Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 - Access Control > Flashcards

Domain 1 - Access Control Flashcards

1
Q

Is an active entity in an Information System

A

Subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A Passive data file

A

Object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Is an access control that gives subjects full control of objects they
have been given access to, including sharing the objects with other subjects

A

Discretionary Access Control - DAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

System-enforced access control based on

subject’s clearances and object’s labels

A

Mandatory Access Control - MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Is an access control where subjects are grouped into roles and each
defined role has access permissions based upon the role, not the individual

A

Role-Based Access Control - RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Its purpose is to allow authorized users access to appropriate data and
deny access to unauthorized users.

A

Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

is keeping data secret. Data must only be accessible to users who
have the clearance, formal access approval, and the need to know

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Threat to confidentiality

A

Disclosure of Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Protects against unauthorized alteration of data

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Ensures that information is readily accessible to authorized users or
programs as the information is needed

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Occurs when subjects not only maintain old access rights but gain new
ones as they move from one division to another within an organization.

A

Authorization Creep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

is another non-discretionary access control model, related to RBAC. It is is based on the tasks each subject must
perform, such as writing prescriptions, or restoring data from a backup tape, or
opening a help desk ticket.

A

Task-based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Concentrates access control in one logical point for a system or organization.

A

Centralized Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Local sites support and maintain

independent systems, access control databases, and data.

A

Decentralized Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Is a 3rd party authentication system described in RFC 2865, 2866. Its uses UDP ports 1812 and 1813.

A

Remote Authentication Dial In User Service (RADIUS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

is RADIUS’ successor, designed to provide an improved (AAA) framework. RADIUS provides limited accountability, and has problems with flexibility, scalability, reliability, and security.

A

Diameter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the number of Attribute Value Pairs (AVP) of Radius and Diameter.

A 
Radius = 8
Diameter = 32
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The cornerstone concept of InfoSecurity

A

The CIA triad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Opposing forces to CIA

A

DAD - Disclosure, Alteration and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

True or false. Our mission as information security professionals is to balance the needs of CIA and make trade offs as needed

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Is the unauthorised disclosure of information

A

Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Is the unauthorised modification of data

A

Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Making systems in available

A

Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

—— is a claim of who you are

A

Identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Proving an identity is called ——

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

—— describes the actions you can perform on a system once you have identified and authenticated. Actions may include reading, writing, or executing files or programs

A

Authorisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

—– holds a user accountable of his actions. This is typically done by logging and analysing audit data

A

Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

It means a user cannot deny having performed a transaction. It combined authentication and integrity

A

Non repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

True of false. You must have both authentication and integrity to have non repudiation

A

True

30
Q

It means users should be granted the minimum amount of access (authorisation) required to do their jobs

A

Least Privilege

31
Q

Is an active entity on a data system

A

Subject

32
Q

This applies multiple safeguards also called controls, measures taken to reduce risk to protect an asset

A

Defence in depth or layered defenses

33
Q

True or false. All controls can fail, and sometimes multiple control will fail. Deploying a range of different Defense in depth safeguards in your your organisation lowers the chance that all control will fail.

A

True

34
Q

—- give subjects full control of objects they have been given access to, including sharing the objects with other subjects

A

Discretionary Access Control - DAC

35
Q

Is a system enforced access control based on subject clearances and object labels

A

Mandatory Access Control -MAC

36
Q

True or false. A subject may access an object only if the subjects clearance is equal to or greater than the objects label.

A

True

37
Q

It defines how information is accessed on a system based on the role of the object

A

Role Based Access Control - RBAC

38
Q

True or false. RBAC is a type of non discretionary access control because users do not have discretion regarding the group of objects they are allowed to access and are unable to transfer objects to other subjects.

A

True

39
Q

Is another non discretionary access control model, related to RBAC based on the tasks each subject must perform, such as writing prescriptions, restoring data from a backup tape, or opening a help a help desk ticket.

A

Task Based Access Control

40
Q

Concentrates access control in one logical point for a system or organisation

A

Centralised Access Control

41
Q

Is an access control where organisations spans to multiple location. The local sites support and maintain independent systems, access control database and data

A

Decentralised Access Control

42
Q

This occurs as individual users gain more access to more systems

A

Access aggregation

43
Q

Users gain more entitlements without shedding the old ones.

A

Authorisation creep

44
Q

Is a centralised access control system that requires users to send an ID and static (reusable) password for authentication. It uses UDP or TCP port 49.

A

TACACS

45
Q

In Microsoft trust relationship, if A trust B, then A will trust all B’s trusted partners. What type of relationship is this?

A

Transitive trust

46
Q

This means limiting the access of authorised users to data they require to perform their duties

A

Least Privilege

47
Q

This allows an organisation to maintain checks and balances among the employees with privileged access by having more than one individual to perform part of a sensitive transaction.

A

Separation of Duties

48
Q

This describes a process that requires different staff perform the same duty.

A

Rotation of Duties

49
Q

Is a label that shall be applied to information,the unauthorised disclosure of which reasonably could be effected to cause exceptionally grave damage to the national security.

A

Top Secret

50
Q

Is a label that shall be applied to information,the unauthorised disclosure of which reasonably could be effected to cause serious damage to the national security.

A

Secret

51
Q

Is a label that shall be applied to information,the unauthorised disclosure of which reasonably could be effected to cause damage to the national security.

A

Confidential

52
Q

Is a determination about whether or not a user can be trusted with a specific level of information

A

Clearance.

Remember objects have labels, subject have clearances

53
Q

Is documented approval from data owner for a subject to access certain objects, requiring the subject to understand all of the rules , and requirements for accessing data and consequences should the data become lost, destroyed or compromised

A

Formal Access Approval

54
Q

What are the six access control types?

A 
Preventive
Detective
Corrective
Recovery
Deterrent
Compensating
55
Q

Three access control categories

A

Administrative
Technical
Physical

56
Q

Is a type of access control that prevents actions from occurring.

A

Preventive

57
Q

Are controls that alert during or after a successful attack

A

Detective

58
Q

Is control that works by correcting a damaged system or process

A

Corrective

59
Q

After a security incident has occurred, this control may have to be taken in order to restore the functionality of the system and organisation.

A

Recovery

60
Q

This control deter users from performing an actions on a system

A

Deterrent

61
Q

Is an additional security control put in place to compensate for weaknesses in other control

A

Compensating

62
Q

These controls are implemented by creating and following organisational policy, procedure, or regulation. User training and awareness also fall into this category

A

Administrative

63
Q

These controls are implemented using software, hardware, or firmware that restricts logical access on an information technology system . Examples includes firewalls, routers, encryption, etc

A

Technical

64
Q

These controls are implemented with physical devices such as locks, fences, gates, security guards, etc…

A

Physical

65
Q

Is a term used for the combination of both identification and authentication of a user

A

Credential set

66
Q

Three basic authentication methods

A

Type 1 - something that you know
Type 2 - something that you have
Type 3 - something you are

67
Q

Is reusable password that may or may not expire

A

Static password

68
Q

—– Are long static passwords, comprises of words in phrases or sentence

A

Passphrase

69
Q

This password may be used for single authentication, impossible to reuse and is valid for single use

A

One time password

70
Q

—-passwords that change at regular intervals

A

Dynamic Passwords

71
Q

This requires that user present more than one authentication factor

A

Strong authentication or multifactor authentication

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions