Deck 11: Access Control Fundamentals

Question 1

Which access control model can dynamically assign roles to subjects based on a set of defined rules?

A)Role Based Access Control
B)Mandatory Access Control
C)Rule Based Access Control
D)Discretionary Access Control

Answer 1

C

Question 2

Although designed to support remote dial-in access to a corporate network, what service below is commonly used with 802.1x port security for both wired and wireless LANs?

A)RADIUS
B)ICMP
C)FTP
D)Telnet

Answer 2

A

Question 3

What authentication service commonly used on UNIX devices involves communicating user authentication information to a centralized server?

A)TACACS
B)RADIUS
C)Kerberos
D)FTP

Answer 3

A

Question 4

What kind of attack allows for the construction of LDAP statements based on user input statements, which can then be used to access the LDAP database or modify the database's information?

A)LDAP poisoning
B)Kerberos injection
C)LDAP injection
D)DAP hijacking

Question 5

A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as:

A)Separation of duties
B)Job rotation
C)Mandatory vacation
D)Role reversal

Question 6

Entries within a Directory Information Base are arranged in a tree structure called the:

A)DAP
B)PEAP
C)EAP
D)DIT

Question 7

What is the name for a predefined framework that can be used for controlling access, and is embedded into software and hardware?

A)accounting and access model
B)user control model
C)access control model
D)authorization control model

Question 8

Group policy is a Unix feature that allows for the centralized management and configuration of computers and remote users using Unix Active Directory.

Question 9

Which access control model is considered to be the least restrictive?

A)Role Based Access Control
B)Mandatory Access Control
C)Rule Based Access Control
D)Discretionary Access Control

Question 10

In a UAC prompt, what color is used to indicate the lowest level of risk?

A)red
B)gray
C)yellow
D)green

Question 11

User accounts that remain active after an employee has left an organization are referred to as being what type of accounts?

A)Active
B)Stale
C)Orphaned
D)Fragmented

Question 12

Authorization and access are viewed as synonymous and in access control, they are the same step.

Question 13

A shield icon warns users if they attempt to access any feature that requires UAC permission.

Question 14

The Bell-LaPadula (BLP) model of MAC can be used to prevent subjects from creating a new object or performing specific functions on objects that are at a lower level than their own.​

Question 15

What access control model below is considered to be the most restrictive access control model, and involves assigning access controls to users strictly according to the custodian?

A)Mandatory Access Control
B)Role Based Access Control
C)Discretionary Access Control
D)Rule Based Access Control

Question 16

The strength of RADIUS is that messages are always directly sent between the wireless device and the RADIUS server.

Question 17

When using Role Based Access Control (RBAC), permissions are assigned to:

A)Roles
B)Groups
C)Labels
D)Users

Question 18

Select below the access control model that uses access based on a user's job function within an organization:

A)Role Based Access Control
B)Rule Based Access Control
C)Discretionary Access Control
D)Mandatory Access Control

Question 19

A user or a process functioning on behalf of the user that attempts to access an object is known as the:

A)subject
B)reference monitor
C)entity
D)label

Question 20

The X.500 standard defines a protocol for a client application to access an X.500 directory known as which of the following options?

A)DIB
B)DAP
C)DIT
D)LDAP

Question 21

Select below the authentication system developed by the Massachusetts Institute of Technology (MIT) to verify the identity of network users:

A)Aurora
B)Kerberos
C)CHAP
D)TACACS

Question 22

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
​Limitation imposed as to when a user can log in to a system or access resources.

Question 23

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
The act of moving individuals from one job responsibility to another.​

Question 24

The action that is taken by a subject over an object is called a(n):

A)authorization
B)access
C)control
D)operation

Question 25

During RADIUS authentication, what type of packet includes information such as identification of a specific AP that is sending the packet and the username and password?

A)accounting request
B)access request
C)verification request
D)authentication request

Question 26

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
​The practice of requiring that processes should be divided between two or more individuals.

Question 27

In the DAC model, ____________________ can create and access their objects freely.

Question 28

To prevent one individual from having too much control, employees can ____________ job responsibilities within their home department or across positions in other departments.

Question 29

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
An attack that constructs LDAP statements based on user input statements, allowing the attacker to retrieve information from the LDAP database or modify its content.​

Question 30

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
The second version of the Terminal Access Control Access Control System (TACACS) authentication service.​

Question 31

A list that specifies which subjects are allowed to access an object and what operations they can perform on it is referred to as a(n):

A)ACE
B)DAC
C)entity
D)ACL

Question 32

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
​The most restrictive access control model, typically found in military settings in which security is of supreme importance.

Question 33

To assist with controlling orphaned and dormant accounts, what can be used to indicate when an account is no longer active?

A)Password expiration
B)Account expiration
C)Last login
D)Account last used

Question 34

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
The current version of the Terminal Access Control Access Control System (TACACS) authentication service.​

Question 35

The capability to look up information by name under the X.500 standard is known as a(n) ____________________-pages service.

Question 36

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
Providing only the minimum amount of privileges necessary to perform a job or function.​

Question 37

____________________ is granting or denying approval to use specific resources.
​
a.​Account expiration
b.Discretionary access control (DAC)​
c.​Extended TACACS (XTACACS)
d.Job rotation​
e.​LDAP injection attack

Question 38

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
​The process of setting a user's account to expire

Question 39

A RADIUS ____________________ is a computer that forwards RADIUS messages among RADIUS clients and RADIUS servers.

Question 40

Matching
a. Account expiration
b. Discretionary access control (DAC)
c. Extended TACACS (XTACACS)
d. Job rotation
e. LDAP injection attack
f. Least privilege
g. Mandatory access control (MAC)
h. Separation of duties
i. TACACS+
j. Time-of-day restriction
The least restrictive access control model in which the owner of the object has total control over it.​

Question 41

Discuss the two significant weaknesses of DAC.

Question 42

Describe LDAP injection attacks.

Question 43

Discuss the differences between DAP and LDAP.

Question 44

Describe the Bell-LaPadula model.

Question 45

List the steps for RADIUS authentication with a wireless device in an IEEE 802.1x network.

Question 46

Describe how Kerberos works.

Question 47

List two major access control models.

Question 48

List two of the most common types of authentication and AA servers.

Question 49

Describe the MAC lattice model.

Question 50

Describe the two key elements of the MAC model.