Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Information Security Management > Chapter 4: Identity and Access Management - Section A > Flashcards

Chapter 4: Identity and Access Management - Section A Flashcards

1
Q

Introduction: Identification and authentication is important because it establishes what?

A

User Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Introduction: What is the first line of defense for most systems

A

Identification and authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Introduction: Logical access can be implemented in a few ways (T or F)

A

False. It can be implemented in various ways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Introduction: Logical security is often determined based on?

A

The job function of the users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Introduction: The success of logical access controls is tied to the what?

A

Strength of the authentication method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Introduction: What is usually the form of authorization?

A

Signatures either physical or electronic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Introduction: The strength of the ________ is proportional to the quality of method used

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

System Access Permission: System access permission is the prerogative to act on a computer resources (T or F)

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

System Access Permission: Usually refers to an administrative privilege (T or F)

A

False. Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

System Access Permission: It is established, managed, and controlled at the physical and not logical level (T or F)

A

False. Both levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

System Access Permission: Logical system access controls built into what? Invoked by what? And Incorporated into what?

A

Operating system; Access control software, application programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

System Access Permission: Physical or logical system access to any computerized information should be on what basis?

A

Need to know/ least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

System Access Permission: What are the other considerations for granting access and must be used by IS auditors when determining the criteria for defining permissions.

A

Accountability and traceability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

System Access Permission: What are the four layers of logical security?

A
  1. Networks
  2. Platforms
  3. Databases
  4. Applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

System Access Permission: The four layers of security for system access provides what to information resources?

A

Greater scope and granularity of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

System Access Permission: Determine what layer of security is being described here

pervasive general
systems control over users authenticating into systems, system software

A

Network and platform layers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

System Access Permission: Determine what layer of security is being described here

generally provide a greater degree of
control over user activity within a particular business process by controlling
access to records, specific data fields and transactions

A

Database and application controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

System Access Permission: The information owner who’s responsible for the information should provide what? And handed over to who?

A

Written authorization for users; security administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

System Access Permission: Which principles should the IS auditor take into account when determining access to systems

A

Need to know, least privilege, SoD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

System Access Permission: Who implements logical access capabilities

A

Security Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

System Access Permission: Reviews of access authorization must be what? To ensure the validity

A

Evaluated regularly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

System Access Permission: Personnel and departmental changes, malicious efforts, and
just plain carelessness result in authentication creep (T or F)

A

False. Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

System Access Permission: What is a good practice when it comes to avoiding authorization creep

A

Integrating review of access rights with human resource processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

System Access Permission: Non Employees with access to corporate IS resources should also be held responsible for security compliance and be accountable for security breaches despite not being part of the organization (T or F)

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Mandatory and Discretionary Access Controls: are logical access control filters used to validate access credentials that cannot be controlled or modified by normal users or data owners;

A

Mandatory Access Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Mandatory and Discretionary Access Controls: MAC acts by default (T or F)

27
Q

Mandatory and Discretionary Access Controls: Controls that may be configured or modified by the users or data owners

A

Discretionary access controls

28
Q

Mandatory and Discretionary Access Controls: MACs only allow management to change the category of a resource (T or F)

A

False. Administrators ang dapat magpalit

29
Q

Mandatory and Discretionary Access Controls: MACs are extremely prohibitive in nature. Only those explicitly and implicitly stated in the access are allowed (T or F)

A

False. Only explicitly permitted are allowed

30
Q

Mandatory and Discretionary Access Controls: DACs cannot override MACs even if owners allow it (T or F)

A

True. DACs can never overried MACs

31
Q

Mandatory and Discretionary Access Controls: MACs are a good choice to enforce a middle level of critical security without possible exception, if
this is required by corporate security policies or other security rules. (T or F)

A

False. good choice to enforce ground level dapat

32
Q

are the primary means used to manage and protect information assets

A

Logical Access controls

33
Q

Logical Access: Logical access controls substantiate what?

A

The management designed policies and procedures

34
Q

Logical Access Exposures: technical exposures exist due to?

A

Accidental or Intentional exploitation

35
Q

Logical Access: What should the IS auditor analyze?

A

The effectiveness of logical access controls in achieving information security objectives

36
Q

Logical Access Exposures: Intentional exploitation might lead to?

A

Computer crime

37
Q

Logical Access Exposures: All computer crimes exploit technical exposures (T or F)

A

False. Not all computer crimes exploit technical exposures

38
Q

Logical Access Exposures: are the unauthorized activities
interfering with normal processing

A

Technical exposures

39
Q

Logical Access Exposures: Involves siphoning or leaking information out of the compute

A

Data Leakage

40
Q

Logical Access Exposures: data leakage may become undetected because it leaves the originical copy (T or F)

41
Q

Logical Access Exposures: Computer shutdown can be initiated online and via the internet (T or F)

42
Q

Logical Access Exposures: Which individuals can initiate a shutdown process

A

People who know a high-level log on ID

43
Q

Logical Access Exposures: What are the limitations of the High level log on ID security measures for computer shutdown

A

It is only effective if proper security access controls are in place

44
Q

Familiarization With the Enterprise’s IT Environment: For IS auditors to effectively assess logical access controls within their organization, they first need to

A

gain a technical and organizational understanding of the organization’s IT environment.

45
Q

Familiarization With the Enterprise’s IT Environment: Includes reviewing the?

A

Network, OS platform, database, and application security layers

46
Q

Paths of Logical Access: Points of entry to an organization can be through multiple avenues (T or F)

47
Q

Paths of Logical Access: When does a direct path of access (mainframe) happen?

A
  1. IS environment is under the direct control of the main systems
  2. Uses are locally known
  3. Well defined access profiles
48
Q

Paths of Logical Access: Direct access related to a LAN is simpler (T or F)

49
Q

Paths of Logical Access: The resources in a LAN have similar access paths (T or F)

A

False. Different paths

50
Q

Paths of Logical Access: What is the most common configuration?

A

A combination of direct, local, and remote.

51
Q

Paths of Logical Access: How do you increase the complexity?

A

Intermediate devices

52
Q

Paths of Logical Access: Examples of access path through common nodes are?

A

Back end and front end interconnected network

53
Q

Paths of Logical Access: Which is used for untrusted networks front or back end?

54
Q

Paths of logical access: Can front end networks be internally based?

55
Q

General points of entry: General points of entry control the access from

A

The organizations infrastructure to its information resources

56
Q

General points of entry: Connectivity in this environment needs to be controlled through a smaller set of __ ___ ___ (servers), which enable a user to obtain access to specific __ ___ __(e.g.,
application servers and databases)

A

primary domain
controllers

secondary points of entry

57
Q

General points of entry: The approach is based on

A

Client - Server model

58
Q

General points of entry: network management devices examples

A

Firewalls and routers

59
Q

General points of entry: Linking PC to an organization’s network infrastructure

A

Network Connectivity

60
Q

General points of entry: At a minimum, access to a segment of an organization’s network infrastructure needs?

A

Identification and authentication to a domain controlling server

61
Q

General points of entry: In remote access, complete access to view all network resources usually requires

A

Virtual Private Network

62
Q

General points of entry: Remote access points of entry can be extensive and should be ?

A

Centrally controlled

63
Q

General points of entry: Organization should know all the points of entry into the
information resource infrastructure (T or F)

64
Q

General points of entry: IS auditors should do what?

A
  1. IF all points of entry are identified
  2. Support management to identify all access paths

Information Security Management (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions