Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 14 > Flashcards

Chapter 14 Flashcards

1
Q

the access granted for an object that determine what you can do with it (read/edit/create/delete)

A

permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

the ability to take an action on an object

A

right

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

a combination of rights and permissions

A

privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

access control model that restricts access to data based on the content within an object

A

content-dependent control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

access control model that requires specific activity before granting users access

A

context-dependent control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

subjects are granted access only to what they need to know

A

need to know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

subjects are granted only the privileges they need

A

least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

access control model where every object has an owner and the owner can grant or deny access to other subjects

A

discretionary access control (DAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

access control model where roles or groups are used to assign permissions

A

Role-Based Access Control (RBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

access control model that applies global rules to all subjects (such as a firewall)

A

Rule-Based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

access control model where rules can include multiple attributes and apply differently to different subjects

A

Attribute-Based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

access control model where labels are applied to both subjects and objects (clearances)

A

Mandatory Access Control (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

access control model that grants access after evaluating risk based on machine learning

A

Risk-Based Access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

MAC classification where labels are ordered from low to high security

A

Hierarchical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

MAC classification where there is no relationship between security domains

A

Compartmentalized Environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

MAC classification that combines hierarchical and compartmentalized concepts

A

hybrid environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

this XML based standard is used to send authentication information within federated environments

A

SAML

18
Q

3 entities involved in SAML

A

principal or user agent
service provider (SP) - website
identity provider (IdP) - third party that authenticates user

19
Q

what are the three types of XML messages an IdP can send in SAML?

A

Authentication Assertion
Authorization Assertion
Attribute Assertion

20
Q

an authorization framework maintained by the IETF

A

OAuth 2.0

21
Q

Can you authenticate users with OAuth 2.0?

A

No, it is only authorization, not authentication

22
Q

this standard provides decentralized authentication and allows users to log into mulptiple websites with one set of credentials by providing a URI.

A

OpenID

23
Q

an authentication layer using the OAuth 2.0 framework - provides both authentication and authorization

A

OpenID Connect (OIDC)

24
Q

what does RFC 6749 describe?

A

OAuth 2.0

25
Q

which auth framework exchanges information using APIs?

A

OAuth

26
Q

which auth framework uses a JSON Web Token?

A

OIDC

27
Q

AAA protocol that uses ticket authentication

A

Kerberos

28
Q

what is the primary purpose of Kerberos

A

authentication

29
Q

what Kerberos element is the trusted third party that provides authentication services?

A

Key Distribution Center

30
Q

what Kerberos element hosts the functions of a ticket-granting service (TGS) and an Authentication Service (AS)?

A

Kerberos Authentication Server

31
Q

what kerberos element is an encrypted message that provides proof that a subject is authorized?

A

Ticket

32
Q

what Kerberos element provides proof that a subject has authenticated through a KDC, and includes a symmetric key, and expiration time, and the user’s IP address?

A

TGT Ticket-Granting Ticket

33
Q

What Kerberos element receives the tickets (usually a user)

A

Kerberos Principal

34
Q

what encryption standard does Kerberos use?

A

AES

35
Q

This remote authentication service uses UDP and only encrypts the password’s exchange by default

A

RADIUS

36
Q

how can RADIUS encrypt the entire session?

A

Using TLS over TCP with RADIUS/TLS

37
Q

this Cisco authentication service uses separate processes for authentication, authorization, and accounting

A

TACACS+

38
Q

what does TACACS+ encrypt

A

all of the authentication information

39
Q

an attacker steals credentials and can login as the user

A

impersonation attack

40
Q

when an attacker sends a captured hash of a password to an authenticating service

A

pass-the-hash

41
Q

Kerberos attacks

A

Overpass the Hash
Pass the Ticket
Silver Ticket
Golden Ticket
Kerberos Brute-Force
ASREPRoast
Kerberoasting

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions