Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP - 2018 > Domain 5 - Identity and Access Management > Flashcards

Domain 5 - Identity and Access Management Flashcards

1
Q

Information that is created, consumed or modified by an organization. Could be labeled as a ______?

A

Asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

All about the relationship between users and data.

A

Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What control type is defined by the following:

a. Fences
b. locks
c. bio metrics
d. mantraps
e. lighting
f. separation of duties
g. job rotation
h. data classification
i. CCTV

A

Preventative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What control type is defined by the following:

a. security guards
b. motion sensors
c. audit trails
d. review of CCTV footage
e. honeypots | honeynets
f. IDS
g. incident response

A

Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What control type is defined by the following:

a. rebooting a system
b. terminating a system
c. A/V software quarantine
d. data restoration
e. IPS

A

Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What control type is defined by the following:

a. policies
b. awareness training
c. locks
d. fences
e. warning signs
f. guards
g. mantraps
h. CCTV

A

Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What control type is defined by the following:

a. fault tolerant systems
b. system clusters
c. imaging
d. mirroring

A

Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What control type is defined by the following:

a. procedures
b. exit signage
c. announced commands

A

Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What control type is defined by the following:

a. When guard is not present to sign in, use badge to swipe
b. when badge swipe does not work, use intercom and CCTV system to request access.

A

Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Provides AAA services between network access servers and an authentication server. The network access server is the client of the ______ server.

A

RADIUS (PROTOCOL for AAA)

RADIUS only encrypts the password exchange, not the rest of the authentication traffic. Uses UDP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Open source solution for TACACS and XTACACS. Separates AAA processes, allowing them to be hosted separately if necessary.

A

TACACS+ (PROTOCOL for AAA)

Encrypts ALL authentication information and uses TCP 49

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Uses TCP port 3368 or Stream Control Protocol (SCTP) port 3668. Supports IPSEC and TLS

A

Diameter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What process defines the following:

a. Identification
b. Authentication
c. Authorization
d. Access / Auditing

A

IAAA

Access Control Life cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

“subject claiming an identity”

A

Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

“Verifies / validates identity of subject through comparison of factors provided (provides validity) “

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

“Subject is granted access to object based on validated identity”

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

“Subject interacts with object”

A

Access

Tracked through auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Something you have …

A

Smartcard or Token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Something you know …

A

Pin or password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Something you are …

A

Biometric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

3 categories of control are ______

A

Administrative, Technical and Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

2 types of bio-metrics are ?

A

Physiological (Fingerprints …etc)

and

Behavioral (Signature and Keystrikes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

All users authenticate back to a central authentication server from remote offices.

A

Centralized Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Authenticate once to centralized access control

A

Single sign On

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

x.500 standard

A

LDAP

26
Q

x.400 Standard

A

Email

27
Q

Ticket bases authentication solution relying on symmetric encryption using AES. . Provides confidentiality and integrity for authentication traffic end to end

A

Kerberos

28
Q

Kerberos:

Verifies and accepts/rejects tickets based on authenticity and timeliness

A

Authentication Server

29
Q

Kerberos:

Issues tickets to authorized users

A

Ticket Granting Server

30
Q

Kerberos:

An encrypted message that provides some form or type of proff depending on what type of ticket it is. 2 Types of tickets.

Ticket Granting Ticket
Service ticket

A

Ticket

31
Q

Kerberos:
Proof that subject has authenticated through a KDC successfully and is authorized to request additional service ticket to access objects

A

Ticket Granting Ticket (TGT)

32
Q

Kerberos:

Proof that a subject is authorized to access an object

A

Service Ticket (ST)

33
Q

A third party solution that provides identity and access management. These are clod based servies that broker identifity nad access mgmt functions to target systems on customers’ premises and/or in the cloud.

A

Identity as a Service (IDaaS)

34
Q

Access to an object is denied unless access has been explicitly granted

A

Implicit Deny

35
Q

Table that is made up of subjects, objects and assigned privileges. System checks the matrix to see whether a subject has appropriate privileges to carry out an activity.

A

Access Control Matrix

36
Q

Sub focused, as opposed to an ACL which is object focused.

A

Capability Table

37
Q

A view that only allows access to features/abilities granted to the subject

Database Views!!!

A

Constrained Interface

Database Views!!!

(Limited menus inside of an application. Not being able to see admin interface but only what you are entitled to)

38
Q

Bases access control authorization on roles or functions, that are assigned to a user within an organization.

A

Role Based Access Control (RBAC)

39
Q

grants use access to data or an application using ACLS

A

NON-RBAC

40
Q

Users are mapped to roles within a single application rather than through an organization wide role structure

A

Limited RBAC

41
Q

Applies a role to multiple applications or systems based on a users specific role within the organization.

A

Hybrid RBAC

42
Q

Roles are defined organizations policy and access control infrastructure and then applied to applications and systems across the enterprise

A

FULL RBAC

43
Q

access is based on list of predefined rules that determine what access should be granted.

Most commonly a form of DAC.

A

Rule based access control

Example: Firewalls

44
Q

Lattice-based - requires the system to manage access controls in accordance with the organizations security policies and where system owners do not want to allow users to potentially contradict or bypass organizationally mandated access.

A

Mandatory Access Control

45
Q

Restrict access to data based on the content of the object.

VIEWS IN A DATABASE

A

Content-Dependent Access Control

46
Q

Based on the context or specific actions that are happening (or not)

A

Context-Dependent Access Control

47
Q

Use of rules defining one or more attributes

A

Attribute Based Access Control

48
Q

Bad actor looking to do harm

A

Cracker

49
Q

Attempt to bypass or circumvent access control methods

A

Access Control Attacks

50
Q

Collecting multiple pieces of nonsensitive information that are combined to understand sensitive information

A

Access aggregation Attacks

Counter measures: Defense in depth with least privilege can be effective counter measure.

51
Q

Attempt to discover passwords by using all possible passwords in a predefined list

A

Dictionary Attack

Counter measures: Complex changing passwords, every 30 days

52
Q

Combination of dictionary and brute force attacks

A

Hybrid Attack

Counter measures:Complex changing passwords, every 30 days

53
Q

All about collisions!! 2 things to keep in mind:

  1. small is bad
  2. same hash - different password = SUCCESS
A

Birthday Attack

Counter measures: Large work factor

54
Q

Attempt to shortcut using tables of pre-computed hash values

A

Rainbow table attack

Counter measures:

a. Salt
b. Pepper

55
Q

Attacking specfic group of users

A

Spear Phisihing

56
Q

Phishing attack targeting senior executives

A

Whaling

57
Q

Pretending to be someone else in hope of assuming their identify

A

Spoofing

Countermeasure: MFA

58
Q

An attempt to gain trust of targeted individual in hopes of getting them to reveal useful information.

A

Social Engineering Attack

59
Q

Phishing attack using VOIP or IM

A

Vishing

60
Q

Side channel
differential power analysis
timing

A

Smart Card Attacks

61
Q
  1. Control Physical Access to System
  2. Control electronic access to system
  3. create and enforce a strong password policy
  4. hash, salt & pepper password
  5. employ password masking, obfuscation and tokenization
  6. MFA
  7. Account lock controls
  8. last logon notification
  9. Awareness Training
A

Protection Methods

CISSP - 2018 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions