Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

► Security+ > Chapter 4: Access Control, Authentication, and Authorization > Flashcards

Chapter 4: Access Control, Authentication, and Authorization Flashcards

1
Q

Identification

A

Finding out who someone is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Authentication

A

Verifying identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Out-of-band Authentication

A

The system you are authenticating gets info from public records and asks you questions to help authenticate you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SFA

A

Single Factor Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Mutual Authentication

A

Multiple parties authenticating each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Layered Security/Defense in Depth

A

You should implement multiple layers of security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Operational Security

A
  • Focuses on how an organization achieves its goals.

- Everything not related to design or physical security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Security Token

A
  • Similar to certificates, it is a small piece of data that holds a sliver of info about the user.
  • Authentication system creates the token every time a user connects or when a session begins, and deletes it when they end.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Federation

A

A collection of computer networks that agree on standards of operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Federated Identity

A

Allows a user to have a single identity that they can use across different business units or businesses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Transitive Access

A

If A trusts B and B trusts C then A trusts C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Shiva Password Authentication Protocol (SPAP)

A

Like PAP, but encrypts username and password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Challenge Handshake Authentication Protocol (CHAP)

A
  • Designed to stop man-in-the-middle attacks

- Periodically asks the client for authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Time-Based One-Time Password (TOTP)

A

Uses a time-based factor to create unique passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Usual minimum password length

A

8 characters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Generic Account

A

An account that is shared

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SLIP

A

One of the first remote authentication protocols, which should not be used now

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PPP

A
  • No data security, but uses CHAP
  • Authentication handled by Link Control Protocol (LCP)
  • Encapsulates network traffic with Network Control Protocol (NCP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

RADIUS server

A

Allows authentication of remote and other network connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

TACACS+

A

Similar to RADIUS, authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Security Assertion Markup Language (SAML)

A

Open standard based on XML used for authentication and authorization

22
Q

Lightweight Directory Access Protocol (LDAP)

A

Allows queries to be made of directories

23
Q

Key Distribution Center (KDC)

A
  • Authenticates a user, program, or system and provides it with a ticket used to show it has been authenticated.
  • Used in Kerberos
24
Q

Ticket Granting Ticket (TGT)

A

The ticket given by the KDC, listing the privileges of the user.

25
Q

Mandatory Access Control (MAC)

A
  • All access is predefined

- Considered most secure

26
Q

Discretionary Access Control (DAC)

A

Incorporates some flexibility, allowing someone with certain permissions to allow someone without the permissions to see stuff

27
Q

Role-Based Access Control (RBAC)

A

Implements access by job function or by responsibility.

28
Q

Rule-Based Access Control (RBAC)

A

Use an ACL to deny all but those who appear in a list, or deny only those that appear in a list.

29
Q

Access Review

A

A process to determine whether a user’s access level is still appropriate.

30
Q

Continuous Monitoring

A

Ongoing audits of what resources a user actually accesses

31
Q

Thin Clients

A

Don’t provide any disk storage or removable media, and rely on servers to use applications and data.

32
Q

Common Access Card (CAC)

A

Issued by the DoD as a general identification/authentication card.

33
Q

Personal Identity Verification Card (PIVC)

A

A card specific to that one person, used in high up government stuff.

34
Q

3 Firewall Rules

A

1) Block the connection
2) Allow the connection
3) Allow the connection only if it is secured

35
Q

802.1X

A
  • Port-based security

- AKA EAP over LAN (EAPOL)

36
Q

Loop Protection

A

Intended to prevent broadcast loops

37
Q

Spanning Tree Protocol (STP)

A

Intended to ensure loop-free bridged Ethernet LANs

38
Q

Network Bridging

A
  • When a device has multiple NICs and the opportunity presents itself to jump between them.
  • We don’t want it on common man’s machines, so disable it!
39
Q

Trusted Operating System (TOS)

A

Any OS that meets the government’s requirements for security.

40
Q

Common Criteria (CC)

A

Security evaluation criteria specified by the collaboration between a few countries.

41
Q

Evaluation Assurance Level (EAL)

A

How the criteria is broken down in CC

42
Q

EAL 1

A

Wants assurance that the system will operate correctly, but not very concerned with security

43
Q

EAL 2

A

Requires product developers to use good design practices.

44
Q

EAL 3

A

Requires conscientious development efforts to provide moderate levels of security

45
Q

EAL 4

A
  • Requires positive security engineering based on good commercial development practices.
  • The recommended level for commercial systems
46
Q

EAL 5

A

Requires special design considerations for high levels of security

47
Q

EAL 6

A

High levels of protection against significant risks

48
Q

EAL 7

A

Extremely high levels of security requiring extensive testing

49
Q

Type 7

A

Weak encryption password type used in routers

50
Q

MD5

A

The stronger password type used in routers

► Security+ (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions