Domain 3

Question 1

Entity that requests access to assets.

Is a user, a process, a procedure, a
client (or a server), a program, or a
device.

Requests a service from an object.

Answer 1

Subject

Question 2

A device, process, person,
user, program, server, client, or other
entity that responds to a request for
service.

Anything that provides service to a user.

A building, a computer, a file, a
database, a printer or scanner

Answer 2

Object

Question 3

To allow or deny access to an object by comparing the validated identity of the subject to an access control list.

Allow access to an object.

How much access is allowed.

Answer 3

Rules

Question 4

An information security strategy that integrates people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization.

Answer 4

Defense in depth

Question 5

Each user is granted access to only the items they need and nothing further.

Answer 5

Least Privilege

Question 6

Granted to a person, subject or group but not to others.

To create, read, update and delete.

Answer 6

Privileged Access Management

Question 7

Beyond normal users like managers and administrators.

To have greater control over data and applications.

Answer 7

Privileged Accounts