Question 1

When LDAP traffic is made secure by using Secure Sockets Layer (SSL)or Transport Layer Security (TLS),what is this process called?

Accepted Answer

A) SAML 
B) LDAPS 
C) TACACS 
D) SDML 
A) SAML 
B) LDAPS 
C) TACACS 
D) SDML B

Question 2

List three major access control models.

Accepted Answer

There are five major access control models: Mandatory Access Control (MAC),Discretionary Access Control (DAC),Role Based Access Control (RBAC),Rule Based Access Control (RBAC),and Attribute-Based Access Control (ABAC).

Question 3

Describe LDAP injection attacks.

Accepted Answer

A weakness of LDAP is that it can be subject to LDAP injection attacks.These attacks,similar to SQL injection attacks,can occur when user input is not properly filtered.This may allow an attacker to construct LDAP statements based on user input statements.The attacker could then retrieve information from the LDAP database or modify its content.The defense against LDAP injection attacks is to examine all user input before processing.

Question 4

What is the purpose of an ACL?

Accepted Answer

ACLs provide file system security for pr

Question 5

Discuss the differences between DAP and LDAP.

Accepted Answer

Unlike X.500 DAP,LDAP was designed to ru

Question 6

With the Discretionary Access Control (DAC)model,no object has an owner;the system has total control over that object.

Accepted Answer

A) True 
 B)False

Question 7

Which access control model that uses access based on a user's job function within an organization?

Accepted Answer

A) Role Based Access Control 
B) Rule Based Access Control 
C) Discretionary Access Control 
D) Mandatory Access Control 
A) Role Based Access Control 
B) Rule Based Access Control 
C) Discretionary Access Control 
D) Mandatory Access Control

Question 8

A list that specifies which subjects are allowed to access an object and what operations they can perform on it is referred to as a(n):

Accepted Answer

A) ACE 
B) DAC 
C) entity 
D) ACL 
A) ACE 
B) DAC 
C) entity 
D) ACL

Question 9

The action that is taken by a subject over an object is called a(n):

Accepted Answer

A) authorization 
B) access 
C) control 
D) operation 
A) authorization 
B) access 
C) control 
D) operation

Question 10

Authentication,authorization,and accounting are sometimes called AAA.

Accepted Answer

A) True 
 B)False

Question 11

Although designed to support remote dial-in access to a corporate network,what service below is commonly used with 802.1x port security for both wired and wireless LANs?

Accepted Answer

A) RADIUS 
B) ICMP 
C) FTP 
D) Telnet 
A) RADIUS 
B) ICMP 
C) FTP 
D) Telnet

Question 12

Discuss the two significant weaknesses of DAC.

Accepted Answer

DAC has two significant weaknesses.First

Question 13

What kind of attack allows for the construction of LDAP statements based on user input statements,which can then be used to access the LDAP database or modify the database's information?

Accepted Answer

A) LDAP poisoning 
B) Kerberos injection 
C) LDAP injection 
D) DAP hijacking 
A) LDAP poisoning 
B) Kerberos injection 
C) LDAP injection 
D) DAP hijacking

Question 14

Which access control model is considered to be the least restrictive?

Accepted Answer

A) Role Based Access Control 
B) Mandatory Access Control 
C) Rule Based Access Control 
D) Discretionary Access Control 
A) Role Based Access Control 
B) Mandatory Access Control 
C) Rule Based Access Control 
D) Discretionary Access Control

Question 15

Which major types of access involving system resources are controlled by ACLs? (Choose all that apply. )

Accepted Answer

A) system access 
B) remote access 
C) user access 
D) application access 
A) system access 
B) remote access 
C) user access 
D) application access

Question 16

What is the name for a predefined framework that can be used for controlling access,and is embedded into software and hardware?

Accepted Answer

A) accounting and access model 
B) user control model 
C) access control model 
D) authorization control model 
A) accounting and access model 
B) user control model 
C) access control model 
D) authorization control model

Question 17

A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as which of the following?

Accepted Answer

A) separation of duties 
B) process sharing 
C) mandatory splitting 
D) role reversal 
A) separation of duties 
B) process sharing 
C) mandatory splitting 
D) role reversal

Question 18

A Local Group Policy (LGP)has more options than a Group Policy.

Accepted Answer

A) True 
 B)False

Question 19

What type of computer can forward RADIUS messages between RADIUS clients and RADIUS servers?

Accepted Answer

A) intermediate proxy 
B) remote proxy 
C) RADIUS proxy 
D) translation proxy 
A) intermediate proxy 
B) remote proxy 
C) RADIUS proxy 
D) translation proxy

Question 20

What policy is designed to ensure that all confidential or sensitive materials,either in paper form or electronic,are removed from a user's workspace and secured when the items not in use or when employees leave their workspace?

Accepted Answer

A) clean workspace 
B) secure workspace 
C) clean desk 
D) secure desk 
A) clean workspace 
B) secure workspace 
C) clean desk 
D) secure desk

When LDAP traffic is made secure by using Secure Sockets Layer (SSL)or Transport Layer Security (TLS),what is this process called?

List three major access control models.

Describe LDAP injection attacks.

What is the purpose of an ACL?

Discuss the differences between DAP and LDAP.

With the Discretionary Access Control (DAC)model,no object has an owner;the system has total control over that object.

Which access control model that uses access based on a user's job function within an organization?

A list that specifies which subjects are allowed to access an object and what operations they can perform on it is referred to as a(n):

The action that is taken by a subject over an object is called a(n):

Authentication,authorization,and accounting are sometimes called AAA.

Although designed to support remote dial-in access to a corporate network,what service below is commonly used with 802.1x port security for both wired and wireless LANs?

Discuss the two significant weaknesses of DAC.

What kind of attack allows for the construction of LDAP statements based on user input statements,which can then be used to access the LDAP database or modify the database's information?

Which access control model is considered to be the least restrictive?

Which major types of access involving system resources are controlled by ACLs? (Choose all that apply. )

What is the name for a predefined framework that can be used for controlling access,and is embedded into software and hardware?

A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as which of the following?

A Local Group Policy (LGP)has more options than a Group Policy.

What type of computer can forward RADIUS messages between RADIUS clients and RADIUS servers?

What policy is designed to ensure that all confidential or sensitive materials,either in paper form or electronic,are removed from a user's workspace and secured when the items not in use or when employees leave their workspace?

Introduction to Security

Malware and Social Engineering Attacks

Basic Cryptography

Advanced Cryptography and PKI

Networking and Server Attacks

Network Security Devices, Design, and Technology

Administering a Secure Network

Wireless Network Security

Client and Application Security

Mobile and Embedded Device Security

Authentication and Account Management

Vulnerability Assessment and Data Security

Business Continuity

Risk Mitigation

Filters

Exam 12: Access Management

When LDAP traffic is made secure by using Secure Sockets Layer (SSL)or Transport Layer Security (TLS),what is this process called?

List three major access control models.

Describe LDAP injection attacks.

What is the purpose of an ACL?

Discuss the differences between DAP and LDAP.

With the Discretionary Access Control (DAC)model,no object has an owner;the system has total control over that object.

Which access control model that uses access based on a user's job function within an organization?

A list that specifies which subjects are allowed to access an object and what operations they can perform on it is referred to as a(n):

The action that is taken by a subject over an object is called a(n):

Authentication,authorization,and accounting are sometimes called AAA.

Although designed to support remote dial-in access to a corporate network,what service below is commonly used with 802.1x port security for both wired and wireless LANs?

Discuss the two significant weaknesses of DAC.

What kind of attack allows for the construction of LDAP statements based on user input statements,which can then be used to access the LDAP database or modify the database's information?

Which access control model is considered to be the least restrictive?

Which major types of access involving system resources are controlled by ACLs? (Choose all that apply. )

What is the name for a predefined framework that can be used for controlling access,and is embedded into software and hardware?

A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as which of the following?

A Local Group Policy (LGP)has more options than a Group Policy.

What type of computer can forward RADIUS messages between RADIUS clients and RADIUS servers?

What policy is designed to ensure that all confidential or sensitive materials,either in paper form or electronic,are removed from a user's workspace and secured when the items not in use or when employees leave their workspace?

Introduction to Security

Malware and Social Engineering Attacks

Basic Cryptography

Advanced Cryptography and PKI

Networking and Server Attacks

Network Security Devices, Design, and Technology

Administering a Secure Network

Wireless Network Security

Client and Application Security

Mobile and Embedded Device Security

Authentication and Account Management

Vulnerability Assessment and Data Security

Business Continuity

Risk Mitigation

Filters