• Shuffle
    Toggle On
    Toggle Off
  • Alphabetize
    Toggle On
    Toggle Off
  • Front First
    Toggle On
    Toggle Off
  • Both Sides
    Toggle On
    Toggle Off
  • Read
    Toggle On
    Toggle Off
Reading...
Front

Card Range To Study

through

image

Play button

image

Play button

image

Progress

1/103

Click to flip

Use LEFT and RIGHT arrow keys to navigate between flashcards;

Use UP and DOWN arrow keys to flip the card;

H to show hint;

A reads text to speech;

103 Cards in this Set

  • Front
  • Back
What is the PRIMARY advantage of using a separate authentication server (e.g., Remote Access Dial-In User System, Terminal Access Controller Access Control System) to authenticate dial-in users?

A. Single user logons are easier to manage and audit.
B. Each session has a unique (one-time) password assigned to it.
C. Audit and access information are not kept on the access server.
D. Call-back is very difficult to defeat.
Audit and access information are not kept on the access server.
Within the Open Systems Interconnection (OSI) Reference Model, authentication addresses the need for a network entity to verify both


A. The identity of a remote communicating entity and the authenticity of the source of the data that are received.

B. The authenticity of a remote communicating entity and the path through which communications are received.

C. The location of a remote communicating entity and the path through which communications are received.

D. The identity of a remote communicating entity and the level of security of the path through which data are received.
The identity of a remote communicating entity and the authenticity of the source of the data that are received
Which of the following is the most reliable authentication device?

A. ) Variable callback system
B. ) Smart card system
C. ) fixed callback system
D. ) Combination of variable and fixed callback system
Smart card system
Which of the following are proprietarily implemented by CISCO?

A. RADIUS+
B. TACACS
C. XTACACS and TACACS+
D. RADIUS
XTACACS and TACACS+
What is a protocol used for carrying authentication, authorization, and configuration information between a Network Access Server and a shared Authentication Server?

A. IPSec
B. RADIUS
C. L2TP
D. PPTP
RADIUS
RADIUS is defined by which RFC?

A. 2168
B. 2148
C. 2138
D. 2158
2138
In a RADIUS architecture, which of the following acts as a client?

A. A network Access Server.
B. None of the choices.
C. The end user.
D. The authentication server.
A network Access Server.
In a RADIUS architecture, which of the following can ac as a proxy client?

A. The end user.
B. A Network Access Server.
C. The RADIUS authentication server.
D. None of the choices.
The RADIUS authentication server.
Which of the following statements pertaining to RADIUS is incorrect?


A. ) A RADIUS server can act as a proxy server, forwarding client requests to other authentication domains.

B. ) Most of RADIUS clients have a capability to query secondary RADIUS servers for redundancy

C. ) Most RADIUS servers have built-in database connectivity for billing and reporting purposes

D. ) Most RADIUS servers can work with DIAMETER servers.
Most RADIUS servers can work with DIAMETER servers.
Which of the following is the weakest authentication mechanism?

A. ) Passphrases
B. ) Passwords
C. ) One-time passwords
D. ) Token devices
Passwords
What is the PRIMARY use of a password?

A. ) Allow access to files
B. ) Identify the user
C. ) Authenticate the user
D. ) Segregate various user's accesses
Authenticate the user
Software generated passwords have what drawbacks?

A. Passwords are not easy to remember.
B. Password are too secure.
C. None of the choices.
D. Passwords are unbreakable.
Passwords are not easy to remember.
What are the valid types of one time password generator?

A. All of the choices.
B. Transaction synchronous
C. Synchronous/PIN synchronous
D. Asynchronous/PIN asynchronous
All of the choices
Which of the following will you consider as most secure?

A. Password
B. One time password
C. Login phrase
D. Login ID
One time password
What type of password makes use of two totally unrelated words?

A. Login phrase
B. One time password
C. Composition
D. Login ID
Composition
Which of the following is the correct account policy you should follow?

A. All of the choices.
B. All active accounts must have a password.
C. All active accounts must have a long and complex pass phrase.
D. All inactive accounts must have a password.
All active accounts must have a password
Which of the following are the advantages of using passphrase?

A. Difficult to crack using brute force.
B. Offers numerous characters.
C. Easier to remember.
D. All of the choices.
All of the choices.
Which of the following are the correct guidelines of password deployment?

A. Passwords must be masked.
B. All of the choices.
C. Password must have a minimum of 8 characters.
D. Password must contain a mix of both alphabetic and non-alphabetic characters.
All of the choices.
Why would a 16 characters password not desirable?

A. Hard to remember
B. Offers numerous characters.
C. Difficult to crack using brute force.
D. All of the choices.
Hard to remember
Which of the following is NOT a good password deployment guideline?

A. Passwords must not be he same as user id or login id.
B. Password aging must be enforced on all systems.
C. Password must be easy to memorize.
D. Passwords must be changed at least once every 60 days, depending on your environment.
Password must be easy to memorize
Routing password can be restricted by the use of:

A. Password age
B. Password history
C. Complex password
D. All of the choices
Password history
What should you do immediately if the root password is compromised?

A. Change the root password.
B. Change all passwords.
C. Increase the value of password age.
D. Decrease the value of password history.
Change all passwords
Which of the following is the most secure way to distribute password?


A. Employees must send in an email before obtaining a password.

B. Employees must show up in person and present proper identification before obtaining a password.

C. Employees must send in a signed email before obtaining a password.

D. None of the choices.
Employees must show up in person and present proper identification before obtaining a password.
Which of the following does not apply to system-generated passwords?


A. ) Passwords are harder to remember for users

B. ) If the password-generating algorithm gets to be known, the entire system is in jeopardy

C. ) Passwords are more vulnerable to brute force and dictionary attacks.

D. ) Passwords are harder to guess for attackers
Passwords are more vulnerable to brute force and dictionary attacks
Passwords can be required to change monthly, quarterly, or any other intervals:


A. ) depending on the criticality of the information needing protection

B. ) depending on the criticality of the information needing protection and the password's frequency of use

C. ) depending on the password's frequency of use

D. ) not depending on the criticality of the information needing protection but depending on the password's frequency of use
depending on the criticality of the information needing protection and the password's
In SSL/TLS protocol, what kind of authentication is supported?

A. ) Peer-to-peer authentication
B. ) Only server authentication (optional)
C. ) Server authentication (mandatory) and client authentication (optional)
D. ) Role based authentication scheme
Server authentication (mandatory) and client authentication (optional)
Which of the following correctly describe the difference between identification and authentication?


A. Authentication is a means to verify who you are, while identification is what you are authorized to perform.

B. Identification is a means to verify who you are, while authentication is what you are authorized to perform.

C. Identification is another name of authentication.

D. Identification is the child process of authentication.
Identification is the child process of authentication.
Identification establishes:

A. Authentication
B. Accountability
C. Authorization
D. None of the choices.
Accountability
Identification usually takes the form of:

A. Login ID.
B. User password.
C. None of the choices.
D. Passphrase
Login ID.
What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

A. ) Authentication
B. ) Identification
C. ) Integrity
D. ) Confidentiality
Identification
What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time?

A. ) Authentication
B. ) Identification
C. ) Integrity
D. ) Confidentiality
Authentication
What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time?

A. ) Authentication
B. ) Identification
C. ) Integrity
D. ) Confidentiality
Authentication
Identification and authentication are the keystones of most access control systems. Identification establishes:

A. ) user accountability for the actions on the system
B. ) top management accountability for the actions on the system
C. ) EDP department accountability for the actions of users on the system
D. ) authentication for actions on the system
user accountability for the actions on the system
Identification and authentication are the keystones of most access control systems. Identification establishes:

A. ) user accountability for the actions on the system
B. ) top management accountability for the actions on the system
C. ) EDP department accountability for the actions of users on the system
D. ) authentication for actions on the system
user accountability for the actions on the system
Which one of the following authentication mechanisms creates a problem for mobile users?

A. ) address-based mechanism
B. ) reusable password mechanism
C. ) one-time password mechanism
D. ) challenge response mechanism
address-based mechanism
Which of the following centralized access control mechanisms is not appropriate for mobile workers access the corporate network over analog lines?

A. ) TACACS
B. ) Call-back
C. ) CHAP
D. ) RADIUS
Call-back
Authentication is typically based upon:

A. Something you have.
B. Something you know.
C. Something you are.
D. All of the choices.
All of the choices
A password represents:

A. Something you have.
B. Something you know.
C. All of the choices.
D. Something you are.
Something you know.
A smart card represents:

A. Something you are.
B. Something you know.
C. Something you have.
D. All of the choices.
Something you have.
Which of the following is the most commonly used check on something you know?

A. One time password
B. Login phrase
C. Retinal
D. Password
Password
Retinal scans check for:

A. Something you are.
B. Something you have.
C. Something you know.
D. All of the choices.
Something you are
What type of authentication takes advantage of an individuals unique physical characteristics in order to authenticate that persons identity?

A. Password
B. Token
C. Ticket Granting
D. Biometric
Biometric
What is called an automated means of identifying or authenticating the identity of a living person based on physiological or behavioral characteristics?

A. ) Biometrics
B. ) Micrometrics
C. ) Macrometrics
D. ) MicroBiometrics
Biometrics
Which of the following forms of authentication would most likely apply a digital signature algorithm to every bit of data that is sent from the claimant to the verifier?

A. ) Dynamic authentication
B. ) Continuous authentication
C. ) Encrypted authentication
D. ) Robust authentication
Encrypted authentication
In which situation would TEMPEST risks and technologies be of MOST interest?

A. Where high availability is vital.
B. Where the consequences of disclose are very high.
C. Where countermeasures are easy to implement
D. Where data base integrity is crucial
Where the consequences of disclose are very high
Which one of the following addresses the protection of computers and components from electromagnetic emissions?

A. TEMPEST
B. ISO 9000
C. Hardening
D. IEEE 802.2
TEMPEST
Monitoring electromagnetic pulse emanations from PCs and CRTs provides a hacker with that significant advantage?

A. Defeat the TEMPEST safeguard
B. Bypass the system security application.
C. Gain system information without trespassing
D. Undetectable active monitoring.
Undetectable active monitoring.
What name is given to the study and control of signal emanations from electrical and electromagnetic equipment?

A. EMI
B. Cross Talk
C. EMP
D. TEMPEST
TEMPEST
TEMPEST addresses

A. The vulnerability of time-dependent transmissions.
B. Health hazards of electronic equipment.
C. Signal emanations from electronic equipment.
D. The protection of data from high energy attacks.
Signal emanations from electronic equipment.
Which one of the following is the MOST solid defense against interception of a network transmission?

A. Frequency hopping
B. Optical fiber
C. Alternate routing
D. Encryption
Optical fiber
Which of the following media is MOST resistant to tapping?

A. ) Microwave
B. ) Twisted pair
C. ) Coaxial cable
D. ) Fiber optic
Fiber optic
What type of wiretapping involves injecting something into the communications?

A. Aggressive
B. Captive
C. Passive
D. Active
Active
Why would an Ethernet LAN in a bus topology have a greater risk of unauthorized disclosure than switched Ethernet in a hub-and-spoke or star topology?

A. IEEE 802.5 protocol for Ethernet cannot support encryption.
B. Ethernet is a broadcast technology.
C. Hub and spoke connections are highly multiplexed.
D. TCP/IP is an insecure protocol.
Ethernet is a broadcast technology.
What type of attacks occurs when a smartcard is operating under normal physical conditions, but sensitive information is gained by examining the bytes going to and from the smartcard?

A. Physical attacks.
B. Logical attacks.
C. Trojan Horse attacks.
D. Social Engineering attacks.
Logical attacks.
What is an effective countermeasure against Trojan horse attack that targets smart cards?

A. Singe-access device driver architecture.
B. Handprint driver architecture.
C. Fingerprint driver architecture.
D. All of the choices.
Singe-access device driver architecture
Which of the following could illegally capture network user passwords?

A. ) Data diddling
B. ) Sniffing
C. ) Spoofing
D. ) Smurfing
Sniffing
Which of the following statements is incorrect?


A. ) Since the early days of mankind humans have struggled with the problems of protecting assets

B. ) The addition of a PIN keypad to the card reader was a solution to unreported card or lost cards problems

C. ) There has never been a problem of lost keys

D. ) Human guard is an inefficient and sometimes ineffective method of protecting resources
There has never been a problem of lost keys
A system uses a numeric password with 1-4 digits. How many passwords need to be tried before it is cracked?

A. ) 1024
B. ) 10000
C. ) 100000
D. ) 1000000
10000
Which of the following can be used to protect your system against brute force password attack?


A. Decrease the value of password history.

B. Employees must send in a signed email before obtaining a password.

C. After three unsuccessful attempts to enter a password, the account will be locked.

D. Increase the value of password age.
After three unsuccessful attempts to enter a password, the account will be locked.
Which of the following is an effective measure against a certain type of brute force password attack?

A. Password used must not be a word found in a dictionary.
B. Password history is used.
C. Password reuse is not allowed.
D. None of the choices.
Password used must not be a word found in a dictionary.
Which type of attack will most likely provide an attacker with multiple passwords to authenticate to a system?

A. ) Password sniffing
B. ) Dictionary attack
C. ) Dumpster diving
D. ) Social engineering
Password sniffing
Which of the following are measures against password sniffing?

A. Passwords must not be sent through email in plain text.
B. Passwords must not be stored in plain text on any electronic media.
C. You may store passwords electronically if it is encrypted.
D. All of the choices.
All of the choices
Which one of the following conditions is NOT necessary for a long dictionary attack to succeed?


A. The attacker must have access to the target system.

B. The attacker must have read access to the password file.

C. The attacker must have write access to the password file.

D. The attacker must know the password encryption mechanism and key variable.
The attacker must have write access to the password file.
What is an important factor affecting the time required to perpetrate a manual trial and error attack to gain access to a target computer system?

A. Keyspace for the password.
B. Expertise of the person performing the attack.
C. Processing speed of the system executing the attack.
D. Encryption algorithm used for password transfer.
Keyspace for the password
Which one of the following BEST describes a password cracker?

A. A program that can locate and read a password file.
B. A program that provides software registration passwords or keys.
C. A program that performs comparative analysis.
D. A program that obtains privileged access to the system.
A program that performs comparative analysis.
Which one of the following BEST describes a password cracker?

A. A program that can locate and read a password file.
B. A program that provides software registration passwords or keys.
C. A program that performs comparative analysis.
D. A program that obtains privileged access to the system.
A program that performs comparative analysis.
If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?

A. Birthday
B. Brute force
C. Man-in-the-middle
D. Smurf
Brute force
Which of the following actions can increase the cost of an exhaustive attack?

A. Increase the age of a password.
B. Increase the length of a password.
C. None of the choices.
D. Increase the history of a password.
Increase the length of a password.
Which of the following attacks focus on cracking passwords?

A. SMURF
B. Spamming
C. Teardrop
D. Dictionary
Dictionary
Which of the following can best eliminate dial-up access through a Remote Access Server as a hacking vector?


A. ) Using TACACS+ server

B. ) Installing the Remote Access Server outside the firewall and forcing legitimate users to authenticate to the firewall.

C. ) Setting modem ring count to at least 5

D. ) Only attaching modems to non-networked hosts.
Installing the Remote Access Server outside the firewall and forcing legitimate users to authenticate to the firewall.
What is known as decoy system designed to lure a potential attacker away from critical systems?

A. Honey Pots
B. Vulnerability Analysis Systems
C. File Integrity Checker
D. Padded Cells
Honey Pots
Which of the following will you consider as a program that monitors data traveling over a network?

A. Smurfer
B. Sniffer
C. Fragmenter
D. Spoofer
Sniffer
Which of the following is NOT a system-sensing wireless proximity card?

A. ) magnetically striped card
B. ) passive device
C. ) field-powered device
D. ) transponder
magnetically striped card
Attacks on smartcards generally fall into what categories?

A. Physical attacks.
B. Trojan Horse attacks.
C. Logical attacks.
D. All of the choices, plus Social Engineering attacks
All of the choices, plus Social Engineering attacks
Which of the following attacks could be the most successful when the security technology is properly implemented and configured?

A. Logical attacks
B. Physical attacks
C. Social Engineering attacks
D. Trojan Horse attacks
Social Engineering attacks
What type of attacks occurs when normal physical conditions are altered in order to gain access to sensitive information on the smartcard?

A. Physical attacks
B. Logical attacks
C. Trojan Horse attacks
D. Social Engineering attacks
Physical attacks
Which one of the following is an example of electronic piggybacking?

A. Attaching to a communications line and substituting data.
B. Abruptly terminating a dial-up or direct-connect session.
C. Following an authorized user into the computer room.
D. Recording and playing back computer transactions.
Following an authorized user into the computer room
A system using Discretionary Access Control (DAC) is vulnerable to which one of the following attacks?

A. Trojan horse
B. Phreaking
C. Spoofing
D. SYN flood
Spoofing
Which of the following is an example of an active attack?

A. ) Traffic analysis
B. ) Masquerading
C. ) Eavesdropping
D. ) Shoulder surfing
Masquerading
Shoulder surfing
Which access control model enables the owner of the resource to specify what subjects can access specific resources?

A. ) Discretionary Access Control
B. ) Mandatory Access Control
C. ) Sensitive Access Control
D. ) Role-based Access Control
Discretionary Access Control
The type of discretionary access control that is based on an individual's identity is called:

A. ) Identity-based access control
B. ) Rule-based access control
C. ) Non-Discretionary access control
D. ) Lattice-based access control
Identity-based access control
Which of the following access control types gives "UPDATE" privileges on Structured Query Language (SQL) database objects to specific users or groups?

A. Supplemental
B. Discretionary
C. Mandatory
D. System
Mandatory
With Discretionary access controls, who determines who has access and what privilege they have?

A. End users.
B. None of the choices.
C. Resource owners.
D. Only the administrators.
Resource owners
What defines an imposed access control level?

A. MAC
B. DAC
C. SAC
D. CAC
MAC
Under MAC, who can change the category of a resource?

A. All users.
B. Administrators only.
C. All managers.
D. None of the choices.
Administrators only.
Under MAC, who may grant a right of access that is explicitly forbidden in the access control policy?

A. None of the choices.
B. All users.
C. Administrators only.
D. All managers.
None of the choices.
You may describe MAC as:

A. Opportunistic
B. Prohibitive
C. None of the choices.
D. Permissive
Prohibitive
Under MAC, which of the following is true?

A. All that is expressly permitted is forbidden.
B. All that is not expressly permitted is forbidden.
C. All that is not expressly permitted is not forbidden.
D. None of the choices.
All that is not expressly permitted is forbidden
Under MAC, a clearance is a:

A. Sensitivity
B. Subject
C. Privilege
D. Object
Privilege
Under MAC, a file is a(n):

A. Privilege
B. Subject
C. Sensitivity
D. Object
Object
Under MAC, classification reflects:

A. Sensitivity
B. Subject
C. Privilege
D. Object
Sensitivity
MAC is used for:

A. Defining imposed access control level.
B. Defining user preferences.
C. None of the choices.
D. Defining discretionary access control level.
Defining imposed access control level.
With MAC, who may make decisions that bear on policy?

A. None of the choices.
B. All users.
C. Only the administrator.
D. All users except guests.
Only the administrator.
With MAC, who may NOT make decisions that derive from policy?

A. All users except the administrator.
B. The administrator.
C. The power users.
D. The guests.
All users except the administrator.
Under the MAC control system, what is required?

A. Performance monitoring
B. Labeling
C. Sensing
D. None of the choices
Labeling
Access controls that are not based on the policy are characterized as:

A. Secret controls
B. Mandatory controls
C. Discretionary controls
D. Corrective controls
Discretionary controls
DAC are characterized by many organizations as:

A. Need-to-know controls
B. Preventive controls
C. Mandatory adjustable controls
D. None of the choices
Need-to-know controls
Which of the following correctly describe DAC?


A. It is the most secure method.

B. It is of the B2 class.

C. It can extend beyond limiting which subjects can gain what type of access to which objects.

D. It is of the B1 class.
It can extend beyond limiting which subjects can gain what type of access to which objects.
Under DAC, a subjects rights must be ________ when it leaves an organization altogether.

A. recycled
B. terminated
C. suspended
D. resumed
terminated
In a discretionary mode, which of the following entities is authorized to grant information access to other people?

A. ) manager
B. ) group leader
C. ) security manager
D. ) user
user
With RBAC, each user can be assigned:

A. One or more roles.
B. Only one role.
C. A token role.
D. A security token.
One or more roles.
With RBAC, roles are:

A. Based on labels.
B. All equal
C. Hierarchical
D. Based on flows.
Hierarchical
With __________, access decisions are based on the roles that individual users have as part of an organization.

A. Server based access control.
B. Rule based access control.
C. Role based access control.
D. Token based access control.
Role based access control.