Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Identity and Access Management > Flashcards

Identity and Access Management Flashcards

1
Q

Access Provision Lifecycle

A

only setup account for those who require them
review account data for error/inconsistencies
audit access authorization/failures
remove access when necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Identification

A

Positive/Negative Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Authentication

A

Requires a key piece of information that only the users knows - aka password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Authorization

A

tied closely to principle of least privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Types of Authentication

A

Know, Have, Are, Somplace(GPS/Geo Location)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Passphrases

A

compared to strong password - less entropy per character but more over entropy due to length

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Password guessing

A

guessing password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Password cracking

A

determine cleartext password based on stole password hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Dictionary attack

A

word list, hash to see if matches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Hybrid

A

begin with word list and adds/changes characters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Brute force

A

attempts every possible password

All combinations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Rainbow tables

A

calculate hash for every password

Salt makes rainbow ineffective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Salt

A

random number that is hashed along with the salt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Tokens

A

Counter Based - asynchronous dynamic password token

Time-Based - Synchronous dynamic password token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Synchronous dynamic password token

A

same time (RSA token)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Asynchronous dynamic password token

A

Password available, no time limit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Biometrics Identifiers

A 
Fingerprints
Palm scan
Hand geometry
Voice print
Retina pattern
Iris scan
Facial recognition
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

False Reject Rate (FRR)

A

Type I Error

It’s me but rejects me

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

False Accept Rate (FAR)

A

Type II Error
It’s not me but accepts it - intruder
Remember Type II is worst than Type I

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Crossover Error Rate (CER)

A

Point where False Reject Rate and False Accept Rate are equal
Equal Error Rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Enrollment (Biometrics)

A

Needs to enroll in 2 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Throughput (Biometrics)

A

10 subjects/min - once ever 6 seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Key Distribution Center (KDC)

A

Vuln - contains all users password in plaintext
access to all keys
issues TGT

24
Q

Kerberos

A

symmetric encryption

***Mutual authentication is best part about it

25
Q

SESAME

A

European equivalent to Kerberos

26
Q

Directory Services

A

TCP: 389

LDAP

27
Q

Screensaves & timeout

A

Screensavers - 5 minutes

Automatic logoff after 10 minutes

28
Q

Federated Identity Management

A

users across different organization can authenticated

29
Q

Security Asssertions Markup Language (SAML)

A

standard-based means of allowing for communication of identity and authentication information.

30
Q

Service Provider (SP) (SAML)

A

application that can lever identity/auth assertion

Think of an application that is used google gmail to authenticate

31
Q

Identity Provider (IdP) (SAML)

A

This would be google gmail authenticator

32
Q

Assertions Consumer Services

A

host by the Service Provider and is the IdP sends the assertions

33
Q

Identity Provider (IDP) (OpenID)

A

sites that the sources of identify information

34
Q

Replaying Parties (RP) (OpenID)

A

sites that can use identity information from IdP

35
Q

RedirectURL (OpenID)

A

redirect URL information RP that the subject has been successfully authenticated

36
Q

RedirectURL (OpenID)

A

redirect URL information RP that the subject has been successfully authenticated

37
Q

Identity As A Service (IDaaS)

A

Single Sign-On for cloud

Dual Factor authentication and encryption critical components

38
Q

Subject: Active

A

user, process, device

Active entity

39
Q

Subject: Passive

A

files, directories, pipes

passive entity that contains or receives information

40
Q

Rules

41
Q

Labels

A

Sensitivity

42
Q

Mandatory Access Control Strengths

A

Controlled by systems, can’t be overridden

strict control/cannot share

43
Q

Mandatory Access Control (MAC) Weakness

A 
Protects information in digital form
Assumes:
trust users/admin
levels have been applies by individual
User do not share account or access
Proper physical security in place
44
Q

Discretionary Access Control (DAC)

A 
owner can change security attributes - think Windows file that can be changed by user
tabular listing (think how unix displays files across with the permission listed
45
Q

Discretionary Access Control (DAC) Strengths

A

fast and can modify their own files

46
Q

Discretionary Access Control (DAC) Weakness

A

intentionally/unintentionally grant access when they shouldn’t
Simple error cause unauthorized disclosure
DAC depends on users acting in trustworthy manner

47
Q

Non-Discretionary Access Control

A 
central authority determines which object a subject can access
Rule-based: Firewall
Role-Based: 
Task-Based: focus on task vs roles
Attribute-Based:
48
Q

Non-RBAC Role-Based Access Control (RBAC)

A

user granted access via Access Control List

49
Q

Limited RBAC Role-Based Access Control (RBAC)

A

users mapped to applications

Local system account

50
Q

Hybrid RBAC Role-Based Access Control (RBAC)

A

users assigned roles that is assigned access to systems

51
Q

Full RBAC Role-Based Access Control (RBAC)

A

access is controlled by roles and applied to applications and systems.
think Active Directory

52
Q

Attribute-Based Access Control (ABAC)

A

access decisions based on subject/object attributes, environmental conditions
Complex - e.g. based on time, where you logged in from, etc..

53
Q

Content Dependent

A

access based on data content

Think of browsing the web at work

54
Q

Context Dependent

A

Account locked out after x number of attempts

think of incrementing counter

55
Q

Captcha

A

mechanism for enforcing a context-dependent access control

56
Q

Constrained User Interface

A

Limited menu options within an application

57
Q

Temporal (Time-Based) Isolation

A

during week accept time cards, then blocks, before opening again.

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions