Exam 6 Flashcards
Which access control model allows for defining granular rules that consider user roles, time constraints, and network access restrictions?
A. ABAC
B. MAC
C. RuBAC
D. DAC
E. RBAC
Rule-based access control (RuBAC) is an access control system that allows user access to network resources according to pre-defined rules. In rule-based systems, administrators define the conditions users must meet before gaining access.
Examples of properties used for defining access policies in Attribute-Based Access Control (ABAC) model include:
A. Subject (i.e., user or process requesting access)
B. Type of action (for example “read”, “write”, “execute”)
C. Resource type (medical record, bank account etc.)
D. Environment (contextual data, such as time of day or geolocation)
E. All of the above
Attribute-based access control (ABAC), also referred to as **policy-based access control (PBAC) ** or claims-based access control (CBAC), is an authorization methodology that sets and enforces policies based on characteristics, such as department, location, manager, and time of day
Which access control model defines access control rules with the use of statements that closely resemble natural language?
A. DAC
B. ABAC
C. MAC
D. RBAC
ABAC evaluates a user’s attributes against policies to determine if they can access an object. Attributes can include a user’s credentials, the environment, or the object’s properties. ABAC uses boolean logic to grant or deny access.
According to NIST, ABAC is defined as “an access control method where subject requests to perform operations on objects are granted or denied based on assigned attributes of the subject, assigned attributes of the object, environment conditions, and a set of policies that are specified in terms of those attributes and conditions.”
Which of the access control models listed below enforces the strictest set of access rules?
A. MAC
B. RBAC
C. DAC
D. ABAC
Mandatory Access Control (MAC) is a computer security policy that limits a user’s ability to access or modify a target or object within a secured environment. MAC is a type of non-discretionary access control, meaning that users cannot override the system policy. Instead, MAC restricts access to system resources based on authorization and sensitivity
Which of the following access control methods would be the most suitable for scheduling system maintenance tasks during periods of low user activity?
A. Resource provisioning
B. Time-of-day restrictions
C. Principle of least privilege
D. Just-in-time permissions
Time of day restrictions can ensure that a user has access to certain records only during certain hours. This would make it so that administrators could update records at night without interference from other users.
The principle of least privilege is a security rule that prevents users from accessing information and resources that lie beyond the scope of their responsibilities.
True
False
In the context of IT security, the term “Biometrics” refers to both biological characteristics of the human body and behavioral traits that can be used for identification and access control purposes.
True
False
A measure of the likelihood that a biometric security system will incorrectly reject an access attempt by an authorized user is called:
A. FAR
B. CER
C. CRC
D. FRR
False Rejection Rate, or FRR, is a measure of how often a biometric authentication system incorrectly rejects an authorized user.
Which of the answers listed below refer(s) to a medium type that can be used as a hardware authentication token? (Select all that apply)
A. Smart card
B. Key fob
C. Security key
D. Passphrase
E. Biometric reader
F. RFID badge
Which of the following examples does not fall into the category of software authentication tokens?
A. QR code token
B. Security key
C. SMS-based OTP
D. Authenticator app
E. Email-based OTP
Which of the answers listed below refer to the features of a security key? (Select 3 answers)
A. Used for OTP generation, remote vehicle access, and building access
B. Hardware authentication token
C. Typically, a physical USB stick or key fob-sized device
D. Primarily used for digital security (2FA/MFA)
E. Software authentication token
G.Typically, a credit card-sized plastic card with an embedded chip
Authentication process can be based on various categories of authentication factors. These include knowledge-based factors such as usernames, passwords, PINs, or security question answers (“something you know”), possession-based factors (i.e., physical tokens) such as smart cards, key fobs, or security keys (“something you have”), inherence-based factors that include unique physical traits of each individual, such as fingerprints, iris scans, facial recognition, or voice patterns (“something you are”), or location-based factors such as geolocation data or IP addresses (“somewhere you are”). A multifactor authentication system requires the implementation of authentication factors from two or more distinct categories.
True
False
The two factors that are considered important for creating strong passwords are: (Select 2 answers)
A. Password length
B. Minimum password age
C. Password History
D. Password complexity
E. Maximum password age
A strong password that meets the password complexity requirement should contain: (Select the best answer)
A. Uppercase letters (A-Z)
B. Digits (0-9)
C. Non-alphanumeric characters if permitted (e.g., !, @, #, $)
D. Lowercase letters (a-z)
E. A combination of characters from at least 3 character groups
Which of the following passwords is the most complex?
A. T$7C52WL4SU
B. GdL3tU8wxYz
C. @TxBL$nW@Xt
D. G$L3tU8wY@z
Which password policy would be the most effective in decreasing the risk of a security breach across multiple accounts?
A. Password expiration policy
B. Minimum password age policy
C. Password reuse policy
D. Maximum password age policy
Which password policy enforces a mandatory password change after a specific time?
A. Password expiration policy
B. Password history policy
C. Minimum password age policy
D. Password reuse policy
The minimum password age policy setting determines the period of time that a password can be used before the system requires the user to change it.
True
False
The Minimum password age policy setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow password changes immediately by setting the number of days to 0.
Which of the answers listed below refers to a software tool specifically designed to store and manage login credentials?
A. BitLocker
B. Password manager
C. Key escrow
D. Password vault
Which of the following technologies cannot be used as a passwordless authentication method?
A. Biometrics
B. Hardware tokens
C. QR codes
D. OTPs
E. Passkeys
F. All of the above can be used as a means for passwordless authentication
Which of the answers listed below refers to a solution designed to minimize the risk of unauthorized access to privileged accounts?
A. Principle of least privilege
B. Just-in-time-permissions
C. Passwordless authentication
D. Multifactor authentication
A security solution that provides control over elevated (i.e., administrative type) accounts is referred to as:
A. MFA
B. IAM
C. SSO
D. PAM
Privileged access management (PAM) is a cybersecurity strategy that protects an organization’s critical resources by monitoring and controlling access to privileged accounts. PAM uses a combination of people, processes, and technology to help prevent unauthorized access to systems, applications, and data.
Which of the terms listed below refer(s) to the concept of ephemeral access, where access to systems, resources, or permissions is provided for a limited duration? (Select all that apply)
A. TOTP
B. OTP
C. Just-in-time permissions
D. User password
E. API key
Which of the following answers refers to an encrypted database that provides secure storage space for user credentials?
A. Secure enclave
B. Password manager
C. Rainbow table
D.Password vault
