Deck 3: Authenticating Users

Question 1

____ access controls remedy a circumstance or mitigate the damage caused during an incident.

A) Corrective
B) Detective
C) Deterrent
D) Preventive

Answer 1

A

Question 2

____ reduces the chance of an individual violating information security by increasing the scrutiny on any one user.

A) Need to know
B) Least privilege
C) Access control
D) Separation of duties

Answer 2

D

Question 3

____ use(s) a challenge-response system.

A) Local authentication
B) Biometrics
C) Synchronous tokens
D) Asynchronous tokens

Answer 3

D

Question 4

Some firewalls use authentication to give employees access to common resources.

Question 5

____ access controls help the organization avoid an incident.

A) Corrective
B) Detective
C) Deterrent
D) Preventive

Question 6

For most information, the U.S.military uses a classification scheme with ____ as the uppermost tier.

A) confidential
B) secret
C) top secret
D) galactic top secret

Question 7

A simple scheme can allow an organization to protect sensitive information, such as marketing or research data, personnel data, customer data, and general internal communications classifies data.Which of the following categories would most likely be used for internal phone lists?

A) Public
B) For Official Use Only
C) Classified
D) Galatic Top Secret

Question 8

Lattice-based access control is a variation of ____ access control.

A) mandatory
B) discretionary
C) nondiscretionary
D) classification

Question 9

Role-based access controls are a type of ____ access controls.

A) mandatory
B) nondiscretionary
C) discretionary
D) task-based

Question 10

A PIN is an example of something you ____.

A) know
B) have
C) are
D) do

Question 11

RADIUS works with Network Address Translation (NAT).

Question 12

Physical attributes are an example of something you ____ that can be used to verify identity.

A) know
B) have
C) are
D) do

Question 13

In ____, access to a specific set of information is dependent on the information's content.

A) content-dependent
B) rule-based
C) role-based
D) task-based

Question 14

IEEE 802.1x is one of the fastest growing standards being used in enterprise networks today.

Question 15

Access controls are defined only using technology.

Question 16

____ authentication can enable employees who work remotely or who are traveling to access your internal servers.

A) Client
B) User
C) Session
D) Synchronous

Question 17

In a lattice-based access control, the column of attributes associated with a particular object is referred to as a(n) ____.

A) need-to-know
B) access control list (ACL)
C) classification scheme
D) rule-based configuration

Question 18

____ authentication is most commonly set up as a form of auditing and occurs when a system records the activities of each user and writes details about each activity to a log file.

A) Local
B) Discretionary
C) Centralized
D) Decentralized

Question 19

Most organizations do not need the detailed level of classification used by the military or federal agencies.

Question 20

____ is most frequently associated with data classification schemes.

A) Need to know
B) Least privilege
C) Access control
D) Separation of duties

Question 21

Client authentication or ____ authentication should be used when only a single user is coming from a single IP address.

A) discretionary
B) network
C) user
D) session

Question 22

____________________ is the act of confirming the identity of a potential user.

Question 23

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
Documenting the activities of the authorized individual and systems.

Question 24

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
This principle limits individuals' information access to what is required to perform their jobs.

Question 25

With ____________________ authentication, the firewall enables the authenticated user to access the desired resources for a specific period of time.

Question 26

Public-Key Infrastructure (PKI) must be used for ____ authentication.

A) Kerberos
B) 802.1x Wi-Fi
C) RADIUS
D) certificate-based

Question 27

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
Principle by which employees are provided access to the minimal amount of information for the least duration of time necessary to perform their duties

Question 28

To configure client authentication, you need to set up one of two types of authentication systems: ____ and ____.

A) standard sign-on and specific sign-on
B) standard sign-on and single-sign on
C) Kerberos and TACACS++
D) Kerberos and RADIUS

Question 29

The ____________________ password system, which is a feature of the Linux operating system that enables the secure storage of passwords, stores them in another file that has restricted access.

Question 30

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
Determined by a central authority in the organization.

Question 31

Linux stores passwords in the ____ file in encrypted format.

A) /etc/pass
B) /root/passwd
C) /etc/passwd
D) /system/password

Question 32

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
Confirming the identity of the entity seeking access to a logical or physical area

Question 33

____________________ IP address mappings work best because some TACACS+ systems use the source IP address to create the encryption key.

Question 34

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
Obtaining the identity of the entity requesting access to a logical or physical area.

Question 35

In ____________________-based access controls, access is granted based on a set of rules specified by the central authority.

Question 36

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
Determining which actions an entity can perform in that physical or logical area.

Question 37

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
Implemented at the discretion of the data user.

Question 38

You might have to use TACACS+ or ____ if your firewall doesn't support authentication.

A) RADIUS
B) Kerberos
C) NAT
D) digital certificates

Question 39

The ____ authentication server is also known as a Key Distribution Center (KDC).

A) TACACS+
B) Kerberos
C) WEP
D) RADIUS

Question 40

Match each item with a statement below.
a.authentication
b.least privilege
c.discretionary access controls
d.authorization
e.separation of duties
f.identification
g.need to know
h.nondiscretionary access controls
i.accountability
This principle increases the security of information and other assets by requiring that more than one individual be responsible for a particular information asset, process, or task.

Question 41

What are the functions that can be used to classify access controls?

Question 42

What is a disadvantage of centralized authentication?

Question 43

What are discretionary access controls?

Question 44

Describe mandatory access control.

Question 45

Describe security clearances.

Question 46

Compare TACACS+ and RADIUS with regard to strength of security.

Question 47

Describe the differences between local and centralized authentication.

Question 48

What are the general steps a firewall uses to authenticate users?

Question 49

What types of one-time passwords are available?

Question 50

What are the four processes encompassed by access control?