Cissp Quick Tips - Chapter 4, Access Control

Front 1

________ is a flow of information between a subject and an object.

Back 1

Access

Front 2

A ________ is an active entity that requests access to an object, which is a passive entity.

Back 2

subject

Front 3

A _________ can be a user, program, or process.

Back 3

subject

Front 4

________ is the assurance that information is not disclosed to unauthorized subjects.

Back 4

Confidentiality

Front 5

Some security mechanisms that provide ________ are encryption, logical and physical access control, transmission protocols, database views, and controlled traffic flow.

Back 5

confidentiality

Front 6

_____________ solutions include directories, web access management, password management, legacy single sign-on, account management, and profile update.

Back 6

Identity management

Front 7

__________ reduces the complexity of keeping up with different passwords for different systems.

Back 7

Password synchronization (single sign-on)

Front 8

__________ password reset reduces the help-desk call volumes by allowing users to reset their own passwords.

Back 8

Self-service

Front 9

________ password reset reduces the resolution process for password issues for the help-desk department.

Back 9

Assisted

Front 10

IdM directories contain all resource information, users' attributes, authorization profiles, roles, and possibly access control policies so other IdM applications have one _________ resource from which to gather this information.

Back 10

centralized

Front 11

An __________ workflow component is common in account management products that provide IdM solutions.

Back 11

automated

Front 12

________ refers to the creation, maintenance, and deactivation of user objects and attributes, as they exist in one or more systems, directories, or applications.

Back 12

User provisioning

Front 13

The HR database is usually considered the __________ source for user identities because that is where it is first developed and properly maintained.

Back 13

authoritative

Front 14

There are three main access control models:

Back 14

discretionary, mandatory, and nondiscretionary

Front 15

____________ enables data owners to dictate what subjects have access to the files and resources they own.

Back 15

Discretionary access control (DAC)

Front 16

________ uses a security label system. Users have clearances, and resources have security labels that contain data classifications.

Back 16

Mandatory access control (MAC)

Front 17

________ access control uses a role-based method to determine access rights and permissions.

Back 17

Nondiscretionary

Front 18

________ access control is based on the user's role and responsibilities within the company.

Back 18

Role-based

Front 19

Three main types of __________ exist: menus and shells, database views, and physically constrained interfaces.

Back 19

restricted interface measurements

Front 20

_________ are bound to objects and indicate what subjects can use them.

Back 20

Access control lists

Front 21

A ________ table is bound to a subject and lists what objects it can access.

Back 21

capability

Front 22

Access control can be administered in two main ways: _________ and ___________.

Back 22

centralized and decentralized

Front 23

RADIUS, TACACS+, and Diameter are examples of _________ administration access control techniques.

Back 23

centralized

Front 24

A __________ administration example is a peer-to-peer working group.

Back 24

decentralized

Front 25

Security policy, personnel controls, supervisory structure, security-awareness training, and testing are examples of __________ controls.

Back 25

administrative

Front 26

Network segregation, perimeter security, computer controls, work area separation, data backups, and cable are examples of __________ controls.

Back 26

physical

Front 27

System access, network architecture, network access, encryption and protocols, and auditing are examples of __________ controls.

Back 27

technical

Front 28

__________ control mechanisms provide one or more of the following functionalities: preventative, detective, corrective, deterrent, recovery, or compensative.

Back 28

access

Front 29

For a subject to be able to access a resource, it must be identified, authenticated, and authorized, and should be _________ for its actions.

Back 29

held accountable

Front 30

_________ can be accomplished by biometrics, a password, a passphrase, a cognitive password, a one-time password, or a token.

Back 30

Authentication

Front 31

A __________ error in biometrics means the system rejected an authorized individual, and a _________ error means an imposter was authenticated.

Back 31

Type 1, Type 2

Front 32

A memory card cannot process information, but a _________ can.

Back 32

smart card

Front 33

Access controls should default to ___________ access.

Back 33

no access

Front 34

____________ and need-to-know principles limit users' rights to only what is needed to perform tasks of their job.

Back 34

Least-privilege

Front 35

____________ capabilities can be accomplished through Kerberos, SESAME, domains, and thin clients.

Back 35

Single sign-on

Front 36

___________ technology requires a user to be authenticated to the network only one time.

Back 36

Single sign-on

Front 37

In Kerberos, a user receives a ticket from the __________ so they can authenticate to a service.

Back 37

KDC

Front 38

The Kerberos user receives a __________, which allows him to request access to resources through the ticket granting service. The TGS generates a new ticket with the session keys.

Back 38

ticket granting ticket (TGT)

Front 39

Types of ___________ attacks include denial of service, spoofing, dictionary, brute force, and war dialing.

Back 39

access control

Front 40

____________ can track user activities, application events, and system events.

Back 40

Audit logs

Front 41

Keystroke monitoring is a type of _________ that tracks each keystroke made by a user.

Back 41

auditing

Front 42

Audit logs should be protected and regularly _________.

Back 42

reviewed

Front 43

Object __________ can unintentionally disclose information

Back 43

reuse

Front 44

Just removing pointers to files is not always enough protection for proper _________.

Back 44

object reuse

Front 45

Information can be obtained via electrical signals in airwaves. The ways to combat this type of intrusion are _________, white noise, and control zones.

Back 45

TEMPEST

Front 46

User __________ is accomplished by what someone knows, is, or has.

Back 46

authentication

Front 47

One-time password-generating token devices can use both _________ or __________ methods.

Back 47

synchronous or asynchronous

Front 48

Strong authentication requires two of the three user authentication attributes (what someone knows, is or ________).

Back 48

has

Front 49

Kerberos addresses privacy and ___________ but not availability.

Back 49

integrity

Front 50

The following are weaknesses of ___________: the KDC is a single point of failure; it is susceptible to password guessing; session and secret keys are locally stored; KDC needs to always be available; and there must be management of secret keys.

Back 50

Kerberos

Front 51

IDSs can be statistical (monitor behavior) or ___________ (watch for known attacks).

Back 51

signature-based

Front 52

_________ is a safeguard against disclosure of confidential information because it returns media back to its original state.

Back 52

Degaussing

Front 53

_________ is a type of social engineering with the goal of obtaining personal information, credentials, credit card numbers, or financial data.

Back 53

Phishing