Domain 2 Asset Security Flashcards
Filip installs and integrates a nondiscretionary system. Which access control policy
gets enforced?
A. Physical
B. Mandatory
C. Role-based
D. Rule-based
Answer: C Role-based models are created implicitly by Non-Discretionary Access
Control (NDAC) systems, in that the users inherit their privileges from within the
role. Mandatory access control puts data into containers, for example, Top Secret,
Secret, and so on. Rule-based access control is defined by specific rules such as
denying an IP address or allowing a MAC address. Physical is a control type,
not a policy.
Anett has decided to use a passphrase instead of a dictionary-word password for
better security. Her new password converts into ____________?
A. The strongest password
B. A virtual password
C. An unusual password
D. A username
Answer: B Most systems today convert the password (or biometric) into a hash or
some representation of a password so that if the system gets hacked, the attacker
only has password hashes (garble) instead of actual passwords. The hash acts as a
virtual password because its value authenticates the user, not the password itself.
Hubert desires the best and most expensive security protection for his firm. Which
of the following does he select?
A. Passwords
B. Smart cards
C. Palm vein scanner
D. Fingerprint reader
Answer: C Vascular scanners observe and capture vein patterns of palms and
fingers. The biometric scan gets converted into a hash. Passwords are the least
expensive, and not as secure as vascular systems. Fingerprint readers are not as
secure, and not as expensive as vascular systems. Smart cards are not as secure as
vascular scanners.
A control category that reacts after an incident is called:
A. Corrective
B. Directive
C. Preventative
D. Deterrent
Answer: A Directives such as signs, deterrent controls such as fake cameras, or
preventatives such as fences are designed to stop an incident, but once an incident
occurs, such as a fire, a corrective control will attempt to mitigate the effects after
the incident; for example, releasing water sprinklers to stop the fire.
Alison is a security manager charged with investigating a recent breach into the
corporate network. What control category does this fall under?
A. Retroactive
B. Investigatory
C. Preventative
D. Detective
Answer: D Preventative controls react to stop an incident. Since there was
a breach, these have failed where detective controls activate. Retroactive and
investigatory are not control categories.
Reilly is performing a security audit for a customer and finds several cases where
users gained access to data without a formal access approval procedure. Reilly
recommends a formal access approval process to fix the issue. Which role should he
list that approves policies for users to gain access to data?
A. Data processor
B. Data custodian
C. Data subject
D. Data owner
Answer: D Data owners are responsible for allowing access to data they own.
Data owners approve access policies, and then operations implement them. Data
subjects are individuals whose privacy information is being saved. Data custodians
maintain and protect data, and data processors process the data in use with mailing
lists or email blasts.
Yulia is setting up an IDS that is rule-based. A rule-based IDS does/contains which
of the following?
A. Recognizes new types of attacks
B. Can recognize patterns and multiple activities
C. IF statements
D. Protocol recognition outside normal settings
Answer: C A rules-based Intrusion Detection System (IDS) uses rules to
evaluate whether packets are allowed or denied. For example, if MAC address
33:44:11:aa:bb:cc is permitted to access the network, those packets will
be allowed. Pattern recognition, attack recognition, and protocol recognition are
characteristics of signature-based or anomaly-based systems.
Passive entities that subjects access are called what? (Choose the BEST answer)
A. Objects
B. Computers
C. Processes
D. Files
Answer: A Computers, processes, files, hard drives, printers, and so on, are
different types of objects that can be accessed by subjects. Subjects include people
and processes.
David, a writer for RMS Publishing, read his emails and opened an attachment to
help him find a lost package. Later that week, he discovered his bank account no
longer had money, and he was locked out of several social networking accounts.
What MOST LIKELY occurred?
A. Phishing attack
B. Cross-site scripting attack
C. Cross-site request forgery attack
D. Malware in the attachment downloaded passwords from his password manager
Answer: D Although what initiated the attack was a phishing email, the attached
malware downloaded David’s password manager. Cross-site scripting and cross-site
request forgery could both steal session keys from the user if currently logged into
his bank account, but the question does not state he was currently logged in, added
to the fact that other accounts were tampered with.
Dayana is a CISO putting together the password policy for her organization and
wants to assure users follow the policy, and don’t find workarounds. Which of the
following is her MOST SECURE choice?
A. Minimum 12-character password with uppercase, lowercase, numbers, and
special characters
B. Minimum 16-character passphrases
C. Minimum 8-character password
D. 4-digit PIN
Answer: B For best password security, passwords must first be long, then complex
because most brute-force tools start with shorter passwords, and then slowly get
longer. Passphrases are easily accepted by users because they allow sentences they
will remember and include the special character space. The policy can be made
stronger by adding a numeral requirement. Once the CISO defines the policy, this
is enforced administratively via the employee agreement, and technologically with
systems such as Pluggable Authentication Modules (PAMs), or Active Directory
(AD) group policies.
An SSO system is characterized by which of the following options?
A. Provides multiple usernames and passwords to access resources
B. Provides a single username with various passwords to access resources
C. Provides a single username and password to access each system
D. Provides a single username and password to access the entire network
Answer: D A Single Sign-On (SSO) system allows a user to access network
resources with one login name and password, easing usability. Using a single
username and password to access each system requires the user to log in and log
out of one system and into another to access new resources. SSO does not require
leaving one resource, such as email, to access another, such as a shared file server.
When an employee or contractor leaves the company, which of the following steps
is the least important?
A. Return the corporate phone to the organization
B. Return their corporate identification card to the organization
C. Return desk nameplate to the organization
D. Deprovision their username and password from all systems
Answer: C The desk nameplate displays the user’s name and often job title,
but is not a means of access to the firm, because guards are required to see a
corporate ID card to grant access, not a desk nameplate. For best security during
the exit interview, the organization must collect the corporate phone, laptop,
identification card, and desk nameplate from the exiting staff because this could
be used in a social engineering attack, but it is the least important of these. System
administrators must remove their account(s) from the network.
Albert logs into an airline website to purchase a plane ticket for a cross-country flight.
The site offers him the ability to also rent a car from a separate company without
having to provide a new login name and password. What is this process called?
A. Identity management
B. Provisioning
C. Single sign-on
D. Federation
Answer: D When the user’s authentication credentials are transferred seamlessly
to another company, this is called federation. SSO allows a user to access multiple
resources or objects on their organization’s network. Provisioning is the process of
setting up a new user’s corporate credentials. Identity management is a general term
that includes SSO, provisioning, deprovisioning, and federation.
What do the best performing biometric authentication systems have?
A. Low crossover error rate
B. The greatest type I error rate
C. The least type II error rate
D. High crossover error rate
Answer: A Crossover error rate is defined where type I errors and type II errors
are equal. The lowest crossover error rate device currently is a retinal scan.
Nadia is a security administrator tasked with finding users with weak passwords.
Which attack would she attempt FIRST as part of this security audit?
A. Rainbow tables
B. Birthday
C. Dictionary
D. Brute force
Answer: C The weakest passwords that users implement, and the simplest for
hackers to exploit, come from the dictionary. The birthday attack uses probability
and statistics to narrow down passwords from a list of possible passwords. Rainbow
tables are lists of hashes and their passwords. Brute-force attacks would be the final
attack option, as they check for every possible pattern.
Lorenzo has been transferred from the marketing department to sales. Six months
earlier he worked in the finance department. Which risk should be MOST considered?
A. Non-disclosure agreement
B. Non-compete agreement
C. Need to know
D. Authorization creep
Answer: D The Non-Disclosure Agreement (NDA) is signed when Lorenzo joins
the company. The non-compete is signed when Lorenzo leaves the company. Need
to know provides Lorenzo with only the authorizations necessary to do his job.
Authorization creep occurs as Lorenzo moves from department to department, and
the rights and privileges from previous departments are not removed.
Which SSO system uses secret keys, principals, and tickets?
A. Kerberos
B. SESAME
C. LDAP
D. NDS
Answer: A Kerberos uses a key-distribution center (KDC) to grant tickets to users
for services to use, such as email or file sharing. The system’s security comes from
not passing passwords over networks, making them harder to attack. SESAME is
a SSO service that uses asymmetric keys and certificates to authenticate users into
the network. LDAP and NDS are both directory services that keep track of users’
identities, such as phone numbers, addresses, and emails.
Sam, a security manager, is considering Kerberos as his single sign-on system for
the organization. He knows the system is very secure but wants to also learn its
weaknesses. Which of the following is he NOT concerned with?
A. Brute-force attacks against the keys
B. Keys temporarily sit on users’ computers, which are prone to attack
C. Asymmetric keys are vulnerable to attackers
D. If the KDC goes down, users will not have access
Answer: C Kerberos only uses symmetric keys called session keys and secret keys as
part of the system. Provide redundancy with the KDC to mitigate it being a single
point of failure. Make certain to use long keys to resist brute-force attacks. Protect
the network from hackers by assuring security patches are installed as needed.
Diskless computers with lots of memory and fast CPUs that obtain their operating
system and data from a centralized server are called what?
A. Thick clients
B. Distributed computing
C. Backup servers
D. Thin clients
Answer: D Thick clients and backup servers have hard drives. Thin clients can
be used for distributed computing, but the question asked is what type of computer
this is, not what can it be used for.
Ekaterina is an air force captain and has top-secret access to all objects, including
submarines. A review shows that since she is not in the Navy, she does not need
access to ship and submarine details. What is this enforcing?
A. Least privilege
B. Need to know
C. Single sign-on
D. Federation
Answer: B Need to know is similar to least privilege but contains the user’s rights
based on their role. SSO grants a user access to the network with a single username
and password. Federation grants a user additional services based on relationships
with the primary vendor, that is, the user logs into the bank, and then the user’s
credentials are federated to the check printing company without having to enter
them again.
Which of the following is NOT an SSO system?
A. CIRCUMFERENCE
B. RADIUS
C. DIAMETER
D. Kerberos
Answer: A SSO allows a user access and authorizations for all of the resources on
the network with a single username and password. SSO systems include RADIUS,
DIAMETER, Kerberos, TACACS, TACACS+, and more.
Qiang is a systems administrator charged with implementing security containers
on her systems. These will be divided into top-secret, secret, confidential, and
unclassified. Which type of system is she implementing?
A. DAC
B. MAC
C. Rule-BAC
D. NDAC
Answer: B Mandatory Access Control (MAC) allows users with specific
clearances, such as secret, to access files in containers marked secret, confidential,
and unclassified. Discretionary Access Control (DAC) allows users to set
authorizations of files they own, as desired. Role-based Access Control (RBAC)
is used within firewalls. NDAC is the same as role-based access control, where
authorizations are defined by a user’s job or position in the organization.
Miomir needs to tighten security access into the server room and wants to add
three-factor authentication. Which two should he combine along with a swipe card
to enter the room? (Choose two)
A. Authenticator
B. OTP
C. Retina scan
D. PIN
Answer: C, D For three-factor authentication, Miomir needs to provide something
you have, with something you know, and something you are type authentications.
Smartphone authenticators and One-Time Passwords (OTP) are both somethingyou-
have type devices and would not qualify. Retina scans and PINs finalize the
authentication with something you are, and something you know, respectively.
Which of the following access control models prioritizes availability over
confidentiality and integrity, so that owners of their files determine the
authorizations of their objects?
A. Rule-BAC
B. Role-BAC
C. MAC
D. DAC
Answer: D Discretionary Access Control (DAC) allows users to set authorizations
on their data at their discretion; usually used within corporate environments where
access to information is prioritized. Mandatory Access Control (MAC) prioritizes
confidentiality over availability and integrity so that once files are stored in the Top
Secret bin, only those with that clearance can access the file. Role-BAC is defined by
the user’s job title, and rule-BAC is used within firewalls and routers.
Jordan adds the following to a file:
Allow MAC Address 35:35:43:ab:ac:1b
Deny All
This is an example of what?
A. Rule-based access control
B. Role-based access control
C. Non-discretionary access control
D. Discretionary access control
Answer: A Rules such as allowing a MAC address or denying an IP address are
found in firewalls, routers, and switches where access is allowed or denied with
single-line entries. Role-based access control (RBAC) and NDAC are the same in
that group, for example, junior administrators have rights to add hard drives, but
not to configure networks. DAC allows users to set rights per their discretion.
Svetlana’s security manager asks her to provide data as to whether they should
stay on their RADIUS AAA server or move to TACACS. What are two differences
between TACACS and RADIUS? (Choose two)
A. TACACS encrypts all the data. RADIUS encrypts the password only.
B. TACACS encrypts all the data. RADIUS encrypts the username and
password only.
C. TACACS transmits data via TCP, and RADIUS transmits data via UDP.
D. TACACS transmits data via UDP, and RADIUS transmits data via TCP.
Answer: A, C TACACS is an improvement over the older RADIUS, which even
offers dial-in access. TACACS can separate authentication, authorization, and
accounting, whereas RADIUS combines authentication and authorization.
Which of the following is NOT a physical access control type?
A. 8-foot fencing
B. Data backups
C. Security-awareness training
D. Network segregation
Answer: C Training is an administrative control. Examples of technical access
controls include network access rules, encryption, system logging, and monitoring.
Which of the following are examples of deterrent control functions? (Choose two)
A. Fake security cameras
B. Secure hiring practices
C. Guard dogs
D. Security cameras
Answer: A, D Security cameras are both a deterrent, discouraging attacks, and
detective control functions, which help to identify attacks. Other control functions
include compensating, which provides an alternative backup control, such as an
online, replicated backup system, and directive control functions, which inform, for
example, a “beware of the dog” sign.
- Which of the following are examples of administrative controls? (Choose two)
A. Non-disclosure agreement
B. Dress code policy
C. Firewall rules
D. Painted parking lot lines
Answer: A, B Policies and agreements are administrative controls because they
are developed by management. Firewall rules are an example of technical controls.
Painted parking lines are an example of a physical control.
Aljaz, a security engineer, is tasked with finding and installing a device that
monitors network activities. Which of the following does he recommend?
A. Intrusion detection system
B. Intrusion prevention system
C. Data loss prevention
D. Proxy server
Answer: A An intrusion detection system (IDS) is a detective access control type
device that identifies activities. An Intrusion Prevention System (IPS) and Data
Loss Prevention (DLP) are preventative access control type devices that block
incidents. IPS blocks incoming traffic, and DLP blocks outgoing traffic, usually
from insider threats desiring to leak corporate secrets. A proxy server is simply a
go-between for message passing, often designed to hide original IP addresses or
help with traffic management.
