Chapter 5 Identity and Access Management Flashcards
What is a capabilities table?
Capabilities tables list the privileges assigned to subjects and identify the objects that subjects can access.
Which of the following is NOT a weakness in Kerberos?
a) The KDC is a single Point of failure
b) Compromise of the KDC would allow attackers to impersonate any user
c) Authentication information is not encrypted
d) Susceptible to password guessing
C) Kerberos encrypts messages using secret keys providing protection for authentication traffic.
Place the following in order for Kerberos authentication process
a) Client/server ticket generated
b) TGT generated
c) Client/TGS key generated
d) User accesses service
e) User provides authentication credentials
1) User provides authentication credentials
2) Client/TGS key is generated
3) TGT generated
4) Client/server ticket generated
5) User accesses service
Callback to a landline phone number is an example of what type of a factor?
a) Something you know
b) Somewhere you are
c) Something you have
d) Something you are
b) A callback to a landline phone number is an example of a “somewhere you are” factor because the fixed physical location of a wird phone. A callback to a mobile phone would be “something you have”
Scott needs to set up an AD trust to allow authentication with an existing Kerberos K5 domain. What type of trust does he need to create?
a) Shortcut trust
b) Forest trust
c) External turst
d) Realm trust
D) Kerberos uses realms, and the proper type of trust to set up for an AD environment that needs to connect to a K5 domain is a realm trust.
When a client sends a username and password to the KDC, how is the username and password protected?
a) 3DES encryption
b) TLS encryption
c) SSL encryption
d) AES encryption
D) The client in Kerberos uses AES to encrypt the username and password prior to sending it to the KDC
What two important elements does the KDC send to the client after verifing the username is valid?
a) An encrypted TGT and a public key
b) An access ticket and a public key
c) An encrypted, time stamped TGT and a symmetric key encrypted with a hash of the user’s password
d) An encypted, time stamped TGT and an access token
C) The KDC uses the user’s password to generate a hash and then uses that hash to encrypt a symmetric key and an encrypted time-stamped TGT to the client
What tasks must the client perform before it can use the TGT?
It must accept te TGT and decrypt the symmetric key
Biba is what type of access control model?
a) MAC
b) DAC
c) Role BAC
d) ABAC
A) Biba uses a lattice to control access and is a form of the MAC model. IT does not use rules, roles, or attributes, nor does it allow user discretion
Which of the following is a client/server protocol designed to allow network access servers to authenticate remote users by sending access request message to a central server?
a) Kerberos
b) EAP
c) RADIUS
d) Oauth
c) Radius is an AAA protocol used to provide authentication and authorization; it is often used for modems, wireless networks, and network devices. IT uses netwrok access servers to send access requests to central Radius Servers
What is a resource-based access control?
Resource-based access controls match permissions to resources like a storage volume. Resource-based access controls are becoming increasingly common in cloud-based infrastructure as a service environments.
Scott uses a sniffer to monitor traffic from a RADIUS server configured with default settings. What protocol should he monitor and what traffic will he be able to read?
a) UDP, none. All Radius traffic is encrypte
b) TCP, all traffic but the passwords, which are encrypted
c) UDP, all traffic but the passwords, which are encrypted
d) TCP, none. All RADIUS traffic is encrypted
C) By default, RADIUS uses UDP and only encrypts passwords. RADIUS supports TCP and TLS, but this is not a default setting
Which of the following is not part of Kerberos authentication system?
a) KDC
b) TGT
c) AS
4) TS
D) A Key Distribution Center (KDC) provides authentication services, and ticket-granting tickets (TGTs) provide proof that a subject has authenticated and can request tickets to access objects. Authentiction services (ASs) are part of the KDC. There is no TS in a Kerberos infrastructure.
What is race conditions?
Race conditions occur when two or more processes need to access the same resource in the right order
Which of the following is not a valid LDAP DN (distinguished name)
a) cn-ben+out-sales
b) ou=example
c) cn=ben,out=example;
d) ou=example, dc=example, dc=com+dc=org
C) LDAP distinguished names are made up of zero or more comma-separated components known as relative distinguished names. CN=ben,ou=example; ends with a semicolon and is not a valid DN
What is the stored sample of a biometric factor called? A) Reference Template b) Token store c) Biometric password d) Enrollment artfifact
A) The stored sample of a biometric factor is called a reference profile or a reference template.
Scott is working to imrpvoe the strength of his organization’s passwords by changing the password policy. The password system that he is using allows for uppercase and lower case letters as well as numbers, but no characters. How much additional complexity does adding a single character to the minimum length of passwords for her organization create?
a) 26 times more complex
b) 62 times more complex
c) 36 times more complex
d) 2 to the 62 power more complex
b) The complexity of brute-forcing a password increases based on both the number of potential characters and the number of letters added. In this case, there are 26 lowercase letters, 26 uppercase letters, and 10 possible digits. That creates 62 possibilities. Since we added only a single letter of length, we get 62 to the power of 1, or 62 possibilities, and thus the new passwords would be 62 times harder to brute-force on average
Which pair of the following factors is key for user acceptance of biometric identification identification systems?
a) The FAR
b) The throughput rate and the time required to enroll
c) The CER and the EER
d) How often users must re enroll and the reference profile requirements
B) Biometric systems can face major usability challenges if the time to enroll is long (over a couple of minutes) and if the speed at which the biometric system is able to scan and accept or reject the user is too slow.
