Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Sec+ > Chapter 2: Understanding Identity and Access Management > Flashcards

Chapter 2: Understanding Identity and Access Management Flashcards

(76 cards)

Start Studying
1
Q

What is Authentication?

A

The method(s) an individual uses to prove an identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Identification?

A

An action that occurs whenever a user makes a claim about their identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does AAA stand for?

A

Authentication, Authorization, and Accounting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the AAA process?

A

If a user can authenticate their identity, then the user is granted authorization to access resources based on their identity. Then their accounts are accounted for by tracking their activities in logs. AAA works together with identification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an Audit Trail?

A

Created by collecting logs on activities and events which allow security professionals to recreate the events that preceded a security incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are Authentication Factors?

A

The different methods used to authenticate a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is “Something you know”?

A

It is an authentication factor that refers to a shared secret. Considered the least secure because secrets can be stolen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are examples of “Something you know”?

A

Passwords (length, expiration/age, history, manage/ etc).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Static Knowledge-based Authentication?

A

Typically used to verify identity when you’ve forgotten your password with questions you would know the answers to (e.g. mother’s maiden name).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Dynamic Knowledge-based Authentication?

A

Typically used to verify an individual’s identity without an account. Organizations query public and private data sources to ask questions (e.g. which high school did you attend)?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Identity Proofing?

A

It’s a security measure to confirm a new user’s identity when they are creating an account for the first time (e.g. collecting PII, checking official docs, etc).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an Account Lockout Threshold?

A

The maximum amount of times a user can enter their password incorrectly. Once the threshold is reached, the system locks the user’s account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an Account Lockout Duration?

A

Indicates how long an account remains locked (could be a minute, could be indefinite until an admin unlocks the account).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is “Something you have”?

A

An authentication factor that refers to something that you can physically hold.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Smart Card?

A

Credit card-sized card that have an embedded microchip and a certificate. They are often used with two-factor authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are Embedded Certificates?

A

They hold a user’s private key (only accessible to the user) and is matched with a public key (available to others). The private key is used each time the user log on to a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Security Key?

A

A small electronic device used to authenticate in to systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a Hard Token (Hardware token)?

A

A small electronic device that displays a number on the screen which is used to authenticate a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a One-Time Password (OTP)?

A

A temporary, single-use code that’s used to verify your identity (proves you’re in possession of the token).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a Soft Token (Software Token)?

A

An application that runs on a user’s smartphone and generates an OTP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is HMAC-OTP?

A

An algorithm that changes the numeric code based on a moving counter. The server and token use the algorithm with a shared private key to generate the next code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Time-based-OTP (TOTP)?

A

An algorithm that changes their code based upon the current time. The OTP they generate usually lasts only 30-60secs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is “Something you are”?

A

It is an authentication factor that refers to the use of biometrics for authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are Fingerprints?

A

Systems that use fingerprint scanners to read a person’s fingerprints to authenticate their identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is Vein Matching?
Systems that authenticate a user using near-infrared light to view their vein patterns (usually on the palm).
26
What is Retina Imaging?
Systems that authenticate a user using retina scanners of one or both eyes. Unpopular because they are physically and medically intrusive.
27
What are Iris Scanners?
Systems that authenticate a user using infrared technology to capture the unique pattern of the iris around the pupil. They can take pictures from 3-10in away, avoiding physical contact.
28
What is Facial Recognition?
Systems that authenticate users based on their facial features which include the size, shape, and position of their eyes, nose, mouth, cheekbones, and jaw.
29
What is Voice Recognition?
Systems that authenticate users based on their speech. People's voices differ from others due to the varying sizes of everyone's mouth and throat.
30
What is a Gait Analysis?
Systems that authenticate users based on the way they walk/run.
31
What is considered the best biometric method of authentication?
Both retina and iris. However, iris is preferred because it's less intrusive.
32
What is a system's Efficacy Rate?
Refers to the performance of the system under ideal conditions.
33
What is False Acceptance?
Whenever a biometric system incorrectly identifies a user as a register user.
34
What is False Acceptance Rate (FAR)?
The percentage of time false acceptances occur.
35
What is False Rejection?
Whenever a biometric system incorrectly rejects a registered user.
36
What is False Rejection Rate (FRR)?
Identifies the percentage of times a false rejection occurs.
37
What is True Acceptance?
Whenever a biometric system correctly identifies a registered user.
38
What is True Rejection?
Whenever a biometric system correctly rejects an unknown user.
39
What is the Crossover Error Rate (CER)?
The point where the FAR crosses over with the FRR. A lower CER indicates that the biometric system is more accurate.
40
What happens if you tighten the biometrics system to avoid false accepts (security focus)?
You risk more false rejections, frustrating users.
41
What happens if you loosen the biometrics system (convenience)?
You risk more false accepts, increasing security risks.
42
What is "Somewhere you are"?
An authentication factor that refers to a user's location for authentication.
43
What is Impossible Travel Time?
A method that identifies when a user's account is accessed from locations within a time frame that's not possible for normal travel.
44
What is Two/Dual-Factor Authentication?
An authentication method that uses a combination of two of the following authentication factors: something you know, have, are, or somewhere you are.
45
What is Multifactor Authentication?
An authentication method that uses two or more authentication factors (something you are, have, know, or somewhere you are).
46
What is Passwordless Authentication?
Eliminates passwords altogether and replaces them with another authentication factor (no something you know methods).
47
What are Authentication Logs?
Used to track successful/unsuccessful login attempts and contain what happened, when it happened, where it happened, and who or what did it.
48
What is Account Management?
The process of creating, managing, disabling, and terminating accounts.
49
What are Credential Policies?
Define the login policies for different personnel, devices, and accounts.
50
What is Privileged Access Management (PAM)?
Allows organizations to apply more stringent security controls over elevated accounts to reduce the risk of insider threats, protect against external cyberattacks, meet compliancy requirements, and enhance visibility and control over critical systems.
51
What are some of the capabilities of PAM?
Allowing users to access the privilege account without knowing the password. Automatically changing the privilege account passwords periodically. Limiting the time users can use the privilege account. Allow users to check out credentials. Log all access of credentials.
52
What are Temporal Accounts?
Temporary administrative accounts that are issued for a limited period of time.
53
What is Just-in-time permissions?
A practice that limits user access to resources and systems to predetermined time periods.
54
Why isn't it a good idea to have shared and generic accounts?
If multiple users share a single account, you cannot implement authorization controls (AAA).
55
What is Deprovisioning?
The process used to disable a user's account when they leave the organization.
56
What are some examples of a good disablement policy?
Disabling the accounts of terminated employees (both resigned and fired), those on leave of absence, and eventual account deletion once the account is no longer necessary.
57
What is a Time-based login?
Ensures that users can only log on to computers during specific times. AKA time-of-day restrictions.
58
What are Account Audits?
The analysis of permissions and rights assigned to users to help enforce the least privilege principle.
59
What is Privilege Creep?
When users gradually accumulate more access rights than they need to perform their jobs.
60
What is Attestation?
The formal process for reviewing user permissions.
61
What is Single Sign-on (SSO)?
An authentication service where a user can log-in once and access multiple systems without logging on again.
62
What is a Federation?
A system where multiple organizations agree to trust each other's authentication, allowing users to access multiple services with a single set of credentials.
63
What is the Security Assertion Markup Language (SAML)
An open standard that enables secure, single sign-on (SSO) by allowing identity providers to share authentication and authorization data with service providers.
64
What doesn't SSO provide?
SSO does not provide authorization.
65
What is OAuth?
An open standard that allows users to grant websites or apps limited access to their resources without sharing their password.
66
What doesn't OAuth provide?
OAuth does not provide authentication.
67
In the context of authorization models, what are Subjects?
Typically users, groups, or services that access an object.
68
In the context of authorization models, what are Objects?
They are items such as files, folders, shares, and printers that subjects access.
69
What is Role-based Access Control (role-BAC)?
A security model where user access is determined by their role, assigning permissions based on job responsibilities.
70
What is Rule-based Access Control (rule-BAC)?
A security model where access decisions are based on predefined rules or conditions; such as time, location, or specific actions.
71
What is Discretionary Access Control (DAC)?
A security model where the resource owner decides who can access or modify their resources.
72
What is a Security Identifier (SID)?
A long string of numbers beginning with the letter S and separated by a series of dashes. They are used as identifiers for a user, user group, or other security principal.
73
What is Mandatory Access Control?
A strict security model where access is controlled by a central authority based on classifications and security policies (uses labels to determine access).
74
Name an OS that uses the MAC Scheme.
Security-enhanced Linux (SELinux).
75
What is Attribute-based Access Control?
A security model where access decisions are based on the attributes of users, resources, and the environment rather than roles or rules.
76
When analyzing authentication logs, what are some things you should be looking for?
Account lockouts, concurrent session usage, impossible travel time, blocked content, resource inaccessibility, and log anomalies.

CompTIA Sec+ (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions