needs to be labeled as to its classification. Access permissions are applied to an object based on the level of clearance given to a subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Nondiscretionary Access Control

A

Based on assignment of permissions as defined by the administrator of a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Access Control Matrix

A

An access control list in the form of a table - showing what permissions a user has for various system objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Rule-based Access Control

A

Specifies the privileges granted to user s(e.g read, write) when the specific condition of a rule is met - e.g. the time a certain file can be accessed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Role-based Access Control

A

Based on job function - objects associated with a role will inherit privileges assigned to that role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

RBAC

A

Non-RBAC - user granted access Limited RBAC - users mapped to roles within a single application Hybrid RBAC-role applied to multiple applications or systems, but instances wheresubjects assigned to roles defined within an application FUll RBAS - roles defined by organizational policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Content Dependent Access Control

A

Based on content of data not roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Constrained User interface

A

Restricting users to specific functions based on their role in the system - e.g. limiting menus, data views, encryption, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Capability Tables

A

Used to match subjects and their capabilities - read, write

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Temporal Isolation

A

Activities may be restricted on when they can be performed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Identification

A

Assertion of a unique identity for a person or system and is the starting point of access control. - Uniqueness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Authentication

A

The process of verifying the identity of the user - Validity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Authorization

A

Process of defining the specific resources a user needs and determining the type of assess to those resources the user may have. - Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

MAC Address

A

Media Access Control - 48-bit number - machine address - now can be set in software so no longer can be considered a strong identifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

IP Address

A

Logical location of a device on the IP network - assigned in software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

RFID

A

Radio Frequency Identification - small label that can be embedded in almost any object - they can be read from a distance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Email Address

A

globally unique - enforced by convention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

User Identification Guidelines

A

User identification must be unique; user identification should be non-descriptive and disclose as little as possible about the user; user identification must be secure; and the final process must be logged and documented so that it can be verified and audited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Identity Management

A

refers to a set of technologies intented to offer greater efficiency in the management of a diverse user and technical environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Challenges for Identity Management Solutions

A

Consistency; usability; reliability; and scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Centralized Access Control Systems

A

RADIOS and TACACS+(Terminal Access Controller Access-Control System Plus)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Authentication Methods

A

By knowledge (knows); by possession (has); by characteristic (is); and geolocation (where)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Single - factor authentication

A

user id and password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Two - factor authentication

A

user id, password, and fob

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Three - factor authentication

A

user id, password, fob, and biometric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Secure passwords

A

typically hashed; a hash function takes an arbitrary amount of data as input and, through the use of a mathematical algorithm, will produce a unique, fixed-length representation of the data as output. Hash is a one-way function.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Authentication by Posession

A

Asynchronous token - challenge response technology; sychronous is based on an event, location, or time based sychronization between the requestor and the authenticator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Memory Card

A

Holds information but cannot process information. e.g users swipes card and enters a PIN. Data stored on the card is not protected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Smart Card

A

Embedded semiconductor chip that accepts, stores and sends information.ICC (integrated circuit card). Based on ISO 7816-2 there are 8 electrical contacts - six are currently used. Can be used in Proximity of a reader.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Biometrics

A

Physical (finger print) and behavioral (voice pattern). Most common -finger prints. tend to provide higher security than other methods - higher strength

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Hand Geometry

A

tension in the tendons, temperature, finger length, bone length, and hand width.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Palm Scans

A

combination of hand geometry and fingerprint analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Face Individuality

A

Iris, Retina (blood vessels back of the eye), entire face (facial geometry and heat signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Vascular Scan

A

veins in hands or face - relatively new

58
Q

Keystroke Dynamics

A

stroke speed, acceleration, deceleration and pen pressure

59
Q

False Reject Rate

A

when authorized users are falsely rejected

60
Q

False Acceptance Rate

A

when unautorized users are falsely accepted

61
Q

CER

A

Crossover Error Rate - amount to adjust sensitivity and maximul acceptable level of change - organization will need to determine based on its overall risk tolerance

62
Q

Session Management

A

single instance of identification and authentication are applied to resources

63
Q

Session hijacking

A

A form of “man in the middle” attack

64
Q

Accountability

A

ability to determine who or what is responsible for an action and can be held responsible

65
Q

Repudiation

A

is the ability to deny an action, event, impact or result

66
Q

Password management

A

Require users to change passwords, lockout mechanisim, self-registration process aids

67
Q

Account Management Systems

A

Central facility, workflow, automatic replication, facility for loading batch changes, automatic creation, change, or removal of access to system resources

68
Q

Profile Management

A

collection of information associated witha particular identity or group.

69
Q

Directory Management

A

centralized collection of user data

70
Q

Directory Technologies

A

X.500, LightWeight Directory Access Protocol (LDAP), Active Directory and X.400

71
Q

X.500

A

developed by the Interantional Telecommunications Union (ITU-IT) - initially worked with OSI to operates over TCP/IP as well. 4 protocols: Directory Access Protocol, Directory system protocol, directory information sharing protocol, and the directory operational binding management protocol. Hierarchial database with a key field of distinguished name (DN)

72
Q

LDAP

A

Provides simpler implementation - hierarchial, operates in client/server architecture, typically runs over unsecured network using TCP port 389. Version 3 of LDAP - suports TLS to encrypt or use of TCP port 636 over an SSL connection

73
Q

Active Directory

A

LDAP for Micorsoft-based environments, provides central authentication and authorization capabilities - organized in forest and trees - forest is a collection of all the objects and their associated attributes and trees are logical groupings of one or more AD security domains within a forest. Domains are identified by their DNS name. Objects are grouped by Organizational units.

74
Q

X.400

A

ITU-T guidelines for exchange of e-mail - known as messaging handling system. Supports message transfer and message storage - supplanted in recent years by SMTP

75
Q

Single Sign-on

A

SSO reduced sign-on or federated ID management - script based single sign-on - aids with leagacy technology

76
Q

Kerberos

A

three-headed dog: authentication, authorization, and auditing. Security system using secret key cyrptography - users must have a unique ID for each application on the network. 4 requirements for access control - security, reliability, transparency, scalability. Based on symmetrical encryption and a secret key shared amongst the participants. Primary goal is to ensure private communiocations between systems over a network,

77
Q

Kerberos Process

A

interaction between three systems: requesting system, the endpoint destination server, and the Kerberos or Key distribution center (KDC). Time-sensitive

78
Q

KDC

A

serves two functions during the authentication transaction: as an authentication sever and as a ticket-granting server. Maintains database of the secret keys of all the participants

79
Q

Realm key

A

a common key used for intitial trusted communication - then unique key is created to support future communications - common to use a hash of the user’s password as the unique user key

80
Q

TGT

A

Ticket granting ticket - user will receive once authenticated with AS along with session encryption key

81
Q

Secure European System for Application in a Multi-Vendor Environment (SESAME)

A

offers single sign-on services and uses both symmettic and asymmetric cryptographic techniques Key attributes: single sign-on,role based access control, use of privileged attribute certificate (PAC), use of Kerberos Version5 protocol to access SESAME components, use of public key cryptography for distribution of secret keys

82
Q

Web Accessed Management

A

WAM - replace sign-on process in affiliated WEB applications, typically by using a plug-on service on the Web server hosting the portal to the member applications.

83
Q

Federated Identity Managment

A

Each organization subscribes to a common set of policies, standards, and procedures for the provisioning and managment of user identification, authentication, and suthorization information, as well as a common process for access control for systems these users must access. Uses cross-certification model for trust but once it goes beyond a small number it becomes very complex. Use of a third party bridge model is an alternative to the cross-sertification model.The third party is considered trust worthy - good for a large number of organizations.

84
Q

OIUA

A

once in unlimited access

85
Q

Auditing Events

A

Network events, System events, Application events, User Actions, and Keystrole Activity

86
Q

Unix System Keystroke Activity

A

logging files are found in the user’s $HOME directory with names like “.history”, “sh_history”

87
Q

IDS

A

Intrusion detection system - part of a network device or dedicated device - does not take any action on the problem. Considered network monitoring

88
Q

IPS

A

Intrusion prevention system - will take proactive prevention action - responds in real time to an event at the system or network layer. Considered an access control.

89
Q

SIEM

A

Security Information and Event Management - aggregates information about access controls and selected system activity to store for analysis and correlation.

90
Q

Denial of Service

A

DoS - consumption of resources preventing useful processesing and interrurption of network resources to preventing communication rendering a system unusable - SYN floods - attackers makes an overwhelming number of session initiation requests - TCP/IP protocol

91
Q

Tear Drop

A

exploits how operating systems managed fragmented IP packets - overlap fragmented packets causing a flaw in the system - shutting it down

92
Q

DDoS

A

Distributed denial of service - attacks a server from thousands of locations

93
Q

Buffer overflows

A

buffer temporarily stores information for processing - an attack manipulates the system’s ability to manage its buffers. - Can also be used to inject malicious code - used to gain unauthorized access or to escalate privileges.

94
Q

Mobile Code

A

transmitted across network from remote source - ActiveX controls, Java applets, Java Script code from a Web page and HTML based email

95
Q

Malicious software

A

Virus - parasitic code which attaches itself to another program; worm - self-propogating code; trojan horse - appear desireable but contain something harmful; spyware - used to deploy malware, collect private data, send advertising;

96
Q

Password crackers

A

if attacker has obtained hashed password file using brute force attacks to compare combinations

97
Q

Martin Hellman

A

developed public key cryptography with Whitfield Diffie

98
Q

Phillip Oechslin

A

faster method of organizing hased chain - rainbow chain

99
Q

Spoofing/Masquerading

A

With IP protocol alter source to a trusted IP - remove the assurance that a person is dealing with a trusted entity.

100
Q

Kevin Mitnick

A

popularized tecnique of IP spoofing

101
Q

sniffers

A

collection information from a communication medium like a network

102
Q

Emanations

A

proliferation of electromagnetic signals given off by electronic devices

103
Q

Tempest

A

late 1960s - Government program studies compromising emanations - equipment should be located in center of building possibly protected by a Faraday cage (wrapped in wire mesh) - restricts signal leakage

104
Q

Shoulder surfing

A

direct observation - seeing a password typed in

105
Q

Object Reuse

A

residual data should be cleared - print only one user’s output at a time

106
Q

Data remanence

A

remains of partial data or even the entire set of digital information

107
Q

FAT

A

File allocation table maintains physical location and often when files are deleted the information is removed form the FAT but the actual data is still residing on the drive.

108
Q

Slack space

A

space at the end of a file - it can be used by hacker’s to store information

109
Q

Data mining

A

act of collecting and analyzing large quantities of information to determine patterns of use of behavior and use those patterns to form conclusions

110
Q

Dumpster diving

A

taking what peopl assume is trash - cross cut shredders are more effective

111
Q

Backdoors and Trap doors

A

special access capabilities put in by developer

112
Q

Logic bombs

A

results of attacks can be delayed for a long period of time - logical progression of events before they unleash theri aggression.

113
Q

Theft

A

physical theft - anything o f value can be removed, digital theft - copies of data

114
Q

Social Engineering

A

practice of misdirection to obtain information through social contact

115
Q

Threat Modeling

A

using scenario analysis with knowledge of threats and vulnerabilities to help determine what risks ares present in a system or application and where to apply resources to ensure the best mitigation for the value

116
Q

Formula for risk

A

impact vs. likelihood

117
Q

Asset Valuation

A

Hardware, Software, Integration, Opportunity COst, Regulatory exposure (Civil/Criminal), Information replacement, reputational exposure

118
Q

SLE=AV x EF

A

Single loss expectancy = asset value x exposure factor (estimate how much an asset will decline %wise)

119
Q

ALE= SLE x ARO

A

Annualized loss exposure = single loss expectancy x Annualized rate of occurrence

120
Q

Penetration Test methodology

A

reconnaissance, enumeration, vulnerability analysis,execution, document findings

121
Q

Identity and Access Provisioning Life Cycle

A

Provisioning, Review, Revocation

122
Q

A preliminary step in managing resources is A. Conducting a Risk Analysis B. Defining who can access a given system or information C. Performing a business impact analysis D. Obtaining top management support

A

B. Defining who can access a given system or information

123
Q

Which best describes Access controls? A. Access controls are a collection of technical controls that permit access to authorized users, systems, and applications B. Access controls help protect against threats and vulnerabilities by reducing exposure to unauthorized activities an providing access to information and systems to only those who have been approved C. Access Control is the employment of encryption solutions to protect authentication information during log-on D. Access Controls help protect against vulnerabiliteis by controlling unauthorized access to systems and information by employees, partners and customers

A

B. Access controls help protect against threats and vulnerabilities by reducing exposure to unauthorized activities an providing access to information and systems to only those who have been approved

124
Q

_____ requires that a user or process be granted access to only those resources necessary to perform assigned functions A. Discretionary Access Control B. Separation of Duties C. Least Privilege D. Rotation of Duties

A

C. Least Privilege

125
Q

What are the 7 main categories of access control? A. Detective, Corrective, monitoring, logging, recover, classification, and directive B. Directive, deterrent, preventative, detective, corrective, compensating and recovery C. Authorization, identification, factor, corrective, privilege, detective, and directive D. Identification, authentication, authorization, detective, corrective, recovery, an directive

A

B. Directive, deterrent, preventative, detective, corrective, compensating and recovery

126
Q

What are the three types of access controls? A. Adminstrative, Physical and technical B. Identification, authentication, and authorization C. Mandatory, discretionary, and least privilege D. Access, management, and monitoring

A

A. Adminstrative, Physical and technical

127
Q

WHich approach revolutionized the process of cracking passwords? A. Brute Force B. Rainbow table Attack C. Memory tabling D. One-time Hashing

A

B. Rainbow table Attack

128
Q

What best describes two-factor authentication? A. A hard token and a smart card B. A user name and a pin C. A password and a pin D. A pin and a hard token

A

D. A pin and a hard token

129
Q

A potential vulenrabilty of kerberos authentication server is A. Single Point of Failure B. Asymmetric key compromise C. Use of dynamic passwords D. Limited lifetimes for authentication credentials

A

A. Single Point of Failure

130
Q

In mandatory access control the system control access and the owner determines A. Validation B. Need to know C. Consensus D. Verification

A

B. Need to know

131
Q

Which is the least significant issue when considering biometrics? A. Resistance to counterfeiting B. Technology type C. User acceptance D. Reliability and Accuracy

A

B. Technology type

132
Q

Which is a fundamental disadvantage of biometrics? A. Revoking credentials B. Encryption C. Communication D. Placement

A

A. Revoking credentials

133
Q

Role based access control A. Is unique to mandatory access control B. Is independent of owner input C. Is based on user job function D. Can be compromised by inheritance

A

C. Is based on user job function

134
Q

Identity management is A. Another name for access controls B. Technologies and processes intended to offer greater efficiency in the management of a diverse user and technical environment C. Technologies and processes focused on the provisioning and decommissioning of user credentials D. Technologies and processes used to establish trust relationships with disparate systems

A

B. Technologies and processes intended to offer greater efficiency in the management of a diverse user and technical environment

135
Q

A disadvantage of single sign on is A. Consistent time-out enforcement across platforms B. A compromised password exposes all authorized resources C. Use of multiple passwords to remember D. Password change control

A

B. A compromised password exposes all authorized resources

136
Q

Which of the following is incorrect when considering privilege management? A. Privileges associated with each system, service or application and the defined roles within the organization to which they are needed, should be identified and clearl documented B. Privileges should be managed based on least privilege. Only rights required to perform a job should be provided to a user, group or role C. An authorization process and a record of all privileges allocated should be maintained. Privileges should not be granted until the authorization process is complete and validated D. Any privileges that are needed for intermittent job functions should be assigned to multiple user accounts, as opposed to those for normal system activity related to the job function

A

D. Any privileges that are needed for intermittent job functions should be assigned to multiple user accounts, as opposed to those for normal system activity related to the job function

137
Q

Threat modeling is the process of A. Determining which threats to neutralize first B. Developing access controls that compensate for the vulnerabilities C. A risk assessment approach in whihc decisions are based on risk and value D. Scenario analysis targeted towards determining the best approach for threat elimination

A

C. A risk assessment approach in whihc decisions are based on risk and value

138
Q

When reviewing user entitlement the security professional must be most aware of A. Identify management and disaster recovery capability B. Business or organizational processess and access aggregation C. The organizational tenure of the user requesting entitlement D. Automated processes which grant users access to resources

A

B. Business or organizational processess and access aggregation

139
Q

Which formula represents ALE or annual loss exposure? A. ALE = SLE * ARO B. SLE = ARO * ALE C. SLE = SRO * EF D. ALE = EF * SLE

A

A. ALE = SLE * ARO

140
Q

In constructing a continuous monitoring system, numerous feeds from several systems must be correlated and analyzed. Which of the following best provides the capability? A. Intrusion Prevention System B. Identity Management and Access Control System C. Intrusion Detection System D. Security Information and Event Management

A

D. Security Information and Event Management

141
Q

A guard dog patrolling the perimeter of a data center is what type of control? A. Recovery B. Administrative C. Logical D. Physical

A

D. Physical

► CISSP CBK (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions