Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security > Identity and access management > Flashcards

Identity and access management Flashcards

1
Q

What provides a near real-time account creation and provisioning process?

A

JIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What error type presents an organization with higher risk impacts?

A

Type 2 - granting access when it should be denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Is the physiological characteristic being
measured – such as a retina scan – correctly referred to as a security
token

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

the point of equilibrium between false acceptance and false rejection in any authentication or authorization process

A

The cross-over error rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where there are more false acceptances than rejections’ is known as a

A

FAR False acceptance rate or type 2 error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

where there are more false rejections than acceptances’ is a

A

False Rejection Rate (FRR) or Type I error and measures the rate at which the system fails to recognize a legitimate identity and denies access, again, as a fraction of the total number of attempts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the three A’s of access management

A

Authentication
Authorisation
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

There are two primary access control systems,

A

logical and physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This form of access control allows for
the greatest flexibility in controls along
with the greatest vulnerabilities.

A

DAC Discretionary Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This facilitates the setting of stricter
permissions for access, based on risk. For
this reason, it is often called risk-intelligent
access control.

A

Attribute based access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When considering modern implementations of access control, which model maps users to applications and then roles?

A

Limited RBAC - In a limited RBAC (Role-Based Access Control) model, the user is first assigned access permission to an application and to a given role within that application; so, a user might have access to a financial application but only as a user, not a developer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Authorization can have two meanings

A
  1. The initial decision to grant certain permissions to an identity, with respect to actions they can take in the future regarding particular objects.
  2. The real-time confirmation that a request to perform an action, by a subject, toward a given object is allowed by the privileges that have been defined for that subject, object, and other criteria that may apply.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Is kerberos an example of an identity store

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Is x.500 an identity store

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

This is a lightweight version of x.500

A

LDAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

the Achilles’ heel of Kerberos

A

encryption processes are ultimately based on passwords. Therefore, it can fall victim to traditional password- guessing attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Where is a potential single point of failure for kerberos

A

KDC - it is therefore not unusual to see many of them on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the three roles within Security Assertion Markup Language (SAML)?

A

Identity provider, relying party, user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which component in Security Assertion Markup Language (SAML) defines how attributes, authentication and authorization are exchanged?

A

Assertions

20
Q

What do bindings do in SAML

A

Bindings define how SAML assertions and protocol message exchanges are conducted with response/request pairs.

21
Q

What function does a credential management system perform?

A

It is the binding between an authenticator and an identifier.

22
Q

Which fundamental security model is composed of a set of generic rights and a finite set of commands?

A

Harrison, Ruzzo, Ullman

23
Q

This model is very similar to the Graham–Denning model, as it is also concerned with situations in which a subject should be restricted from gaining particular privileges.

A

Harrison, Ruzzo, Ullman

24
Q

The labels and data constructs that all subjects and objects must have are considered to be what?

A

Identities

25
Q

____________ can take the form of many things from a Media Access Control (MAC) address to a username.

A

Identities

26
Q

Devices, human or non-human users (with usernames or user IDs or not) and software tasks initiated on behalf of users, are known as

A

Entities

27
Q

Devices, human or non-human users (with usernames or user IDs or not) and software tasks initiated on behalf of users, are known as entities within an organisation. These entities have unique characteristics. The amalgamation of these elements is referred to

A

Identities

28
Q

With version OAuth 2.0 we see several changes the most noteworthy of which are

A
  1. V2.0 is transport-dependent (version 1.0 was not) and requires the use of HTTPS over TLS
    (Transport Layer Security).
  2. Access tokens are encrypted in transit
29
Q

Is OAuth 2.0 transport dependent

A

Yes, it requires the use of HTTPS over TLS (Transport Layer Security).

30
Q

This protocol, which runs on top of OAuth 2.0, provides authentication carried out by
the authorization server and is the identity layer that verifies the identity of the user.

A

OpenID connect

31
Q

OpenID Connect

A
  • runs on top of OAuth 2.0
  • is the identity layer that verifies the identity of the user
32
Q

Why are SAML and Oauth different to Kerberos

A

Kerberos is similar and provides a three-step process for identification and authorization but is generally used more within the organization and not between organizations.

33
Q

SP 800-63-3

A

The digital identity management guidelines

34
Q

What are the three digital identity assurance levels outlined in SP 800-63-3

A

IAL1 - self asserted
IAL2 - identifying attributes supplied remotely
IAL3 - in person identifying attributes + identifying attributes verified by authorised credential provider

35
Q

At which Identity Assurance Level (IAL) do organizations like Facebook, LinkedIn or Gmail function when allowing users to create accounts with their services?

A

IAL1

36
Q

What component, found in Kerberos, is responsible for creating and issuing access tokens to authenticated users

A

The Ticket Granting Service (TGS) creates and issues service tickets (tokens) based on successfully receiving a valid Ticket Granting Ticket (TGT).

37
Q

The Ticket Granting Service (TGS) creates and issues service tickets (tokens) based on successfully receiving a valid

A

Ticket Granting Ticket (TGT).

38
Q

The TGT is produced by the ______________________ after a successful logon.

A

Authentication Server (AS)

39
Q

The TGS and AS are components found within the ________________________

A

Key Distribution Center (KDS)

40
Q

OpenID Connect is an implementation of the authorisation framework

A

Oauth2

41
Q

Tickets are stored in the ___________ on computers, which are non-pageable areas of memory

A

Kerb Tray

42
Q

When the user is authenticated to the AS, it receives a TGT. Does this permit access?

A

The TGT only allows the user to request access, it does not automatically mean the
user receives access

43
Q

In Kerberos what is an attractive vector for DoS attacks.

A

Kerberos’s processes are extremely time sensitive and often require the use of Network Time Protocol (NTP) to ensure times are synchronized.

44
Q

In almost all cases, organizations and their security teams should be able to define sets or patterns of user activities that are acceptable and expected, in most, if not all circumstances.

A

User behavior review

45
Q

sometimes called proactive monitoring, this involves having external agents
run scripted transactions against a web application

A

Synthetic performance monitoring,

46
Q

A variety of different systems and processes can benefit
from synthetic performance monitoring. These include

A
  • Website monitoring
  • Database monitoring
  • TCP port monitoring
  • Service-level agreement validation

Security (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions