Identification, Authentication, Authorization

Question 1

Identify these Access Control Terminologies:
1) Subject
2) Object
3) Reference Monitor
4) Operation

Answer 1

1) The user or process that wants access to a resource.
2) The specific resource.
3) The access control rule for the object.
4) The action taken by a subject on an object.

Question 2

Describe these Access Control Principles:
1) Seperation of Duties
2) Need-to-Know
3) Principle of Least Privilege

Answer 2

1) Ensures that no single individual has rights to perform all functions.
2) Access is only granted to required information to perform a task.
3) Users are only given the minimum access to a system that is required to perform their role.

Question 3

Describe these Access Control Models:
1) MAC
2) DAC
3) RBAC
4) RB-RBAC

Answer 3

1) Only admins have the rights to assign privileges
2) End user has complete access to the informatio they own.
3) Permissions are assigned based on user roles.
4) Permissions are assigned to a user dynamically.

Question 4

What are these 2FA Techniques:
1) OATH
2) HOTP
3) OCRA
4) TOTP

Answer 4

1) Is an open standard to secure online transactions based on 2FA.
2) The OTP is moved based on a counter.
3) A challenge-response authentication method based on random questions.
4) The OTP is based on a time-event.

Question 5

What are the types of Authorization Systems:
1) Centralized
2) Decentralized
3) Implicit
4) Explicit

Answer 5

1) Authorization is performed by a single unit.
2) Each network maintains its own authorization unit.
3) Users can access resources on the behalf of others.
4) Maintains authoizations for each requested object.

Question 6

Describe these types of accounts:
1) User
2) Guest
3) Service
4) Admin
5) Privileged
6) Shared/Generic
7) Application
8) Group
9) Third-party

Answer 6

1) Default accounts of the OS
2) Least privileged account created to share system resources.
3) Accounts that allow an application or service to communicate with the OS.
4) Privileged accounts that can perform system-level functions.
5) Have admin control over one or several systems.
6) Credentuals are amongst multiple users.
7) Used by applications to access databases and execute scripts
8) Simplifies the process of granting rights to individual users.
9) Handles cloud applications or other third-party services.