Chapter 14 Flashcards
What are common authorization mechanisms ?
Implicit Deny
ACL
Access Control Matrixes
Capability Tables
Constrained Interfaces
Content Dependent Controls
Context Dependent Controls
What access control model is where all objects have owners that can modify permissions?
DAC
What is commonly referred to as a lattice based model and supports à compartmentalized and hierarchical environment?
MAC
What is an XML based standard used to exchange authentication and authorization information?
SAML
What is an authorization framework described in RFC 6749 and support by many online sites ?
OAuth 2.0
What maintains OpenID and OpenID Connect?
OASIS
What provides both authentication and authorization by using the OAuth framework and building on the OpenID standard?
OIDC
What sues symmetric cryptography and tickets to prove identification and provide authentication ?
Kerberos
What is the primary purpose of Kerberos ?
Authentication
What is a common SSO method within orgs?
Kerberos
What AAA protocol uses UDP and encrypts the password only ?
RADIUS
What AAA protocol uses TCP and encrypts the entire session?
TACACS+
What is based on RADIUS and improves many of the weaknesses of RAIDUS ?
Diameter
What is not compatible with RADIUS?
Diameter
What attack allows an attacker to impersonate a user with the captured hash of a user’s password ?
Pass-the-hash
What type of ticket grants an attacker all the privileges granted to a service account ?
Silver Ticket
What are some algorithms that add salt to passwords ?
Argon2
Bcrypt
PBKDF2
What is a large constant number used to increase the security of a hashed password further and is stored outside the database holding the passwords?
Pepper
What can prevent users from logging on within a Kerberos environment ?
NTP Synchronization
What uses a JSON Web token to provide authentication and profile information for internet based SSO?
OIDC
