Cissp Cbk - Access Controls

Front 1

Access control is concerned with protecting?

Back 1

- Confidentiality
- Integrity
- Availability

Front 2

Confidentiality is?

Back 2

The property that ensures information is not disclosed to unauthorized users: Prevention of Disclouser

Front 3

Integrity is?

Back 3

The property that ensures data has not been modified either in transit or while in storage: Prevention of Alteration

Front 4

Availability is?

Back 4

The property that ensures access to data when it is needed: Prevention of Destruction

Front 5

Access Control Responsibility Role:
- Data owner

Back 5

- Ultimately responsible
- Final authority

Front 6

Access Control Responsibility Roles:

Data custodian

Back 6

- Acts on behalf of the data owner
- Maintains and administers security

Front 7

• Centralized control

Back 7

- Single group in charge
- Could cause delays in response to remote business units

Front 8

• Decentralized control

Back 8

- Controls map to individual business units
- Causes discrepancies across the
organization
- No consistent view

Front 9

(CHAP)
Challenge Handshake Authentication Protocol

Back 9

- Central location sends challenge to remote user
- User responds with encrypted hash of challenge
- Password not sent in clear over link and messages are encrypted

Front 10

(TACACS)
Terminal Access Controller Access Control System

Back 10

- Requires user ID and static password

Front 11

TACACS+

Back 11

- Provides better protection
- Uses tokens for two-factor, dynamic password authentication.

Front 12

(PAP)

Password Authentication Protocol

Back 12

PAP is used by Point to Point Protocol to validate users before allowing them access to server resources.

- Unencrypted

Front 13

What are the three areas of security?

Back 13

C - Confidentiality
I - Integrity
A - Availability

Front 14

Which of the following critical areas of security represents the unauthorized
modification of information?

Back 14

Integrity

Front 15

Which formula below accurately represents the equation for calculating the risk
associated with your critical assets?

Back 15

Risk = Threat x Vulnerability

Front 16

Of the four core principles of network security, which one relates to
understanding which services are running on your system?

Back 16

Know thy system

Front 17

Giving Bob, the accountant, access only to the Accounting application required
for his duties is an example of which core security principle?

Back 17

Principle of Least Privilege

Front 18

Which principle is represented by an accountant creating a company's books and
an auditor reviewing the books for accuracy?

Back 18

Separation of Duties

Front 19

Which access control measure method would be affected by an inaccessible
system administrator?

Back 19

Detective

Front 20

Which of the following concepts relates most closely to the Principle of Least
Privilege?
a) Authentication
b) Identity
c) Detection
d) Separation of Duties

Back 20

Separation of Duties

Front 21

If Dan, a user with level three clearance, attempts to read a document requiring a
level four clearance, he is violating which of the following access control
techniques?
a) The Star Property of the Bell-LaPadula Model
b) The Simple Security Property of the Bell-LaPadula Model
c) The Simple Integrity Property of the Biba Model
d) The Super Simple Star Property of Biba Model

Back 21

The Simple Security Property of the Bell-LaPadula Model

Front 22

Which of the following access control techniques requires the user to follow a
procedure to access protected data?
a) The Clark-Wilson model
b) The Biba model
c) The Middleman model
d) The Bell-LaPadula model

Back 22

The Clark-Wilson model

Front 23

Which of the following characteristics makes the BIBA model the opposite of the
Bell LaPadula (BLP) model?
a) No write down and no read up
b) Read up but no write down
c) No read down and no write up
d) Write down but no read up

Back 23

No read down and no write up

Front 24

In the process of employee termination, which access management activity most
effectively controls access?
a) Account administration
b) Account maintenance
c) Account monitoring
d) Account revocation

Back 24

d) Account revocation

Front 25

Of the four ways a user can be authenticated, which presents the use of physical
human attributes in the process?
a) Something you are
b) Something you have
c) Something you know
d) Something you share

Back 25

Something you are

Front 26

If you had a classified system located in the middle of the desert, which
authentication method would serve best?
a) Something you have
b) Something you know and are
c) Something you share
d) Someplace you are

Back 26

Someplace you are

Front 27

What is the MOST influential factor in determining if a biometric solution is
feasible for a system?
a) System size
b) Usability
c) Criticality
d) Cost

Back 27

Cost

Front 28

Which authentication method negotiates the validity of the user through tickets?
a) Single Sign On (SSO)
b) System Generated Passwords (SGP)
c) Challenge Handshake Authentication Protocol (CHAP)
d) Kerberos

Back 28

Kerberos

Front 29

Which password cracking technique will eventually figure out Jim's hard-to-guess
password?
a) Hybrid attack
b) Brute force attack
c) Dictionary attack
d) Long-term attack

Back 29

Brute force attack

Front 30

Stateful inspection of packets is an example of which kind of access control?
a) Prevention
b) Detection
c) Suspension
d) Eradication

Back 30

Prevention

Front 31

Which are the three common methods used in password cracking?
a) Dictionary, hybrid, and brute force
b) Word list, brute force, and distributed
c) John the ripper, LOphtcrack, and hydra
d) SAM, passwd, and shadow

Back 31

Dictionary, hybrid, and brute force

Front 32

Which of the following are among the primary design types used for access
control systems today?
a) Mandatory, discretionary, and role-based
b) Interaction, fixed, and closed
c) Subject-based, object-based, and file-based
d) Mandatory, optional, and discretionary

Back 32

Mandatory, discretionary, and role-based

Front 33

Which of the following access control techniques associates a group of users and their privileges with each
object?
a) Role Based Access Control
b) Token Based Access Control
c) List Based Access Control
d) User Based Access Control

Back 33

List Based Access Control

Front 34

Which of the following is NOT an example of a Mandatory Access Control (MAC)
technique?
a) Secure Communications Processor (SCOMP)
b) SMURF
c) Pump
d) Purple Penelope

Back 34

SMURF

Front 35

Which of the following access control techniques allows the user to feel
empowered and able to change security attributes?
a) Discretionary Access Control
b) Mandatory Access Control
c) Optional Access Control
d) User Access Control

Back 35

Discretionary Access Control

Front 36

Which of the following control types is used to provide alternatives to other
controls?
a) Compensating
b) Deterrent
c) Corrective
d) Recovery

Back 36

Compensating

Front 37

Your location is one of four commonly accepted items on which authentication
can be based. What are the other three?
a) Something you say, type, or press
b) Something you have, do, or know
c) Something you do, know, type
d) Something you know, have, or are

Back 37

Something you know, have, or are

Front 38

What attribute of the Kerberos authentication process makes it so strong?
a) Encrypting the Ticket Granting Ticket (TGT)
b) Mutual authentication
c) Using a Ticket Distribution Center (TDC) and a Key Granting Server (KGS)
d) User defined passwords

Back 38

Mutual authentication

Front 39

Applying which principle represents one of the best ways to thwart internal
attacks using access control systems?
a) Principle of Open Access
b) Principle of Least Privilege
c) Principle of Internal Suppression
d) Principle of Trust

Back 39

Principle of Least Privilege

Front 40

There are three primary areas of threat. Of the following items, which is NOT one
of those three areas?
a) Threats to business goals
b) Threats based on validated data
c) Threats that are widely known
d) Threats combined with risk

Back 40

Threats combined with risk

Front 41

In terms of information security, what is a vulnerability?
a) A weakness in your systems that allows a threat to occur
b) A threat to your security that creates a risk condition
c) A combining of both a risk and a threat in the same system
d) A risk to your system(s) that cannot be eliminated

Back 41

A weakness in your systems that allows a threat to occur

Front 42

Which are the three generally accepted options for managing risk?
a) Eliminate, quarantine, or insure
b) Accept, mediate, or delegate
c) Accept, eliminate, or transfer
d) Transfer, eliminate, or cogitate

Back 42

Accept, eliminate, or transfer

Front 43

What is the principle that ensures data has not been modified either in transit or while in storage referred
to as?
a) Non-repudiation
b) Assurance
c) Integrity
d) Reliability

Back 43

Integrity

Front 44

What is the principle that ensures information is not disclosed to unauthorized
users referred to as?
a) Encryption
b) Confidentiality
c) Encapsulation
d) Security

Back 44

Confidentiality

Front 45

The assurance of access to data when it is needed is one of the three key
principles in information security. What is this principle called?
a) Availability
b) Guaranteed delivery
c) Accessibility
d) Connectivity

Back 45

Availability

Front 46

Discretionary Access Control (DAC) is one of the many Access Control Models.
Which of the following items is NOT part of the Discretionary Access Control
(DAC) model?
a) An administrator decides whether a user should have access to an object
b) Performed at the discretion of any administrator
c) Strictly enforced by the system and cannot be overridden
d) Owners can change security attributes

Back 46

Strictly enforced by the system and cannot be overridden

Front 47

Lattice Security Model

Back 47

- Deals with information flow
- Formalizes network security models
- Shows how Information can or cannot flow

Front 48

Chinese Wall Security Model

Back 48

(lBrewer and Nash)
- Deals with conflict of intrest
- No information flow allowed that could lead to "conflit of intrest" (COI)

Front 49

Bell-LaPadula Security Model

Back 49

- Deal with confidentiality
The are two main rules with BLP:
• The Simple Security property, which is No Read Up (NRU)
• The * property, which is No Write Down (NWD)

Front 50

BIBA

Back 50

- Deals with integrity
• Simple integrity property: A user cannot write data to a higher integrity level than hers.
• Integrity star property: A user cannot read data of a lower integrity level than hers.

Front 51

Clark-Wilson Security Model

Back 51

• Deals with integrity
- Unauthorized users cannot make changes.
- This model maintains internal and external
consistency at the system level.
- Authorized users cannot make unauthorized
changes.

Front 52

COLLUSION

Back 52

When more than one person controlling a component
portion collaborates with others to breach the security of a system.

Front 53

Rotation of Duties

Back 53

Rotation of duties occurs when personnel are moved from one job to another at regular intervals.
This helps to detect and minimize fraud.

Front 54

Separation of Duties

Back 54

Separation of duties is considered valuable in deterring fraud because fraud can occur if an
opportunity exists for collaboration between various job-related capabilities.

Front 55

Least Privilege

Back 55

• Access control needs good
administration.
• Availability versus security: The
best security is no availability.
• What is the need of the business?
• Reduce the misuse of privilege.

Front 56

Subjects: Active

Back 56

A subject is either a user or process.

Front 57

Objects: Passive

Back 57

An object is a passive entity that contains data. An object can be files, directories, pipes, devices,
sockets, ports, and so on.

Front 58

Rules: Filters

Back 58

The standard rules for UNIX are Read, Write, and Execute. The standard rules for Windows NT 4 are
Read, Write, Execute, and No Access. The standard rules of NDS and Active Directory are more
granular. In Windows 2000, there are about 30 rules, which are also known as permissions. Each rule
has a positive and a negative.

Front 59

Labels: Sensitivity

Back 59

Another set of rules with respect to sensitivity of both object and subject is labels