Deck 4: Access Control

Question 1

The authentication function determines who is trusted for a given purpose.

Answer 1

False

Question 2

__________ controls access based on comparing security labels with security clearances.

A)MAC
B)DAC
C)RBAC
D)MBAC

Answer 2

A

Question 3

A user may belong to multiple groups.

Answer 3

True

Question 4

The default set of rights should always follow the rule of least privilege or
read-only access

Question 5

__________ is verification that the credentials of a user or other system entity are valid.

A)Adequacy
B)Authentication
C)Authorization
D)Audit

Question 6

Reliable input is an access control requirement.

Question 7

_________ is the granting of a right or permission to a system entity to access a system resource.

A)Authorization
B)Authentication
C)Control
D)Monitoring

Question 8

A user program executes in a kernel mode in which certain areas of memory
are protected from the user's use and certain instructions may not be executed.

Question 9

The main innovation of the NIST standard is the introduction of the RBAC
System and Administrative Functional Specification,which defines the features required for an RBAC system.

Question 10

__________ is the traditional method of implementing access control.

A)MAC
B)RBAC
C)DAC
D)MBAC

Question 11

An access right describes the way in which a subject may access an object.

Question 12

Security labels indicate which system entities are eligible to access certain
resources.

Question 13

T F 4.External devices such as firewalls cannot provide access control services.

Question 14

A constraint is a defined relationship among roles or a condition related to
roles.

Question 15

Traditional RBAC systems define the access rights of individual users and
groups of users.

Question 16

The principal objectives of computer security are to prevent
unauthorized users from gaining access to resources,to prevent legitimate users from accessing resources in an unauthorized manner,and to enable legitimate users to access resources in an authorized manner.

Question 17

An auditing function monitors and keeps a record of user accesses to
system resources.

Question 18

Any program that is owned by,and SetUID to,the "superuser" potentially
grants unrestricted access to the system to any user executing that program.

Question 19

__________ implements a security policy that specifies who or what may have access to each specific system resource and the type of access that is permitted in each instance.

A)Audit control
B)Resource control
C)System control
D)Access control

Question 20

Access control is the central element of computer security.

Question 21

An approval to perform an operation on one or more RBAC protected objects is _________ .

A)support
B)prerequisite
C)permission
D)exclusive role

Question 22

Role hierarchies make use of the concept of __________ to enable one role to implicitly include access rights associated with a subordinate role.

Question 23

The __________ user ID is exempt from the usual file access control constraints and has system wide access.

Question 24

A(n)__________ is a resource to which access is controlled.

A)object
B)owner
C)world
D)subject

Question 25

Basic access control systems typically define three classes of subject: owner,__________ and world.

Question 26

A __________ is a named job function within the organization that controls this computer system.

A)user
B)role
C)permission
D)session

Question 27

X.800 defines __________ as the prevention of unauthorized use of a resource,
including the prevention of use of a resource in an unauthorized manner.

Question 28

A concept that evolved out of requirements for military information security is ______ .

A)reliable input
B)mandatory access control
C)open and closed policies
D)discretionary input

Question 29

A __________ is a mapping between a user and an activated subset of the set of roles to which the user is assigned.

Question 30

A __________ is an entity capable of accessing objects.

A)group
B)object
C)subject
D)owner

Question 31

__________ provide a means of adapting RBAC to the specifics of administrative and security policies in an organization.

A)Constraints
B)Mutually Exclusive Roles
C)Cardinality
D)Prerequisites

Question 32

__________ is based on the roles the users assume in a system rather than the user's identity.

A)DAC
B)RBAC
C)MAC
D)URAC

Question 33

The basic elements of access control are: subject,__________,and access right.

Question 34

__________ access control controls access based on the identity of the requestor and on access rules stating what requestors are or are not allowed to do.

Question 35

A __________ access control scheme is one in which an entity may be granted access rights that permit the entity,by its own volition,to enable another entity to access some resource.

Question 36

An independent review and examination of system records and activities in order to test for adequacy of system controls,to ensure compliance with established policy and operational procedures,to detect breaches in security,and to recommend any indicated changes in control,policy and procedures is a(n)__________ .

Question 37

__________ refers to setting a maximum number with respect to roles.

A)Cardinality
B)Prerequisite
C)Exclusive
D)Hierarchy

Question 38

_________ specifications limit the availability of the permissions by placing constraints on the roles that can be activated within or across a user's sessions.

A)PSD
B)DSD
C)SSD
D)SDS ¸

Question 39

__________ access control controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles.

Question 40

The final permission bit is the _________ bit.

A)superuser
B)kernel
C)set user
D)sticky

Question 41

The NIST model defines two types of role hierarchies: general role hierarchies and ___________ hierarchies.

Question 42

__________ functions provide the capability to create,delete,and maintain RBAC elements and relations.

Question 43

A __________ dictates that a user can only be assigned to a particular role if it is already assigned to some other specified role and can be used to structure the implementation of the least privilege concept.

Question 44

The __________ functions include the following: create a user session with a default set of active roles; add an active role to a session; delete a role from a session; and check if the session subject has permission to perform a request operation on an object.

Question 45

__________ Separation of Duty enables the definition of a set of mutually exclusive roles,such that if a user is assigned to one role in the set,the user may not be assigned to any other role in the set.