Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 3 - Access Control > Flashcards

Chapter 3 - Access Control Flashcards

0
Q

Access

A

The flow of information between subject and object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Access control

A

Used to restricted access and for authentication of access and ensures AIC on the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Subject

A

The requesting entity of an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Object

A

A passive entity that holds information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Identification

A

Proving someone is who they say they are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Authentication

A

A second piece to the credential set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Authorization

A

Being granted access based on your authenticated identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Accountability

A

Now that you have been authorized, you are now responsible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Logical access controls

A

Boolean operator controls, if authorized than access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Race Condition

A

Running authorization independent of authentication

Process 1 then 2

Hacker just runs two

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the factors of authentication?

A

Something a person knows, has, or is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Verification ratio

A

Used to see how many people are authenticated by the same token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Auth by knowledge

A

A password, a pin, a combination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Auth by ownership

A

Key, badge, access card

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Auth by characteristic

A

Biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Strong auth

A

2 factor auth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Mutual auth

A

This is when each side authenticates the other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

IdM

A

Identity management - controlling identitity in an environment for accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IDM meta directories

A

A virtual directory to aggregate identity data stored from HR/SQL/AD etc

This is primarily useful for non-ldap integrated systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What makes up X.500?

A

Directory structure standard

Must have a parent child tree
Each entry unique
Attributes defined in schema
Unique IDS called distinguished names

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Virtual directory

A

Similar to meta directories except it doesn’t know the answer .. It points to one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

WAM

A

Web access management

Web server receives auth req
Web server gets access approval
Sends back a session cookie
Browser used cookie in further security context

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cookie

A

Browser side data storage

Permanent- stored on the hard drive for later usage and access

Session- temporary token stored in memory for use with session state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Single sign on

A

Sign in once, as long as you use the cookie the server just sent to authenticate you are allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Password synchronization

A

Reduces number of passwords known by changing the multiple systems to the same password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Self-service password reset

A

Reduces help desk volume by allowing users to reset own password, or security questions and a click the link email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Assisted password reset

A

Two person password reset, ie. an authenticated help desk person changes it to changemenow and then the user is forced to reset that

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is an example of a bad security question ?

A

What is your mothers maiden name?

This is public information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Single sign on

A

One authentication to rule them all!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Account management

A

Automated construction and destruction of accounts on all necessary systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Authoritative source

A

The location of a record where it was written

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Identity repository

A

The centralized location of information regarding accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Authoritative system of record

A

A hierarchy that tracks changes to an environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

User provisioning

A

From hired to fired what happens to your account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Self-service

A

Users can change their own information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Federated

A

If you trust that guy, send me his authenticated session

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Digital identity

A

Made of

Attributes
Entitlements
Traits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Federated identity

A

This is the authenticated token being passed around

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Web portal

A

A site that contains multiple website feeds

Yahoo
Msn

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Portlet

A

This is an individual module that displays website information on a web portal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

XML

A

Extensible markup language

Used to standardize a way of communicating between platforms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

SPML

A

Service provisioning markup language

Request authority
Provisioning service provider
Provisioning service target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

SAML

A

Security assertion markup language

Used for passing authentication in a unified format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Web services

A

This is any site that provides a service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

SOAP

A

Simple object access protocol

A means to transmit markup language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

XACML

A

Extensible access control markup language

Used to communicate acl between services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Extensible

A

Means standardized really

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

OASIS

A

Organization keeping all the XML standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What makes XML standards different?

A

The schema

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the error types in biometrics?

A

1 - Failed on an authorized person

2 - Allowed an unauthorized person

50
Q

Crossover error rate or equal error rate?

A

The point where error % of both types match. 3% is better than 4%

51
Q

What causes type 2 errors to switch over to type 1 errors?

A

Sensitivity

52
Q

Replay attack?

A

When information is gather now and used later, ie a stolen password

53
Q

What ways can you steal a password?

A 
Electronic monitoring
Access the password database
Brute force attack
Dictionary attack
Social engineering
Rainbow table (hash table)
54
Q

What is last login messaging for?

A

To point out to the user when he last attempted a login to the system.

55
Q

Clipping level

A

Threshold

56
Q

What is the most effective way to steal passwords?

A

Rainbow tables

57
Q

How does someone make a password hash secure?

A

Salts - random characters entered into a password before hashing

58
Q

Cognitive passwords

A

Fact or opinion based question and answer

59
Q

Two types of synchronous tokens for one time password

A

Time synchronous
Counter synchronous

Encryption key is on device

60
Q

Counter-based is also called?

A

Event based

61
Q

Asynchronous token

A

Challenge is sent from server, token makes a password out of it using an algorithm and generates a OTP

62
Q

Digital signatures

A

Used to authenticate by pki

63
Q

Pass phrase

A

LongPhraseThatIsHardTocrackAndStealFrom

64
Q

Authentication memory card

A

A read only verification of who you are

An ATM card is used with a pin, the ATM card is a memory card

65
Q

Contact vs contact less smart card

A

Contact has a electrical contact pad that sends and receives IO

Contact less has an antenna that gets the IO

66
Q

What is fault generation?

A

Generating faults in a system to see of it feeds back any useful data

67
Q

Side channel attack

A

An attack where they are simple trying to figure out how it works..

Ie using electromagnets to see what kind of response a smart card gives you

68
Q

Microprobing

A

Tampering with a chip using ultrasonic and needleless techniques to get directly to the embedded ROM

69
Q

ISO 14443

A

Smart card standardization

70
Q

RFID

A

Radio frequency id

Low security due to low processing capabilities

71
Q

What can be used to set access controls?

A 
Role
Group
Location
Time
Transaction type
72
Q

Kerberos

A

Authentication methodology using shared secret keys

73
Q

KDC

A

Key distribution center - used to create and store the shared Kerberos keys

74
Q

Principles

A

Users, applications or services

Each one has it’s own shared secret

75
Q

How do tickets work?

A

A ticket granting service issues a ticket that is used to pass from one principle to another

76
Q

How does Kerberos work?

A
  1. User sends cress for auth…
  2. KDC sends password in a tgt
  3. Users entered password is used to get the tgt client side
  4. Access to another principle is request
  5. Tgt is generated with both principles passwords and tgt’s
  6. User pinciple sends sends this to the other principle which verifies it’s tgt and grants or denies access to user
77
Q

How is SESAME and Kerberos different?

A

Kereberos is strictly symetrical and SESAME is both asymetrical and symetrical

SESAME uses PACs to Kerberos Tickets

78
Q

GSS-API

A

Standard API used to programmatically use these authentication mechanisms in applications

79
Q

Thin client

A

A machine that stored no data

80
Q

Discretionary access control

A

I made it, I can access it, I control it

This is the windows model and allows for systems to runas a user context

81
Q

Non discretionary access?

A

A group policy is non discretionary because it is forced on the user

82
Q

Security or sensitivity labels

A

In a mandatory access model it is a security level assigned to a document. If you have that level of clearance the you can see it. For granularity the is also a need to know check

83
Q

Role based access control

A

The permissions are set to groups defined by job function rather than department or specific person

84
Q

What is the difference between static an dynamic separation of duties ?

A

Static is if part of x role than cannot be part of y as a member

Dynamic means the session itself and disallows the y functionality if logged in as x

85
Q

Rule based access

A

This is access based strictly on if then statements

86
Q

Constrained UI

A

Limiting the user interface to only what you want them to be able to do

87
Q

What is capability and acl?

A

Capability is what a user can do and acl is what an object allows

88
Q

Content dependent access

A

Packet sniffing web traffic is a great example, access decisions are based on the content you are trying to receive

Sensitivity based decisions

89
Q

Context dependent access

A

Access control that understand order of operations .. A firewall understand SYN must come before SYN/ACK

This prevents complex knowledge attacks. User can see A and B or A and C but not ABC

90
Q

AAA

A

Authentication, authorization, auditing

91
Q

Radius vs tacacs+

A

Radius is in clear, does not comply with AAA and uses UDP

Tacacs+ uses encryption complies with AAA and uses TCP

92
Q

Diameter

A

Twice the radius, it is a AAA protocol diversified for our complex protocol rich world. It is peer based rather than server client and superior in all ways

93
Q

Access control layers

A

Administrative
Technical
Physical

94
Q

Audit reduction tool

A

Used to parse out on specific information to reduce logs

95
Q

SEM/SIEM

A

Security event manager used for audit control

96
Q

Scrubbing

A

Deleting log events that show an attackers presence

97
Q

Object reuse

A

Thumb drives should be cleaned with 1/0 before someone else uses it, for example

98
Q

Emanation security

A

Electronics emanate electro-magnetic waves that can be caught and recreated

99
Q

TEMPEST

A

Used as a standard to shield electronics from emanating

100
Q

White noise

A

Random interference that overwhelms and overpowers useful information

101
Q

Faraday cage

A

A shielding

102
Q

Network IDS

A

Wire shark with NIC in promiscuous mode

103
Q

Host based IDS

A

Inner system object monitoring

104
Q

Types of IDS monitors

A

Signature - pattern/stateful

Anomalies - statistical/protocol/traffic/rule

105
Q

What is a signature?

A

A pattern

106
Q

What is being in the zoo

A

A virus that has not been released yet

107
Q

Misdirecting IDS

A

Send IDS systems on a goose chase while you sneak in the other way

108
Q

What is the difference between false positive and negative

A

Positive- flagging good traffic as bad

Negative- flagging bad traffic as good

109
Q

Icmp attacks

A

Icmp loaded with variables and payload

110
Q

Signature based IDS

A

Pattern matching
Stateful matching - compares sequences

Signatures must be updated
Cannot identify new attacks

111
Q

Anomaly based IDS

A

Behavior based on normal baseline
Can detect new attacks
Called behavioral/heuristic

Statistical - baseline vs now
Protocol - that packet is malformed
Traffic - why is this bandwidth spiking

112
Q

Rule based IDS

A

If/then rules
AI inference possible
Demanding
Cannot detect new attacks

113
Q

What makes a honeypot a legal issue?

A

The use of entrapment instead of enticement

Enticing - ports open, web page without ssl etc
Entrapment - giving a download link to the hacker and then charging him for hacking when all he did was use your link

114
Q

Sniffer

A

Used to analyze promiscuous packets on the network

115
Q

What is another name for hashing

A

Message digest

116
Q

Dictionary attack

A

Using known words vs a password to resolve the password

117
Q

Brute force

A

Trying every combination until a response is received

118
Q

What is a war dialer?

A

A phone dialer users to discover dialup modems

119
Q

Phishing

A

Sending requests for information through tricky websites and emails

Cannot trust the URL, JavaScript can replace with a legitimate site name

120
Q

Pharming

A

The use of fake web sites to pass credentials to, often using DNS poisoning

121
Q

DNS poisoning

A

Modifying the DNS response your machine receives to redirect to a black server

122
Q

Why is feeling secure with a solution dangerous?

A

Because you stop looking for security flaws

123
Q

Identity theft

A

Using someone’s identity to make non legitimate purchases, or generate false criminal records and warrants

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions