Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

cissp > Domain 5: Identification and Authentication > Flashcards

Domain 5: Identification and Authentication Flashcards

1
Q

Subject

A

Active Entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Object

A

Passive Entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Three Primary Control Types of Access Controls

A

Preventative, Detective, and Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

4 “Other” Control Types of Access Controls

A

Deterrent, Recovery, Directive, Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Preventative Controls

A

attempts to stop and unwanted activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Detective Controls

A

discover activity after the fact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Corrective Controls

A

modify environment to return to normal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Deterrent Controls

A

discourage unwanted activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Recovery Controls

A

repair or restore resources, more complex than corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Directive Controls

A

direct the actions of subjects to force compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Compensating Controls

A

alternative when the primary control doesn’t work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Three Types Of Controls (based on how they are implemented)

A

Administrative, Logical/Technical, Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Identification

A

process of a subject claiming an identitiy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authentication

A

verifies the identity of the sybject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Authorization

A

Subjects are granted access to objects based on idenitity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Accountability

A

provided through auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Type 1 Authentication Factor

A

Something you know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Type 2 Authentication Factor

A

Something you have

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Type 3 Authentication Factor

A

Something you are or do

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cognitive Password

A

Series of questions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Synchronous vs Asynchronous Dynamic Password

A

Synchronous is time based (changes every 60 seconds(, Asynchronous changes after it is used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Type 1 Error

A

valid subject is not authenticated, false rejection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Type 2 Error

A

invalid subject is authenticated, false acceptance

24
Q

Centralized Access Control

A

all authorization verification is performed by a single entity within a system

25
Q

Decentralized Access Control

A

various entities perform authentication verification

26
Q

SSO

A

a centralized access control technique that allows a subject to be authenticated only once on a system and access multiple resources

27
Q

LDAP

A

centralized access control system, directory service for network services and assets

28
Q

Most commons and well-known ticket system

A

Kerberos

29
Q

Kerberos Architecture

A

Key Distribution Center, Kerberos Authentication Server, Ticket-Granting Ticket.

30
Q

Permissions

A

access granted for an object and determines what you can do with it

31
Q

Rights

A

the ability to take an action on an object

32
Q

Privileges

A

combination of rights and permissions

33
Q

Implicit Deny

A

access to an object is denied unless explicitly granted

34
Q

Access Control Matrix

A

table that includes subjects, objects, and assigned privileges

35
Q

Capability Tables

A

identify privileges assigned to subjects

36
Q

Constrained Interface

A

restricts what users can do or see based on privileges (disabled capabilities may be grayed out)

37
Q

Context-Dependent Control

A

requires specific activities before granting user access - ex: data flow for online transactions

38
Q

Content-Dependent Control

A

restrict access based on the content within an object (database view)

39
Q

DAC

A

allows data owner, creator, or custodian of an object to control access to it

40
Q

RBAC

A

define a subject’s ability to access an object based on their role

41
Q

TBAC

A

each user is assigned an array of tasks

42
Q

RuBAC

A

uses a set of rules to determine access (global rules)

43
Q

ABAC

A

Attribute based, uses multiple attributes for rules

44
Q

MAC

A

relies on classification lables

45
Q

Hierarchical Environment

A

ordered structure of classifications: TS, S, UC

46
Q

Compartmentalized Environment

A

no relationship between domains

47
Q

Hybrid Environment

A

Clearance + need to know

48
Q

What are the key steps in a risk management process?

A

Identifying assets, threats, and vulnerabilities

49
Q

Threat Modeling

A

identifying, understanding, and categorizing threats

50
Q

Three Threat Modeling Approaches

A

Focus on Assets, Focus on Attackers, Focus on Software

51
Q

Advanced Persistent Threat

A

group of attackers working together, advanced skills and motivation

52
Q

Access-Aggregation

A

collecting multiple pieces of nonsensitive information and combining to learn sensitive info

53
Q

Dictionary Attack

A

use every possible password in a predefined database

54
Q

Birthday Attack

A

focuses on finding collusion

55
Q

Rainbow Table Attack

A

uses large databases of precomputed hashes

56
Q

Sniffing

A

captures packets sent over a network

57
Q

Spoofing

A

pretending to be something else

cissp (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions