Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 5: Authentication Methods > Flashcards

Domain 5: Authentication Methods Flashcards

1
Q
  • Authentication method
  • Testing the subject with some sort of challenge and response where the subject must respond with a knowledgeable answer
  • i.e. password or PIN
A

Type 1 Authentication: Something You Know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q
  • Type of Password
  • Reusable passwords that may or may not expire
  • Typically user-generated
A

Static Passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  • Type of Password
  • Long passwords comprised of words in a phrase or sentence
  • i.e. “I will pass the CISSP”
A

Passphrases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  • Type of Password

- Authentication that is only valid for one-time use

A

One-time Passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  • Type of Password
  • Authentication that changes at regular intervals
  • i.e. RSA security token
A

Dynamic Passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  • The process of trying to predict a password in order to authenticate while online
  • Account lockouts is a prevention
A

Password guessing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Attacker has gained access to the password hashes or database and compares the output to a desired hash hoping to find a match therefore deriving the original password

A

Password Cracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  • Password Attack
  • Uses a word list each of which is hashed
  • Cracking software matches hash output to the password hash; if a match we‘ve identified the password
A

Dictionary Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
  • Password Attack
  • Appends, prepends, or changes characters in words from a dictionary before hashing in order to attempt the fastest crack of complex password
A

Hybrid Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  • Password Attack

- Attacker calculates the hash outputs for every possible password.

A

Brute-Force Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Database that contains the precomputed hashed output for most of all possible passwords

A

Rainbow table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  • Random value added to the plaintext password before hashing
  • Adds complexity to hashed password stored in database
  • Protects against rainbow attacks
A

Salt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Authentication method
  • Requires that users possess something
  • i.e. token
A

Type 2 Authentication: Something You Have

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • Time-based and synchronized with an authentication server (AS).
  • New password generated periodically (i.e. every 60 secs)
  • Does require the token and the server to have accurate time
A

Synchronous Dynamic Passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  • Creates a dynamic one time password that stays the same until used for authentication
  • Hardware token generates passwords based on an algorithm and an incrementing counter
  • Does not use a clock
A

Asynchronous Dynamic Passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  • Authentication method
  • Uses a physical characteristics as a means of identification or authentication
  • i.e. facial recognition system or fingerprint
A

Type 3 Authentication: Something You Are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The process of registering with the biometric system

A

Biometric Enrollment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q
  • The process of authenticating to a biometric system

- Typically 6-10 secs

A

Throughput

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
  • Occurs when an authorized subject is rejected by the biometric system as unauthorized
  • Type I error
A

False Rejection Rate

20
Q
  • Occurs when an unauthorized subject is accepted as valid

- Type II error

A

False Acceptance Rate

21
Q
  • The point where False Rejection Rate and False Acceptance Rate are equal
  • Describes the overall accuracy of a biometric system
  • AKA Equal Error Rate (EER)
A

Crossover Error Rate

22
Q

Most widely used biometric control

A

Fingerprints

23
Q

Includes specific details of fingerprint friction ridges like whorls, ridges and bifurcation

A

Minutiae

24
Q
  • Laser scan of capillaries that feed the back of the eye
  • This biometric control raises privacy concerns because conditions such as pregnancy and diabetes can be determined
  • Rarely used
A

Retina scan

25
Q
  • Camera takes a picture of the colored portion of the eye and then compares photos within the authentication database
  • Scan even works if person is wearing contact lenses or glasses
  • This is unique on every person, including twins
A

Iris scan

26
Q
  • Biometric control

- Takes measurements from specific points on a subject’s hand

A

Hand Geometry

27
Q
  • Biometric control

- Refers to how hard a person presses each key and the rhythm in which the keys are pressed.

A

Keyboard Dynamics

28
Q
  • Biometric control

- Measures the process by which someone signs his/her name

A

Dynamic Signatures

29
Q
  • Biometric control

- Measures the subject’s tone of voice while stating a specific sentence or phrase

A

Voiceprint

30
Q
  • Biometric control

- Process of taking a picture of a subjects face and comparing that picture to a list stored in a database

A

Facial scan

31
Q
  • Describes location-based access control using technologies
  • i.e. GPS, IP address-based geolocation
A

Someplace You Are

32
Q
  • OASIS standard typically used to define access control policies i.e. attribute-based or role-based
  • Most commonly used by software-define-networking systems
A

Extensible Access Control Markup Language (XACML)

33
Q
  • Used for federated identity SSO

- Based on DSML, which is used to present LDAP info in XML format

A

Security Provisioning Markup Language (SPML)

34
Q
  • Large constant value added to the plaintext password before hashing
  • Value is stored somewhere outside the database holding the hashed passwords
A

Pepper

35
Q

What are some algorithms that add a salt to a password and repeat the hashing function many times?

A

bcrypt

Password-Based Key Derivation Function 2 (PBKDF2)

36
Q
  • Type 3 authentication factor

- Behavioral biometrics i.e. signature and keystroke dynamics

A

Something-you-do

37
Q
  • ID or badge that has an integrated circuit chip embedded in it
  • Certificate inside microprocessor can be used for authentication, to encrypt data, digitally sign email and etc…
A

Smartcard

38
Q

Card that holds authentication information for a user

A

Memory card

39
Q

Authentication method that uses situational info (i.e. identity, geolocation, geofence, time of day, type of device) to determine who can access a network

A

Context-Aware authentication

40
Q

Virtual perimeter identifying the location of the building and can identify when a user is in the building

A

Geofence

41
Q

Series of challenge questions about facts or predefined response that only the subject should know

A

Cognitive Passwords

42
Q
  • Worn smartcards by personnel within the US government

- Users wear them while walking around and insert them into card readers at their computer when logging on

A

Common Access Cards (CACs)

Personal Identity Verification (PIV)

43
Q
  • Standard to create one time passwords
  • Typically creates values of six to 8 numbers
  • Values remain valid until used
A

HMAC-based One-Time Password (HOTP)

44
Q
  • Standard to create one time passwords
  • Uses a timestamp and remains valid for a certain timeframe (i.e. 30 secs)
  • Password expires if user does not use within timeframe
A

Time-based One-Time Password

45
Q
  • Biometric control

- Use near-infrared light to measure vein patterns in the palm, which are as unique as fingerprints

A

Palm scanners

46
Q
  • Biometric control

- Ensures that a real person is providing the biometric factor

A

Heart/Pulse Patterns

47
Q

Database where users biometric data is stored

A

Reference profile

CISSP (30 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions