Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Access Control > Flashcards

Access Control Flashcards

(69 cards)

Start Studying
1
Q

What are two types of Integrity?

A

Data Integrity & System Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the opposite of the CIA triad?

A

Disclosure, Alteration, & Destruction (DAD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What must occur before Authentication, Authorization, & Accountability(AAA)?

A

Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What combines authentication and integrity?

A

Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What means users should be granted the minimum amount of access(authorization) required to do their jobs?

A

Least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is more granular than Least privilege?

A

Need to know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

An active entity that accesses a passive entity is known as?

A

Subject(active) and object(passive)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What applies multiple controls to reduce risk on an asset?

A

Defense-in-depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the three primary access control models?

A

Mandatory, Discretionary, and Non-discretionary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are two types of Non-discretionary access control models?

A

Role based and task based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a list of objects and for each entry describes what a subject can do?

A

Access Control List(ACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a one logical point for controlling access through a third party system? Provides a central point for AAA and an example would be Single Sign On(SSO)

A

Centralized access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

______ _________ occurs as individual users gain more access to systems. This can happen intentionally(SSO) or unintentionally which would result in _______ ________.

A

Access Aggregation, Authorization Creep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the following?
A client/server protocol
Runs in the application layer Uses UDP port 1812(authentication) and 1813(accounting)
Considered a AAA system

A

Remote Authentication Dial-In User Service(RADIUS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the successor to RADIUS?

A

Diameter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the following?
Requires user to send an ID and static(reusable) password for authentication
Goes over UDP or TCP port 49

A

TACACS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does TACACS+ offer over TACACS?

A

Provides better password protection through two factor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Why is PAP insecure?

A

When user enters password, it goes over the network in cleartext thus allowing someone to sniff it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does CHAP protect against? What does it depend on?

A

Playback attacks. It depends on a secret only known to the authenticator and peer. This secret is not sent over the link.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Access Control categories fall into what?

A

Administrative(Directive), Technical(Logical), Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a combination of both the identification and authentication of a user?

A

Credential set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the three basic types of authentication methods?

A

Type 1(Something you know) Type 2(Something you have) Type 3(Something you are)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is it when the user is required to provide more than one authentication factor?

A

Strong Authentication or multi factor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is often the weakest form of authentication?

A

Type 1(Something you know)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are the four types of passwords?
Static Passphrases One-time Dynamic
26
Reusable passwords that may or may not expire, work best when combined with another authentication type such as smart card or biometrics?
Static passwords
27
Can be made stronger using nonsense words like XYZZY, described as long static passwords?
Passphrases
28
Used for single authentication, very secure, difficult to manage, impossible to reuse?
One time password
29
This password changes at regular intervals, user could combine their static PIN with a token to create the password, token is expensive?
Dynamic passwords
30
What is it called when an attacker runs a hash algorithm forward many times selecting different passwords to produce a matching hash?
Password cracking
31
This type of attack uses a predefined list of words to run the hash algorithm through in hopes to generate a matching hash?
Dictionary attack
32
This attack appends, prepends, or changes characters in words from a dictionary before hashing attempting to quickly crack complex passwords?
Hybrid attack
33
This attack takes more time by calculating hash outputs for every possible password but is more effective?
Brute Force attack
34
This attack is a precomputed compilation of passwords(or plaintext) and matching hashes(or ciphertext) that can quickly crack almost all hashes?
Rainbow table
35
A ______ value ensures that the same password will encrypt differently when used by different users. This makes Rainbow tables far less effective depending on the length?
Salt
36
An object that helps prove an identity claim?
Token
37
_________ _________ ______ use time or counters to synchronize a displayed token code expected by the authentication server: the codes are synchronized.
Synchronous dynamic tokens
38
A challenge response token authentication system requires a user to enter information into to produce an output which is sent to the system, this is also known as?
Asynchronous dynamic token
39
Biometrics may be used to establish what?
An Identity or to Authenticate
40
What describes the process of registering with a biometric system(ex. Creating an account for the first time)?
Enrollment
41
What describes the process of authenticating to a biometric system(Also called a biometric system response time)?
Throughput
42
False rejection errors are also known as?
Type-I error
43
False acceptance errors are known as?
Type-II error
44
What type of biometric accuracy error is the worst?
FARs(Type II errors) are worse than FRRs (Type I errors)
45
Used to describe the overall accuracy of a biometric system(Also known as the Equal Error rate)?
Crossover Error rate(CER)
46
When the sensitivity of a biometric system increases what also increases and what drops?
FRRs increase and FARs will drop
47
The most widely used biometric control, stored in smart cards, and data(minutiae) must be small enough for authentication?
Fingerprints
48
Scans the blood vessels in a eye, most intrusive, and rarely used due to the health risks/invasion of privacy issues involved?
Retina Scan
49
This biometric control include high accuracy, passive scanning, no health risks?
Iris Scan
50
Measurements are taken from specific points on the subject's hand(Fairly simple, stores info as small as 9 bytes)?
Hand geometry
51
Refers to how hard a user presses a key and the rhythm at which they are pressed(cheap to implement and can be effective)?
Keyboard dynamics
52
Similar to keyboard dynamics, measures the handwriting of the subject while they sign their name?
Dynamic signature
53
This uses measurements of a subject's tone of voice while stating a specific sentence/phrase(Vulnerable to replay attacks, requires compensating controls to make secure)?
Voiceprint
54
What is the process of passively taking a picture of a subject's face and comparing that picture to a list stored in a database?(High cost)
Facial scan or facial recognition
55
Considered to be the fourth type of authentication(through the use of GPS or IP based geolocation or the physical location for a point of sale purchase)?
Someplace you are
56
This allows multiple systems to use a central authentication server to authenticate once and then access multiple, different systems?
Single Sign On(SSO)
57
Applies SSO on a much wider scale(May use OpenID or SAML)
Federated Identity Management(FIdM), also known as Identity Management
58
What is a third party authentication service used to support SSO?
Kerberos
59
Kerberos uses ________ encryption and provides ________ authentication of both client and servers. It protects against _______ ________ and _______ ________.
Symmetric, mutual, network sniffing, replay attacks
60
The authenticator within Kerberos provides a requested service to the client after validating which of the following?
Timestamp
61
Like the Kerberos protocol, SESAME is also subject to what kind of attack?
Password Guessing
62
What are some drawbacks of Kerberos?
Central server as a single point of failure, stores symmetric keys in plaintext, not scalable
63
How is SESAME different from Kerberos?
Supports heterogeneous environments, scalability of public key systems, and use of PACs instead of tickets
64
A security assessment may include what kind of 'narrow' tests?
Penetration test, vulnerability assessment, security audit
65
The pen tester begins with no external or trusted information and begins the attack with public information only?
Zero-Knowledge
66
Internal information is provided to the pen tester including network diagrams, policies and procedures, and sometimes reports from previous pen tests?
Full-Knowledge
67
Scans a network or system for a pre-defined list of vulnerabilities such as system misconfigurations, outdated software, or lack of patching?
Vulnerability scanning(or vulnerability testing)
68
What is a test against a published standard?
Security Audit
69
What is a holistic approach to assessing the effectiveness of access controls?
Security Assessment

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions