Chapter 2: Authentication and Authorization

Question 1

What are the three steps to access control?

Answer 1

• Identification
• Authentication
• Authorization

Question 2

Access Control Process

During the first step of the process, {BLANK}, an individual makes a claim about their identity.

Answer 2

Identification

Question 3

Together, the activities performed ny an access control system are referred to as AAA, or “triple-A”.

What does the three A’s stand for?

Answer 3

Authentication, authorization, and accounting

Question 4

Access Control Process

During the {BLANK} step, the individual proves thair identity to the satisfaction of the access control system.

Answer 4

Authentication

Question 5

Access Control Process

The access control system also needs to be satisifed that you are allowed to access the system. This is the third step of the process called {BLANK}.

Answer 5

Authorization

Question 6

Access Control Process

In addition to indentication, authentication, and authorization, access control systems also provide an {BLANK} functioanlity that allows administrators to track user activity and reconstruct it from logs.

Answer 6

Accounting

Question 7

In the electronic world, authorization often takes the form of {BLANK} that itemize the specific file system permissions granted to an individual user or a group of users.

Answer 7

Access Control Lists

Question 8

The simplest and most common control on passwords is setting the {BLANK}.

Answer 8

password length

Question 9

Organizations may also set {BLANK} requirements. These requirements force users to include different types of characters in their passwords, such as uppercase and lowercase, digits, and special characters.

Answer 9

password complexity

Question 10

{BLANK} requiremts force users to change their passwors periodically.

Answer 10

password expiration

Question 11

{BLANK} requirements are designed to prevent users from reusing old passwords.

Answer 11

password history

Question 12

What are the three authentication factors?

Answer 12

• Something you know
• Something you are
• Something you have

Question 13

Authentication Factors

What is considersomething you know?

Answer 13

Passwords, Personal Identification Numbers (PINs), and answers to security questions.

Question 14

Authentication Factors

What is considersomething you are?

Answer 14

Fingerprint, eye pattern, face, or voice.

Question 15

{BLANK} authentication techniques measure one of your physical characteristics.

Answer 15

Biometric

Question 16

Authentication Factors

What is considersomething you have?

Requires the user to have physical possession of a device.

Answer 16

• Smartphone running a software token application
• Hardware authentication token key fob
• Smart cards

Question 17

The access control process consists of three major steps. {BLANK} is when a user makes claim of identity. {BLANK} is when the user proves that identity claim. {BLANK} is when the system determines whether the user is allowed tp perform a requested action.

Answer 17

Identification; Authentication; Authorization

Question 18

{BLANK} processes create a record of who performed which actions on a system and are useful when investigating security incidents.

Answer 18

Accounting

Question 19

{BLANK} combines at least two of the thre factors: something you know, something you have, and something you are.

Answer 19

Multi-factor Authentication (MFA)

Question 20

Password {BLANK} requirements set a minimum number of characters that must be in a user’s password, whereas password {BLANK} requirements mandate the use of different character types.

Answer 20

length; complexity

Question 21

Password {BLANK} requirement prevent the reuse of old passwords, whereas password {BLANK} requirements force the periodic reset of existing passwords. Users should be permitted to reset their passwords whebevr they wish.

Answer 21

history; expiration

Question 22

Users should be encouraged not to {BLANK} passwords across multiple sites, as this increases the risk of compromise. Password {BLANK} provides a convenient tool for managing many unique, strong passwords.

Answer 22

reuse; managers

Question 23

You are considering deploying a multi-factor authentication system to protect access to your organization’s virtual private network (VPN). Which one of the following combinations of access controls would meet this requirement?

A. Password and PIN
B. Fingerprint and eye scan
C. Smart card and fingerprint
D. Key fob and smart card

Answer 23

Smart card and fingerprint

Question 24

Andy is attempting to change his password and has created the following long password:

p7djkqnr2LAD

He recieves an error message that he must use a symbol in his password. Which password policy is he failing to meet?

A. Password length
B. Password history
C. Password complexity
D. Password reuse

Answer 24

Password complexity