Security Fundamentals - Ch 2 - Authentication, Authorization, And Accounting

Front 1

Which of the following services is used for centralized AAA?
a - VPN
b - PGP
c - RADIUS
d - PKI

Back 1

The RADIUS protocol, remote authentication dial-in user service, provides centralized authentication, authorization, and accounting for users who need to connect to a network service. pg 23

PKI - public key infrastructure - a system to deal with digital certificates pg 47
PGP - pretty good privacy - a protocol to encrypt email pg 51

Front 2

What is the primary authentication method used in Microsoft Active Directory?
a - LDAP
b - Kerberos
c - NTLAN
d - SSO

Back 2

Active Directory is a technology that provides a variety of network services, pg 25

Kerberos is the default authentication protocol for today's domain computers. In instances where Kerberos is blocked (e.g. by a firewall), servers can fall back to NTLM as a fall-back protocol. pg 26

Lightweight directory access protocol (LDAP) is an application protocol for querying and modifying data using directory services over TCP/IP

NTLAN is probably NTLM

SSO, single sign-on, allows you to log on once and access multiple related but independent software services without having to log on again. pg 25

Front 3

Which NTFS permission is needed to change attributes and permissions?
a - Full control
b - modify
c - read and execute
d - write

Back 3

a - full control. pg 35

Front 4

In the world of information security, _____________ is a leading model for access control.

Back 4

AAA
Authentication
Authorization
Accounting (or auditing)
pg 20

Front 5

How does the concept of nonrepudiation relate to AAA?

Back 5

If you have established proper AAA, no user should be able to deny the actions he or she has carried out while in your organization's system - everything is tracked, monitored, and able to be accounted for.
pg 20

Front 6

What are some ways to authenticate local users?

Back 6

Authentication via
- what they know (passwords, personal details)
- what they possess (smart cards, security tokens)
- what they are (fingerprints, facial recognition, etc)
pg 21-22

Front 7

When you dial in with a VPN or access a wireless router via a laptop or other mobile device you are connecting to a RADIUS or TACACS+ server. What is going on behind the scenes to get you authenticated?

Back 7

The server resides on a remote system and responds to queries from clients like the one you're using and also from switches, WAPs, and routers. The server authenticates username/password combinations, determines whether users are allowed to connect, and logs the connection.
pg 23

Front 8

When it comes to setting up a AAA server, you can choose between RADIUS and TACACS+. Are these two protocols the same?

Back 8

While they are not the same, TACACS+ is a variation of RADIUS created by CISCO and containing extra functions to meet their needs. It can be considered an extension of RADIUS
pg 24

Front 9

Active Directory has been called the heart of a Windows server. What is it?

Back 9

Active Directory service is technology developed by MS that
- stores, organizes, and provides access to information.
- locates, manages, and administers common items and network resources
- provides a variety of network services
- organizes those network resources
- permits administrators to assign passwords, permissions, and rights to those entities that need them
- allows for the assignment of group object managers
pg 25

Front 10

What is the Lightweight Directory Access Protocol?

Back 10

LDAP is an application protocol (network service) that provides for the querying and modifying of data using directory services running over TCP/IP,

Within the directory the objects are organized hierarchically to aid in location and management.

Front 11

What is a domain controller? For that matter, what the heck is a domain??

Back 11

First, let's get things straight here: On a local area network, a domain is a subnetwork made up of a group of clients and servers under the control of a central security database. Within a domain, users authenticate once to a centralized server known as a domain controller, rather than repeatedly authenticating to individual servers and services. Individual servers and services accept the user based on the approval of the domain controller.
(from Indiana University IT Knowledgebase)

A domain controller is a windows server that stores a replica of the account and security info of a domain and defines the domain boundaries.

A windows server can become a domain controller after Active Directory Domain Services is installed.
Pg 25

Front 12

What is Kerberos?

Back 12

Kerberos is the default computer network authentication protocol, which allows hosts to prove their identity over a nonsecure network in a secure manner.
In an environment with Kerberos-based authentication, hosts are assigned secret keys which the server keeps track of.

Front 13

To help organize objects within a domain organizational units are used. What do they hold?

Back 13

OUs can hold users, groups, computers, and even other OUs. The objects must reside within the domain. Pg 27
OUs can be organized by location, function, or areas of management.
If an object can hold other objects it's called a container and include the forest, tree, domain, and OU.

Front 14

T/F: Rights and permissions should be assigned to every user to properly secure the network.

Back 14

False. Users should be placed into groups that have to proper rights and permissions for those users already applied. pg 32

Front 15

To effectively manage the assigning of network resources to groups the mnemonic AGDLP is helpful. What does this mean?

Back 15

Defines how to add users to a domain:
1. add the user Account into the Group where the user exists
2. add the group from the user domain into the Domain Local group in the resource domain
3. assign Permissions on the resource to the domain local group
pg 33

Front 16

What is the difference between rights and permissions? Where is this information stored?

Back 16

A right authorizes a user to perform certain tasks on a computer whereas a permission defines the type of access granted to an object or object attribute (e.g., files, folders and printers).

Information about which users can access an object and what they can do with it is stored in the access control list.

Front 17

Why is NTFS preferred over FAT32?

Back 17

The most significant advantages of NTFS include much larger file support and built in security through permissions and encryption
pg 35

Front 18

Describe NTFS permissions

Back 18

Front 19

If a user is part of two groups and has permission to modify the contents of a folder as part of his group 1 permissions, but is denied the same right in the other group (explicit denial pg 38) what will be his effective permissions for that folder?

Back 19

He will be denied modify permission because explicit denial always takes precedence.

Front 20

Describe share permissions (pg 41)

Back 20

Front 21

What is UNC?

Back 21

UNC stands for universal naming convention
\\servername\sharename
pg 40

Front 22

Transmitting private data over the public internet is (hopefully) done with either SSL or TLS. What are these and what is the difference between them?

Back 22

SSL, secure sockets layer is a cryptographic system that uses 2 keys to encrypt data.
TLS, transport layer security, is an extension of SSL designed to be open-source to support continuing innovation.
TLS is generally the standard in modern browsers today, though SSL can be used instead if needed.

pg 51

Front 23

What are the two encryption technologies offered with Windows 7?

Back 23

Windows 7 has two built in encryption technologies - EFS - Encrypting File System - and Bitlocker. The former encryptes files and folders while the later encrypts entire drives.

Front 24

What is IP Security, AKA IPsec?

Back 24

IPsec is a suite of protocols that handle data integrity, authentication, and privacy for internet communication. It protects communications by creating secure electronic tunnels between two machines or devices and can be used for VPNs, LANs, and WANs.

It can be used in one of two modes:
Transport - client to server
Tunnel - server to [server or gateway]

You must choose one of two protocols to use
- ESP, encapsulating security payload - secures the message, but not the entire packet the message rides in
- AH, authentication header - secures the entire packet but does not encrypt anything (it is readable but protected from modification)
Pg 57-8

Front 25

Which of the following services is used for centralized AAA?
a - VPN
b - PGP
c - RADIUS
d - PKI

Back 25

c - RADIUS

Front 26

What is the primary authentication method used on MS Active Directory?
a - LDAP
b - Kerberos
c - NTLAN
d - SSO

Back 26

b - Kerberos

Front 27

The master time keeper and password manager in an Active Directory domain is
a - PDC Emulator
b - RID
c - Infrastructure master
d - Schema master

Back 27

a - PDC Emulator

Front 28

Local user accounts are found in
a - Active Directory
b - Registry
c - SAM
d - LDAP

Back 28

c - SAM, or security account manager

Front 29

A(n) ___________ authorizes a user to perform certain actions on a computer.
a - permission
b - encryption algorithm
c - authentication protocol
d - right

Back 29

d - right
pg 34

Front 30

Which NTFS permission is needed to change attributes and permissions?
a - full control
b - modify
c - read and execute
d - write

Back 30

a - full control

Front 31

Which type of permission is granted directly to a file or folder?
a - explicit
b - inherited
c - effective
d - share

Back 31

a - explicit

Front 32

If you copy a file or folder to a new volume, what permissions will it have?
a - the same as it had before
b - the same as the target folder
c - the same as the source folder
d - none

Back 32

b - the same permissions as the target folder.

If it was MOVED it would retain its own permissions

Front 33

Which of the following uses an ACL?
a - NTFS folder
b - Active Directory user
c - Registry key
d - Login rights

Back 33

a-c
Information about which users can access an object and what they can do is stored in the Access Control List. pg 34
The registry uses permissions that are stored in the ACL pg 44

Front 34

Which type of key has one key for encryption and a different key for decryption?
a - asymmetric
b - symmetric
c - hash function
d - PKI

Back 34

a - asymmetric encryption uses 2 keys for encryption - one to encrypt and one to decrypt. SSL, TLS, and PGP all use asymmetric keys.
pg 46
PKI, public key infrastructure, is a system consisting of hardware and software that control the use and storage of digital certificates.

Front 35

What is a certificate revocation list?

Back 35

Pg 47 - a CRL, or certificate revocation list, is a list of certificates that have been revoked or are no longer valid and therefore should not be relied upon.

Front 36

A device that may give you a second password with which to log into a system is a(n) _______________.

Back 36

security token, pg 22. AKA hardware token, or hard token. Such a device is issued to verified users to aid in authentication and are typically small enough to be clipped to a keychain. Some of them use a USB connector or RFID or bluetooth.

Some can generate a second code that users must input in order to be authenticated.

Front 37

When you can't access a folder because someone removed the permissions, you must _______________ to gain access to it again.

Back 37

take ownership of the folder

Front 38

To track a user's activities in Windows, you need to enable _____________.

Back 38

auditing

Front 39

List some of the disadvantages to biometrics.

Back 39

1. Expensive (Fulcrum Biometrics sells their entry-level biometric server software for $2,500)
2. Some people might be missing the required body part
3. Requires a biometric database