Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security+ > Module 04 - Identity and Acess Management > Flashcards

Module 04 - Identity and Acess Management Flashcards

1
Q

Definition:
Non-repudiation

A

Cannot deny having done something in systems or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Acronym:
CSF

A

Cybersecurity Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Acronym:
NIST

A

National Institute of Standards and Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

According to NIST, what are the classification of security tasks?
[NUST Categories]

A
  1. Identify
  2. Protect
  3. Detect
  4. Respond
  5. Recover
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Definition:
Gap Analysis

A

Process that identifies how security systems deviate from outcomes required, or recommended, by CSTs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Definition:
Access Control

A

Defines how subjects interact with objects.

Subjects => Can be granted access to resources

Objects => Resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Acronym:
IAM

A

Identity and Access Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Definition:
Identity and Access Management - IAM systems

A

System that implements access controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the processes of IAM?

A
  1. Identification
  2. Authentication
  3. Authorization
  4. Accounting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Acronym:
AAA

A

Authentication, Authorization and Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Definition
Zero Trust

A

Security model that assumes that all devices, users, and services are not inherently trusted, regardless of whether inside or outside a network’s perimeter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the main concepts of Zero Trust Model?

A
  1. Adaptive identity [UBA]
  2. Threat scope reduction [Principle of Least Privilege]
  3. Policy-drive access control [Device posture, network context, user identity]
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Definition:
Adaptive identity [Zero Trust Concept]

A

Recognition of identity not being static.

UBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Definition:
Threat scope reduction [Zero Trust Concept]

A

Access to resources are only to the ones needed to complete a task.

[Principle of least privilege]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Definition:
Policy-driven access control [Zero Trust Concept]

A

Access Control policies enforces access restriction based on user identity, device posture and network context.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Definition:
Device Posture

A

Security status of a device, including its security configurations, software versions, and patch levels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In Zero Trust architecture, what are the planes?

A

Control and data planes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Definition:
Control plane

A

Manages policies that dictate how users and devices are authorized to access network resources.

Divided in Policy Engine and Policy Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Definition:
Data plane

A

Where a subject makes access requests for a given resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Definition:
Policy Engine

A

Responsible for making authentication and authorization decisions per-request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Definition:
Policy Administrator

A

Issues access tokens and establishes or tears down sessions based on the decisions made by the policy engine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

List the access control best practices

A
  1. Principle of least privilege
  2. Need to know [Information classification]
  3. Separation of Duties [Conflict of interest]
  4. Multi-Factor Authentication
  5. Mutual Authentication
  6. Time of day restrictions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Acronym:
MFA

A

Multi-Factor Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the common methods of controlling access?

A

Implicit Deny
Explicit Deny
Explicit Allow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Acronym:
ACL

A

Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Acronym:
MAC [Access Control]

A

Mandatory Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Acronym:
DAC

A

Discretionary Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Acronym:
RBAC

A

Role-Based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Acronym:
ABAC

A

Attribute-Based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

List the types of Access Controls

A

Discretionary Access Control [DAC]
Mandatory Access Control [MAC]
Role-Based Access Control [RBAC]
Attribute-Based Access Control [ABAC]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Definition:
Discretionary Access Control - DAC

A

In the DAC Model, every resource has an owner which has full control over the resource, and they can modify its access control list (ACL) to grant rights to others.

Discretionary => By one’s judgment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Definition:
Mandatory Access Control - MAC

A

Model based on security clearance levels.

Each object is given a classification label, and each subject is granted a clearance level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Definition:
Role-Based Access Control - RBAC

A

Permissions depends on the tasks that an employee or service must be able to perform.

Each set of permissions is a role, or a group account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Definition:
Attribute-Based Access Control - ABAC

A

Based on a combination of subject and object attributes plus any context-sensitive or system-wide attributes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Definition:
Rule-Based Access Control

A

Any sort of access control model where access control policies are determined by system-enforced rules rather than system users.

Anything but discretionary access control models.

Ex: RBAC, ABAC, and MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Definition:
Provisioning

A

Setting up a service according to a standard procedure or best practice checklist.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Definition:
Deprovisioning

A

Removing the access rights and permissions allocated to a subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Time-based restrictions:

A

A time-of-day restrictions policy [Login hours]
A duration-based login policy
Impossible travel time/risky login policy
Temporary permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Identification x Authentication

A

Identification is saying who you are

Authentication is confirming who you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

List the authentication factors

A
  1. Something you know
  2. Something you are
  3. Somewhere you are
  4. Something you can do
  5. Something you exhibit
  6. Someone you know [CA or Attestation]
  7. Something you have
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Definition and list:
Hard authentication token

A

Token generated within a secure cryptoprocessor

  1. Smart card
  2. OTP
  3. Security Key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Definition and list:
Soft authentication token

A

OTP generated by the Identity provider (IdP) and transmitted to the supplicant.

  1. Email
  2. SMS
  3. Authentication app
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Acronym:
IdP

A

Identity provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Definition:
Passwordless

A

No longer processes knowledge-based factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Acronym:
LSASS

A

Local Security Authority Subsystem Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Acronym:
NTLM

A

NT LAN Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Acronym:
VPN

A

Virtual Private Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Acronym:
SAM [Windows File]

A

Security Accounts Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

List the windows authentication scenarios

A
  1. Windows local sign-in or interactive logon
  2. Windows network sign-in
  3. Remote sign-in
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What protocols are responsible for a network sign-in, in Windows?

A

Kerberos and NTLM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Acronym:
SSH

A

Secure SHell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Acronym:
PAM
Type of authentication

A

Pluggable Authentication Module

53
Q

In linux, what’s the /etc/passwd file?

A

It’s where user account names are stored

54
Q

In linux, what’s the /etc/shadow file?

A

It’s where user account password hashed are stored

55
Q

What’s the protocol used in network sign-in, in Linux?

56
Q

Definition:
Directory Services

A

Service that stores information about users, computers, security groups/roles, and services.

57
Q

What’s the protocol responsible for directory services?

A

LDAP - Lightweight Directory Access Protocol

58
Q

Acronym:
LDAP

A

Lightweight Directory Access Protocol

59
Q

Acronym:
SSO

A

Single Sign-On

60
Q

Definition:
Single Sign-On - SSO

A

Authentication method that requires only once authentication and recieves authorizations on other compatible applications to be logged in

61
Q

Definition:
Kerberos

A

Single sign-on network authentication and authorization protocol.

Named after the three-headed guard dog of Hades (Cerberus)

62
Q

Acronym:
KDC

A

Key Distribution Center

63
Q

Definition:
Key Distribution Center - KDC

A

System that vouches tokens for identities, made out of two systems:
- Authentication Service (AS)
- Ticket Granting Service (TGS)

64
Q

True or False:
Kerberos protocol sends the password encrypted in the network

65
Q

In kerberos talk, what are principals

A

Users or applications that authenticates

66
Q

How is the request for a TGT made?

A

By encrypting the date and time on the local computer with the user’s password hash as the key, and sending to the AS

67
Q

Acronym:
TGT

A

Ticket Granting Ticket

68
Q

Definition:
Token Granting Ticket - TGT

A

Identifies a principal but doesn’t provide access to any resource

69
Q

Definition:
Federation [Authentication]

A

The network trusts accounts created and managed by a different network. The model is similar to Kerberos SSO

70
Q

List federated network protocols

A
  1. SAML - Security Assertion Markup Language
  2. SOAP - Simple Object Access Protocol
71
Q

Acronym:
SAML

A

Security Assertion Markup Language

Written in XML - eXtension Markup Language

72
Q

Acronym:
SOAP

A

Simple Object Access Protocol

Written in XML - eXtension Markup Language

73
Q

Acronym:
XML

A

eXtension Markup Language

74
Q

Acronym:
OAuth

A

Open Authentication

75
Q

Definition:
Open Authentication - OAuth

A

Facilitate the sharing of information (resources) within a user profile between sites.

Uses REST APIs for communication and JWTs for authentication

76
Q

Acronym:
API

A

Application Programming Interface

77
Q

Acronym:
REST

A

REpresentational State Transfer

78
Q

Acronym:
JWT

A

JSON Web Token

79
Q

Acronym:
JSON

A

JavaScript Object Notation

80
Q

Definition:
Biometric authentication

A

Based on a unique physical attribute or characteristic

81
Q

Definition:
False rejection rate (FRR)

A

Where a legitimate user is not recognized.
Type I error or false non-match rate (FNMR)

82
Q

Definition:
False acceptance rate (FAR)

A

Where an interloper is accepted.
Type II error or false match rate [FMR]

83
Q

Definition:
Crossover Error Rate (CER)

A

The point at which FRR and FAR meet

The lower the more efficient and reliable the technology.

84
Q

List the most common biometric information

A
  1. Fingerprint
  2. Retina
  3. Iris
  4. Facial
  5. Voice
  6. Vein
  7. Gait [walk]
85
Q

Definition:
Authorization

A

process of determining privileges of an entity and enforcing them.

86
Q

List the types of permissions

A
  1. Effective permissions
  2. Deny permissions
  3. Cumulative permissions
87
Q

Advantages of Hierarchical database as in directory sevices

A
  1. Organization
  2. Replication
  3. Delegation
  4. Scalability
88
Q

List Active Directory Components

A
  1. Domain
  2. Trees and forests
  3. Organizational Units
  4. Generic container
  5. Object
  6. Domain Controller
89
Q

Definition:
Tree [Directory Services]

A

Group of related domains that share the same DNS namespaces.

90
Q

Definition:
Forest [Directory Services]

A

Highest level of the organization hierarchy and is a collection of related domain trees.

91
Q

Definition:
Policy [Directory Service]

A

Set of configuration settings applied to users or computers

92
Q

Acronym:
GPO

A

Group Policy Object

93
Q

Definition:
Group Policy Object - GPO

A

Collection of files with registry settings, scripts, templates, and software-specific configuration values.

Collection of Group Policy configurations.

94
Q

What are the types of GPOs and when are applied?

A

Computer and User configuration types.

Computer => Applied when boots
User => Applied when log on

95
Q

What’s the order GPOs are applied?

A
  1. Local
  2. Site
  3. Domain
  4. OU

LSDOU - Local Site Domain OU

96
Q

Definition:
Hardening

A

To stregthen

97
Q

List Hardening Authentication Methods

A
  1. Password Policies
  2. MFA
  3. Account restrictions
  4. Account Monitoring
  5. Account Maintenance
  6. Limit Remote Access
  7. Account Lockout Policies
98
Q

List Smart Card Benefits

A
  1. Tamper-resistant storage por PIIs
  2. Isolated security-related operations
  3. Portable security credentials
99
Q

List Smart Card Weaknesses

A
  1. Microprobing (Possibility to interfere with chip)
  2. Software attacks
  3. Eavesdropping
  4. Fault generation
100
Q

List the options for storing directory information in Linux

A
  1. Local file system
  2. LDAP-Compliant database
  3. Network Information System (NIS)
  4. Windows domain
101
Q

Acronym:
NIS

A

Network Information System

102
Q

Definition:
Network Information System - NIS

A

Allows many Linux computers to share common user accounts, group accounts, and passwords.

103
Q

In linux, what’s the /etc/group file?

A

contains information about each user group.

104
Q

In linux, what’re the managing users configuration files?

A
  1. /etc/default/useradd
  2. /etc/login.defs
  3. /etc/skel
105
Q

In linux, what’s the /etc/default/useradd file?

A

Contains default values used by the useradd utility when creating a user account

106
Q

In linux, what’s the /etc/login.defs file?

A

Contains configurations of login, such as password encryption in shadow file, or password expiration values.

107
Q

In linux, what’s the /etc/skel file?

A

Contains a set of configuration file templates that are copied into a new user’s home directory when it is created

108
Q

List Linux User Management Commands

A
  1. useradd
  2. passwd
  3. usermod
  4. userdel
109
Q

List Linux User Security Commands and what they do?

A
  1. chage (Set user passwords to expire)
  2. ulimit (Limits computer resources used for applications launched from the shell)
110
Q

List Linux Group Commands

A
  1. groupadd
  2. groupmod
  3. groupdel
  4. gpasswd
  5. newgrp [Change group ID]
  6. usermod [Mod group membership of a user]
  7. groups [display groups a user is in]
111
Q

List VPNs architectures

A
  1. site-to-site
  2. client-to-client
  3. host-to-host
112
Q

Definition:
Client-to-client VPN

A

Connects a client on a endpoint to a VPN gateway which it’s inserted on the LAN

113
Q

Definition:
Site-to-site VPN

A

Connects two or more private networks, it connects the edge gateways of the private network on a tunnel connection

114
Q

Definition:
Host-to-host VPN

A

Securing traffic between two computers where the private network is not trusted.

115
Q

List most common VPN protocols

A
  1. PPTP - Point-to-Point Tunneling Protocol (Deprecated)
  2. TLS - Transport Layer Security
  3. IPSec - Internet Protocol Security
116
Q

Acronym:
RDP

A

Remote Desktop Protocol

117
Q

Acronym:
VNC

A

Virtual Network Computing

118
Q

Definition
VNC - Virtual Network Computing

A

Remote access tool and protocol.

119
Q

Definition:
AAA server

A

Handles user requests for access to remote computer resources.

2 solutions: RADIUS and TACACS+.

120
Q

Definition:
RADIUS

A

AAA Server used by Microsoft.

  • Allows separation of Accounting to different servers
  • Challenge-response method for authentication.
  • Uses UDP ports 1812 (Auths) and 1813 (Account)
  • Vulnerable to buffer overflow attacks.
121
Q

Definition:
TACACS+

A

AAA CISCO server.
- TCP port 49.
- Supports more protocol suites than RADIUS.
- Provides three protocols, one each AAA

TACACS and XTACACS are older protocols

122
Q

Acronym:
RADIUS

A

Remote Authentication Dial-In User Service

123
Q

Acronym:
TACACS

A

Terminal Access Controller Access-Control System

124
Q

List LDAP authentication options

A
  1. No authentication
  2. Simple bind [DN + cleartext passwd]
  3. Simple Authentication and Security Layer (SASL)
  4. LDAPS
125
Q

Acronym:
SASL

A

Simple Authentication and Security Layer

126
Q

Definition:
Simple Authentication and Security Layer - SASL

A

Means the client and server negotiate using a supported authentication mechanism, such as Kerberos.

127
Q

Acronym:
LDAPS

A

LDAD Secure

Security+ (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions