FOS

Question 1

What are the 3 parts of the CIA triad and their objectives?

Answer 1

Confidentiality - Ensures info is only accessible. to those with the appropriate authorization.

Integrity - ensures that data remains accurate and unaltered unless modification is required.

Availability - ensures that information and resources are accessible and functional when needed by authorized users.

Question 2

What are the 3 parts of AAA and their objectives?

Answer 2

Authentication - the process of verifying the identity of a user or system

Authorization - defines what actions or resources a user can access.

Accounting - The act of tracking user activity and resource usage, typically for audit or billing purposes

Question 3

What is Zero Trust?

Answer 3

Security model that operates on the principle that no one, whether inside or outside the org, should be trusted by default

Question 4

What does the Control Plane define?

Answer 4

Policies and Procedures

Question 5

What does the Data Plane do?

Answer 5

Ensures the policies and procedures defined in the control plane are being enforced.

Question 6

What are the parts of the Zero Trust Control Plane, and what do they do?

Answer 6

1. Adaptive Identity - User adaptive identities rely on real-time validation that considers the user’s behaviour, device location, and other factors.
2. Threat Scope Reduction - Limit the user’s access to only what they need for their work tasks because this drastically reduces the network’s potential attack surface.
3. Policy-Driven Access Control - This entails developing, managing, and enforcing user access policies based on their access and responsibility.
4. Secured Zones - Isolated environments within a network that are designed to house sensitive data.

Question 7

What are the parts of the Zero Trust Data Plane, and what do they do?

Answer 7

1. Subject/System - Refers to the individual or entity attempting to gain access. Verify authenticity before giving access.
2. Policy Engine - Cross-reference the access request with its pre-defined policies
3. Policy Administrator - Used to establish and manage the access policies. Dictates who gets access to what.
4. Policy Enforcement Point - Final step in the process. Allow or restrict access, and it will effectively act as a gatekeeper to the sensitive areas of the systems or networks.