Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISC2 Certified Cybersecurity > Domain 3 > Flashcards

Domain 3 Flashcards

Access Control Concepts

1
Q

Which of the following is an example of security control?

A

Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Subject definition

A

any entity that requests
access to asset. May be a user, program, etc., is active in initiating the request for services, and should have some level of clearance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Object definition

A

an entity that responds to a request for service. May be a building, file, etc., provides service to a user, is passive in the request, do not have their own access control logic, and may have a classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

an instruction developed to allow or deny access to an object by comparing the validated identity of the subject to an access control list

A

Rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the definition of an object in the context of access controls?

A

An entity that responds to a request for service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Derrick logs on to a system to read a file.

In this example, Derrick is the ______.

A

Subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of the following is a subject?

A

User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the strategy that integrates people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of an organization?

A

Layered Defense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How does privileged access management implement the principle of least privilege?

A

By granting each user access only to the items they need

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Physical access controls are

A

tangible methods or mechanisms that
limit someone from getting access to an
area or asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Logical access controls are

A

electronic methods that limit someone
from getting access to systems, and
sometimes even to tangible assets or areas, including passwords, biometrics, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which of the following is an example of a logical access control method?

A

Biometrics on a smartphone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Limiting access to data on the network would be considered which of the following controls?

A

Logical or technical controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A control serves to

A

reduce the risk
according to where it falls within
the risk tolerance of the individual
or organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What would be considered an administrative control in the context of seat belt usage?

A

Passing a law requiring seat belt use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What would be considered a physical control in the context of seat belt usage?

A

The seat belt itself would be considered a physical control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What alternative control could be used if biometric locks on multiple doors are not necessary and access does not need to be audited?

A

Replacing doors with deadbolt locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In what type of environment does role-based access control work well?

A

High-staff turnover and similar access requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Role-based access control provides

A

each worker
privileges based on what role
they have in the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What term is used to describe the situation where someone inherits expanded permissions that are not appropriate for their role in Role-based Access Control (RBAC)?

A

Privilege creep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the key feature of just-in-time privileged access management?

A

Role-based subsets of privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Privileged accounts are

A

those with
permissions beyond those of normal users,
such as managers and administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

In Mandatory Access Control (MAC), what determines the level of access to certain areas in certain government agencies?

A

Government policy and security clearance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

With Mandatory Access Control, who
assigns access rights or permissions?

A

security administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

With Discretionary Access Control, who
assigns access rights or permissions?

A

the object owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Who can modify security rules in a system governed by Mandatory Access Control (MAC)?

A

Trusted subjects designated as security administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of these combinations of physical security controls share a single point of failure?

A

High-illumination lighting and cameras

A power failure will disable both the cameras and the lights.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What challenges do small and medium businesses face regarding technical controls in payroll systems?

A

Insufficient personnel for duty separation

29
Q

Which of the following is an example of a physical access control?

A

Motion detectors

30
Q

Separation of duties is based on

A

the security practice that no one person should control
an entire high-risk transaction from start to finish.

31
Q

Collusion is when

A

two individuals willfully work together to bypass the separation of duties to jointly commit fraud

32
Q

Duncan and Mira work in the data center at Triffid, Inc. There is a policy in place that requires both to be present in the data center at the same time.

If one has to leave for any reason, the other must step out, too, until they can both re-enter.

This is called ________.

A

Two-person integrity

33
Q

Why is Discretionary Access Control (DAC) not considered very scalable?

A

It relies on the discretion of individual object owners

34
Q

What is the two-person rule in the context of security strategy?

A

Two people must be in an area together

35
Q

Audit

A

Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures

36
Q

Crime Prevention through Environmental Design (CPTED)

A

An architectural approach to the design of buildings and spaces which emphasizes passive features to reduce the likelihood of criminal activity

37
Q

Defense in Depth

A

Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization

38
Q

Discretionary Access Control (DAC)

A

A certain amount of access control is left to the discretion of the object’s owner, or anyone else who is authorized to control the object’s access. The owner can determine who should have access rights to an object and what those rights should be

39
Q

Firewalls

A

Devices that enforce administrative security policies by filtering incoming traffic based on a set of rules

40
Q

Insider Threat

A

An entity with authorized access that has the potential to harm an information system through destruction, disclosure, modification of data, and/or denial of service

41
Q

iOS

A

An operating system manufactured by Apple Inc. Used for mobile devices.

42
Q

Layered Defense

A

The use of multiple controls arranged in series to provide several consecutive controls to protect an asset; also called defense in depth.

43
Q

Linux

A

An operating system that is open source, making its source code legally available to end users.

44
Q

Log Anomaly

A

A system irregularity that is identified when studying log entries which could represent events of interest for further surveillance.

45
Q

Logging

A

Collecting and storing user activities in a log, which is a record of the events occurring within an organization’s systems and networks

46
Q

Logical Access Control Systems

A

Logical Access Control Systems
An automated system that controls an individual’s ability to access one or more computer system resources, such as a workstation, network, application or database. A logical access control system requires the validation of an individual’s identity through some mechanism, such as a PIN, card, biometric or other token. It has the capability to assign different access privileges to different individuals depending on their roles and responsibilities in an organization

47
Q

Mandatory Access Control

A

Access control that requires the system itself to manage access controls in accordance with the organization’s security policies

48
Q

Mantrap

A

An entrance to a building or an area that requires people to pass through two doors with only one door opened at a time

49
Q

Object

A

Passive information system-related entity (e.g., devices, files, records, tables, processes, programs, domains) containing or receiving information. Access to an object (by a subject) implies access to the information it contains

50
Q

Physical Access Controls

A

Controls implemented through a tangible mechanism. Examples include walls, fences, guards, locks, etc. In modern organizations, many physical control systems are linked to technical/logical systems, such as badge readers connected to door locks

51
Q

Principle of Least Privilege

A

The principle that users and programs should have only the minimum privileges necessary to complete their tasks.

52
Q

Privileged Account

A

An information system account with approved authorizations of a privileged user

53
Q

Ransomware

A

A type of malicious software that locks the computer screen or files, thus preventing or limiting a user from accessing their system and data until money is paid

54
Q

Role-based access control (RBAC)

A

An access control system that sets up user permissions based on roles.

55
Q

Rule

A

An instruction developed to allow or deny access to a system by comparing the validated identity of the subject to an access control list.

56
Q

Segregation of Duties

A

The practice of ensuring that an organizational process cannot be completed by a single person; forces collusion as a means to reduce insider threats. Also commonly known as Separation of Duties

57
Q

Subject

A

Generally an individual, process or device causing information to flow among objects or change to the system state

58
Q

Technical Controls

A

The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software or firmware components of the system.

59
Q

Turnstile

A

A one-way spinning door or barrier that allows only one person at a time to enter a building or pass through an area.

60
Q

Unix

A

An operating system used in software development

61
Q

User Provisioning

A

The process of creating, maintaining and deactivating user identities on a system

62
Q

Why is it recommended to disable accounts for a period before deletion when an employee leaves the company?

A

To preserve the integrity of audit trails or files

63
Q

Lakshmi presents a user ID and a password to a system to log on.

Which of the following characteristics must the password have?

A

Confidential

64
Q

What is user provisioning in identity management?

A

Managing access to resources and information systems

65
Q

Which of the following is the responsibility of systems administrators who use privileged accounts?

A

Operating systems and applications

66
Q

What does behavioral biometrics measure?

A

User actions, such as voiceprints and keystroke dynamics

67
Q

Which of the following is an example of a monitoring tool?

A

Cameras

68
Q

Which is a physical control that prevents “piggybacking” or “tailgating,” when an unauthorized person follows an authorized person into a controlled area?

A

Turnstile

ISC2 Certified Cybersecurity (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions