Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP2020 > Domain 5 - Identity And Access Management > Flashcards

Domain 5 - Identity And Access Management Flashcards

1
Q

Low security cost because security is configured based on roles.

A

Role-based access control (RBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Easier to implement than other access control models.

A

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Is not user friendly.

A

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

More user friendly than other access control models.

A

Discretionary Access Control (DAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Allow the data owner to determine user access rights.

A

DAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If a user needs access to a file, he only needs to contact the file owner.

A

DAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Is not discretionary in nature.

A

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

is discretionary in nature.

A

DAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Is not used in a highly secure environment.

A

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Use in a highly secure environment.

A

Mandatory Access Control (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Every subject and object is assigned a security label.

A

MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Is easy to enforce minimum privilege for general users.

A

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Users are assigned into roles based on the structure of the organization, which is usually hierarchical.

A

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A popular access control model used in commercial applications, especially large network applications.

A

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Access Control models considered non-discretionary in nature.

A

RBAC, MAC, and context-based access control (CBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

This method type relies on security policies and security labels to determine an object’s access to resources.

A

Non-discretionary access control method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

This type of access control allows the resource owner to determine the level of resource access given to a user.

A

Discretionary Access Control (DAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

These type of method of access control is usually managed by a central administrator who determines that the subject’s access rights are based on security policy and the user’s roles and responsibilities related to his duties in the organization.

A

Non-discretionary access control method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Benefits of Role-based access control.

A

Easy to implement and manage; cost effective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Drawbacks of Role-based access control.

A

Not user friendly, not discretionary, not good for highly secure environments.

21
Q

Popular access control model used for commercial applications.

A

Role-based access control

22
Q

User name + password

A

one-factor authentication (something you know)

23
Q

User name + password + smart card

A

two-factor authentication (something you know and something you have)

24
Q

User name + password + smart card + fingerprint

A

three-factor authentication (something you know, something you have, something you are)

25
Q

Allows access based on a user’s or a group’s identity.

A

DAC

26
Q

What is a Preventative Access Control?

A

A Preventitive Control attempts to stop unwated access

27
Q

What is a Dectective Access Control?

A

A Detective Control attempts to discover or detect unwanted or unauthorized activity

28
Q

What is a Corrective Access Control?

A

A Corrective Access Control modifies the enviroment to return systems to a normal after an unwanted or unauthorized activity has occurred

29
Q

What is a Detettent Access Control?

A

A Deterrent Access Control attempts to discourage security policy violations

30
Q

What is a Recovery Access Control?

A

A Recovery Access Control attempts to repair or restore resources, functions, and capabilities after a security policy violation.

31
Q

What is a Directive Access Control?

A

A Directive Access Control attempts to direct, confine, or control the actions of subjects to force or encourage compliance with security policies.

32
Q

What is a Compensating Access Control?

A

A Compensating Access Control provides an alternative when it isn’t possible to use a primary control, or when necessary to increase the effectiveness of a primary control.

33
Q

What is an Administrative Access Control?

A

An Administrative Access Control are the policies and procedures defined by an organizations security policy , regulations or requirements.

34
Q

What is a Logical/Technical Access Control?

A

Logical Access Controls (also known as technical access controls) are the hardware or software mechanisms used to manage access and to provide protection for resources and systems.

35
Q

What is a Physical Access Control?

A

Physical Access Controls are items that you can physically touch (doors, gates etc).

36
Q

What Identification as it relates to Authentication?

A

Identifiction is how you claim your identity to a system such as a username. Identification and Authentication always occur together as a single two-step process.

37
Q

What is Authentication as it relates to Identification?

A

If Identification is the username that you provide and Authentication would be a password. Identification and Authentication always occur together as a single two-step process.

38
Q

What is Authotization as it relates to IAAA?

A

Subjects are granted access to objects based on proven identies. For example, administrators grant users access to files based on the users proven identity.

39
Q

What does IAAA stand for?

A

Identify, Authentication, Authorization and Accountability

40
Q

What is a Type 1 Authentication Factor?

A

Type 1 authentication is something that you know

41
Q

What is a Type 2 Authentication Factor?

A

Type 2 authentication factor is something you have.

42
Q

What is a Type 3 Authentication Factor?

A

Type 3 authentication factor is something you are

43
Q

What is context aware authnetication?

A

Location of the user, time of day, mobile device etc

44
Q

What is a cognitive password?

A

A cognative password is a series of challenge questions about facts or predefined responses that only the subject should know

45
Q

What type of certificate does a Smartcard use?

A

Asymmetric

46
Q

What is a Common Access Card or a Personal Identity Vertification Card?

A

It’s a smart card with the employees photo on it which they wear as they walk around the building. This is used in government buildings.

47
Q

What is a Token Device?

A

OTP tokens like RSA tags

48
Q

What is a Synchronous Dynamic Password Token?

A

Hardware tokens that create synchronous dynamic passwords are time-based and synchronized with an authentication server. Usually every 60 seconds.

49
Q

What is an Asynchronous Dynamic Password Token?

A

Does not use a clock, instead it generates the password based on an algorithm and an incrementing counter. Each time you log in it will create a new password token.

CISSP2020 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions