Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > D3: Access Controls > Flashcards

D3: Access Controls Flashcards

1
Q

They dictate how subjects access _, adn their main goal is to protect the _ from _ _.

A

objects

objects; unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Access controls can be (3):

A

1) physical
2) administrative
3) logical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Access control defines:

A

how users should be identified, authenticated, and authorized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Access control needs to be integrated into the core of operating systems through the use of _, _, and _ models

A

DAC
MAC
RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How is access control enforced in the physical world?

A

security zones, network segmentation, locked doors, securit yguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Access is…

A

a flow of information between a subject and an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

subject v. object

A

subject - aactive entity that requests access to an object

object 0 a passive entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

a subject can be a

A

user, program, process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Access controls are security features that are usually considered the _ _ _ _ in asset protection.

A

First line of defense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Name security mechanisms that provide confidentiality:

A
  • encryption
  • logical and physical access control
  • transmission protogol
  • database views
  • controlled traffic flow
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Name some identity management solutions:

A
  • directories
  • web access management
  • passwrod management
  • legacy single sign-on
  • account management
  • profile update
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the benefit of password synchronization?

A

It reduces the complexity of keeping up with different passwords for different systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Benefits of self-service password reset:

A

Reduces help-desk call volumes by allowing users to reset their own passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the benefits for assisted password reset?

A

It reduces the resolution process for password issues for the help-desk department

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What do IdM directories contain and what’s the purpose?

A

All resource information, user’s attributes, authorization profiles, roles, and possibly access control policies.

Other IdM applications have one centralized resource from which to gather this information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Automated workflow component is _ in account management products that provide IdM solutiosn

A

common

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

User provisioning refers to:

A

creation, maintenance, and deactivation of user objects and attributes, as they exist in one or more systems, directories, or applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The HR database is usually considereed the authoritative source for:

A

user identities. This is where it is first developed and properly maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the three main access control models?

A

1 - discretionary
2 - mandatory
3 - role-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

DAC

A

Discretionary Access Control. Enables data owners to dictate what subjects have access to the files and resources they own.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

MAC

A

Mandatory Access Control.

This model uses a security label system. Users have clearnaces, and resources have security labels that contain data classifications.

MAC systems compare these two attributes to determine access control capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Role-Based Access Control

A

Based on the user’s role and responsibiliteis (tasks) within the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the three main tyapes of restricted interface measurements?

A

1 - menus and shells
2 - database views
3 - physically constrained interfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Access control lists are bound to _ and indicate what _ can use them.

A

objects

subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A capability table is bound to a _ and lists what _ it can access.

A

subject

objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the two man ways that access control can be adminstered?

A

1 - centralized

2 - decentralized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Provided a decentralized administration access control example:

A

peer-to-peer working group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Provide some examples of centralized administration access control technologies:

A

RADIUS
TACACS+
Diameter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Provide examples of administrative controls:

A
  • security policy
  • personnel controls
  • supervisory structure
  • security awareness training
  • testing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Provide examples of physical controls

A
  • network segregation
  • perimeter security
  • computer controls
  • work area separation
  • cable
31
Q

Provide examples of technical controls

A
  • system access
  • network architecture
  • network access
  • encryption and protocols
  • auditing
32
Q

For a subject to be able to access a resource it must be:

A

1 - identified
2 - authenticated
3- authorized
4 - held accountable for its actions

33
Q

Through what ways can authentication be accomplished?

A 
1 - biometrics
2 - password
3 - passphrase
4 - cognitive password
5 - one-time password
6 - token
34
Q

Biometrics Type I error =

A

the system rejected an authorized individual

35
Q

Biometrics Type II error =

A

an imposter was authenticated

36
Q

A _ _ cannot process information, but a _ _ can through the use of integrated circuits and processors

A

memory card

smart card

37
Q

What do Least-privilege and need-to-know principles do?

A

Limit users’ rights to only what is needed to perform tasks of their job

38
Q

Single sign-on cabailities can be accomplished through:

A
  • Kerberos
  • SESAME
  • domains
  • thin clients
39
Q

How does Kerberos work?

A

1 - the Kerberos user receives a ticket granting ticket (TGT) which allows him to request access to resources through the ticket granting service (TGS)
2 - The TGS generates a new ticket with the session keys

User –> TGT –> TGS –> ticket with session keys

40
Q

Name types of access control attacks

A
  • DoS
  • Spoofing
  • dictionary
  • brute force
  • war dialing
41
Q

KEYSTROKE LOGGING

A

A type of auditing that tracks each keystroke made by a user

42
Q

How can object reuse unintentiallly disclose information?

A

By assigning media to a subject before it is properly erased

43
Q

Is removing pointers to files (deleting file, formatting hard drive) enough protection for proper object reuse?

A

No

44
Q

Information can be obtained via electrical signals in airwaves. The ways to combat this type of intrusion are:

A

TEMPEST
White noise
control zones

45
Q

User authentication is accomplished by:

A

what someone knows, is, or has

46
Q

One-time password generating token devices can use synchronous (, ) or asynchronous (-) methods

A

time, event

challenge-based

47
Q

Strong authentication requires:

A

two of the three authentication attributes (knows, is, has)

48
Q

What are the weaknesses of Kerberos:

A
  • the KDC is a single point of failure
  • it is susceptible of password guessing
  • session and secret keyes are locally stored
  • KDC needs to always be available
  • there must be management of secret keys
49
Q

What is phishing?

A

A type of social engineering with the goal of obtaining personal information, credentials, credit card numbers, or financial data

50
Q

When is a race condition possible?

A

When two or more processes use a shared resource and the access steps could take place out of sequence

51
Q

What is mutual authentication?

A

When two entities must authenticate to each other before sending data back and forth.

Also referred to as two-way authentication

52
Q

What is a directory service?

A

A software component that stores, organizes, and provides access to resources, whicih are listed in a directory (listing) of resources. Individual resources are assigned names within a namespace

53
Q

Cookie

A

Data that are held permanently on a hard drive in the format of a text file or held temporariliy in memory. It can be used to store browsing habits, authentication data, or protocol state information

54
Q

Federated Identity

A

A portable identity.

Its associated entitelements that can be used across business boundaries without the need to synchronize or consolidate directory information

55
Q

Extensible Markup Language (XML)

A

A set of rules for encoding documents in machine-readable form to allow for interoperability between various web-based technologies

56
Q

Service Provisioning Markup Language (SPML)

A

An XML-based framework being developed by OASIS

57
Q

eXtenible Access Control Markup Language (XACML)

A

A declaritive access control policy language implemented in XML and a processing model, describes how to interpret security policies

58
Q

Replay attack

A

A form of network attack in which a valid data transmission is maliciously or fradulently repeated with the goal of obtaining unauthorized access.

59
Q

Clipping level

A

A threshold value. Once a threshold is passed, the activity is considred an event that is logged, investigated, or both

60
Q

RAINBOW TABLE

A

A set of precomputed hash values that represent password combinations. These are used in password attack processes and usually produce results more quickly than dictionary or brute force attacks.

61
Q

COGNITIVE PASSWORDS

A

Fact- or opinion-based information used to verify an individuals identity

62
Q

Smart cards can require physical interaction with a reader () or no physical interaction with the reader ( _ _ ). Two _ _ are combi ( ) and hybrid ( _).

A 
contact
contactless architecture
contactless architectures 
one chip
two chips
63
Q

How is a side channel attack carried out?

A

By gathering data pertaining to how something works and using that data to attack or crack it, as in differntial power analysis or electronmagnetic analysis.

64
Q

When does authorization creep take place?

A

when a user gains too much access rights and permissions over time.

65
Q

What is SESAME?

A

A single sign-on technology developed to address issues in Kerberos. It is based upon publi key cryptography (asymmetic) and uses privileged atribute servers and certs.

66
Q

Intrusion detection systems are either _ or _ based and provide _ (statistical) or _ (knowledge) types of functionality.

A

host; network

behavioral; signature

67
Q

If a DNS server is poisoned and points users to a malicious website, its called:

A

pharming

68
Q

A web portal is commonly made up of _, which are pluggale user interface software components that present information and services from other systems

A

portlets

69
Q

SPML

A

Service Provisioning Markup Language.
Allows for the automation of user management (account creation, amendments, revocation) and access entitlement configuration related to electornically published services across mulitple provisioning systems

70
Q

SAML

A

Security Assertion Markup Language.

Allows for exchange of authentication and authroization data to be shared between security domains.

71
Q

SOAP

A

Simple Object Access Protocol.

For exchanging structured information in the implementation of web services and networked environments.

72
Q

SOA

A

Service oreiented architecture.

Allow ofr a suite of interoperable services to be used within multiple, separate systems from several business domains

73
Q

Threat modeling

A

identifies potential threats and attack vectors.

74
Q

vulnerability analysis

A

identifies weaknesses and lack of countermeasures;

CISSP (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions