Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ICS > Cissp - Access Control > Flashcards

Cissp - Access Control Flashcards

0
Q

A passive data file

A

Object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

An active entity on an information system

A

Subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Gives subjects full control of objects they have been given access to, including sharing the objects with other subjects.

A

Discretionary access control - DAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

System enforced access control based on subject’s clearances and objects labels.

A

Mandatory access control - MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Subjects are grouped into roles and each defined role has access permissions based on the role not the individual .

A

Role based access control - RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The mission and purpose of access control is to:

A

Protect the confidentiality, integrity, and availability of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  1. What type of password cracking attack will always be successful?
A

Brute Force

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  1. What is the difference between password cracking and password guessing?
A

Password guessing attempts to log into the system, password cracking attempts to determine a password used to create a hash.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  1. The most insidious part of phishing and spear phishing attacks come from which part of the attack anatomy.
A

Phishing and spear phishing attacks are rarely successful.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
  1. What is the term used for describing when an attacker, through a command and control network, controls hundreds, thousands, or even tens of thousands of computers to perform actions all at once?
A

Botnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  1. What are the main differences between retina scans and iris scans?
A

Iris scans invade a person’s privacy and retina scans to not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  1. What is the most important decision an organization needs to make when implementing RBAC?
A

The roles users have on the system need to be clearly defined..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  1. What access control method weighs additional factors such as time of attempted access before granting access?
A

Context-dependent access control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  1. An attacker sees a building is protected by security guards and attacks a building next door with no guards. What control combination are the security guards.
A

Physical/deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  1. A Type II biometric is also known as what?
A

False accept rate (FAR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  1. Within Kerberos, which part is the single point of failure?
A

Key distribution center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  1. Your company has hired a third-party company to conduct a penetration test. Your CIO would like to know if exploitation of critical business systems is possible. The two requirements the company has are:
  2. The tests will be conducted on live, business functional networks. Thes networks must be functional in order for business to run and cannot be shut down, even for an evaluation.
  3. The company wants the most indepth test possible.

What kind of test should be recommended?

A

Full knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  1. Your company has hired a third-party company to conduct a penetration test. Your CIO would like to know if exploitation of critical business systems is possible. The two requirements the company has are:
  2. The tests will be conducted on live, business functional networks. Thes networks must be functional in order for business to run and cannot be shut down, even for an evaluation.
  3. The company wants the most indepth test possible.

While conducting the penetration test, the tester discovers that a crical business system is currently compromised. What should the tester do?

A

Immediately end the penetration test and call the CIO.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q
  1. What group launches the most attacks?
A

Outsiders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
  1. A policy stating that a user must have a business requirement to view data before attempting to do so is an example of enforcing what?
A

Need to know.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q
  1. What technique would raise the false accept rate (FAR) and lower the false reject rate (FRR) in a fingerprint scanning system?
A

Decrease the amount of minutiae that is verified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CIA stands for

A

Confidentiality, integrity, and availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What do access controls protect against.

A

Unauthorized access, inappropriate modification of data, and loss of confidentiality of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the opposing forces in CIA

.

A

Disclosure, Alteration, and Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is PII

A

Personally identifiable information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is integrity

A

Unauthorized modification of files

26
Q

What is availability

A

Data is accessible when needed

27
Q

What is confidentiality

A

Prevent unauthorized disclosure

28
Q

What is DAD

A

Disclosure, alteration destruction (opposite of CIA)

29
Q

What is AAA

A

Identity and authentication, authorization and accountability

30
Q

What is authentication

A

You are the person you claim to be

31
Q

What is Authorization

.

A

Actions you can preform on a system once you have identified and authenticated

32
Q

What is non-repudiation

A

User can not deny having performed a transaction (combines authentication and integrity

33
Q

What is least privilege

A

User granted minimum amount of access

34
Q

What is a subject

A

Is an active entity on a system, running computer programs are also subjects

35
Q

What is an object

A

Passive data within the system

36
Q

What is Defense in depth

A

Also known as layered security, uses multiple safeguards, or controls, to protect an asset

37
Q

What are controls

A

Controls are measures taken to protect an asset

38
Q

What is Discretionary access control (DAC)

A

Gives full control of objects the user has been given access to, including sharing the objects with other subjects.

39
Q

Deploying a range of different ___________ safeguards in your organization lowers the chance that all controls will fail.

A

Defense in Depth

40
Q

What is MAC

A

Mandatory Access Control

41
Q

Honeywell’s SCOMP and Purple Penelope are examples of _______ systems.

A

MAC

42
Q

What is RBAC

A

Role-Based Access Control

43
Q

What rules are included in RBAC

A

Role assignment, role authorization, and transaction authorization.

44
Q

Role Assignment means

A

A subject can execute a transaction only if the subject has selected or been assigned a role. Identification and authentication are not considered a transaction. All other user activities on the system are conducted thru activities.

45
Q

Role authorization means

A

A subject’s active role must be authorized for the subject. This with Role assignment ensures that users can take on only roles for which they are authorized.

46
Q

Transaction authorization means

A

Subject can execute a transaction only if the transaction is authorized through the subject’s role memberships, and subject to any constraints that may be applied across users, roles, and permissions.

47
Q

Non-Discretionary access control

A

RBAC is a type of ________ because users do not have discretion regarding the groups of objects they are allowed to access and are unable to transfer objects to other subjects.

48
Q

What is role based access control

A

How information is accessed on a system based on the role of the subject. Permissions are based on role not individual user

49
Q

What is task based access control

A

Another non-discretionary access control, permission based on a task the subject I preforming

50
Q

Content and content-dependent play what role?

A

Defense in depth supporting role

51
Q

Content-depend relies on

A

Access based on the content the subject is accessing

52
Q

What is centralized access control

A

Instead of managing access locally you have a central system managing it, Single Sign on (SSO). Subject can authenticate once then access multiple systems

53
Q

Access control catagories

A
  • Preventative
  • Detective
  • Corrective
  • Recovery
  • Deterrent
  • Compensating
54
Q

Access control catagories

Can fall into one of three categories

A

Administrative (Directive) controls– policies, training regulations
Technical controls- Software, hardware, firmware
Physical Controls – locks, fences, gates

55
Q

Type one authentication: Passwords

A

Involves testing a subject with some sort of challenge

56
Q

Static passwords -

A

user generated and often used with another authentication method

57
Q

Passphrase -

A

comprised of words or phrases with different twists. Maybe using a “Zero” instead of a “O”

58
Q

One time password -

A

can only be used once

59
Q

Dynamic passwords –

A

passwords that always change (RSA)

60
Q

Microsoft Lan Manager makes password all

A

uppercase before hashing

61
Q

Hybrid attack

A

substitutes and and prepends characters in a password

62
Q

Salt allows one password to be

A

hashed multiple ways, prevent rainbow tables

63
Q

Asynchronus dynamic tokens are not

A

synchronized with a central server, EX: challenge response token …System produces a challenge for the token device user then enter information into device along with a pin. It then goes back to the system The reponse is tied to the system making it correct

ICS (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions