Chapter 4 - Access Control, Authentication and Authorization Flashcards Preview

CompTIA Security+ > Chapter 4 - Access Control, Authentication and Authorization > Flashcards

Flashcards in Chapter 4 - Access Control, Authentication and Authorization Deck (25):
1

Rene

What is the mechanism of verifying that identification?

page 131
Authentication

2

Rene

Authentication systems or methods are based on one or more of which 5 factors

page 131
Something you know, such as a password or PIN
Something you have, such as a smart card, token or ID device
Something you are, such as your fingerprints or retinal pattern (often called biometrics)
Something you do, such as an action you must take to complete authentication
Somewhere you are (this is based on geolocation)

3

Rene

Whenever two or more parties authenticate each other, it is know as _______?

page 132
Mutual Authentication

4

Rene

When two or more access methods are included as part of the authenticate process is known as _______?

page 133
Multi-factor Authentication

5

Rene

A system that uses smart cards and passwords is referred to as a _________________?

page 133
Two-Factor Authentication

6

Rene

What are similar to certificates in that they are used to identify and authenticate the user, contain the rights and access privileges to the bearer, and at the completion of a session is destroyed?

page 135
Token

7

Rene

What is collection of computer networks that agree on standards of operation such as security standards?

page 135
Federations

8

Rene

What the 5 Authentication Protocols?

page 139
PAP (Password Authentication Protocol)
SPAP (Shiva Password Authentication Protocol)
CHAP (Challenge Handshake Authentication Protocol)
TOTP (Time-Base One-Time Password)
HOTP (HMAC-Based One-Time Password)

9

Rene

What must you do to configure the router securely?

page 160
Change the default password
Walk through the advanced settings
Keep the firmware upgraded

10

Rene

In the Trusted OS which of the 7 Evaluation Assurance Levels (EAL) requires product developers to use good design practices?

page 159
EAL 2

11

Rene

In the Trusted OS which of the 7 Evaluation Assurance Levels (EAL) requires conscientious development moderate levels of security?

Page 159
EAL 3

12

Rene

In the Trusted OS which of the 7 Evaluation Assurance Levels (EAL) is primarily used when the user wants assurance that the system will operate correctly but threats to security aren't viewed as serious?

page 159
EAL 1

13

Rene

In the Trusted OS which of the 7 Evaluation Assurance Levels (EAL) requires positive security engineering based on good commercial development practices?

page 159
EAL 4

14

Rene

In the Trusted OS which of the 7 Evaluation Assurance Levels (EAL) is intended to ensure that security engineering has been implemented in a product from the early design phases.

page 159
EAL 5

15

Rene

In the Trusted OS which of the 7 Evaluation Assurance Levels (EAL) provides high level of assurance of specialized security engineering?

page 160
EAL 6

16

Rene

In the Trusted OS which of the 7 Evaluation Assurance Levels (EAL) is intended for extreme high levels of security?

page 160
EAL 7

17

Rene

What is Network Bridging?

page 158
Occurs when a device has more than one network adapter card installed and the opportunity presents itself for a user on one of the networks to which the device is attached to jump to the other.

18

Rene

What are the Firewall Rules?

page 157
Block the connection
Allow the connection
Allow the connection only if it is secured

19

Rene

Who issued the CAC?

page 155
The DoD (Department of Defense), issued the CAC (Common Access Card) as a general identification / authorization card for military personnel, contractors and non-DoD employee.

20

Rene

What are the 4 Access Control methods?

page 150
* Mandatory Access Control (MAC)
* Discretionary Access Control (DAC)
* Role-Based Access Control (RBAC)
* Rule-Based Access Control (RBAC)

21

Rene

What is a variation of Mandatory Access Control and it isn't addresses separately on the Security+ exam?

page 150
LBAC (Lattice-Based Control)

22

Rene

What is SSO?

page 149
Single Sign On
The purpose is to give users access to all the applications and systems they need when they logon

23

Rene

What type of authentication does Kerberos use?

page 148
Key Distribution Center (KDC)
KDC authenticates the principle (which can be a user, program or system) and provides it with a ticket.

24

Rene

What type of ticket is the user given when using Kerberos and authenticates with KDC?

page 148
Ticket Granting Ticket (TGT)
This ticket is encrypted and has a time limit of up to 10 hours. The ticket lists the privileges of that user (much like a token)

25

Rene

What is a standardized directory access protocol that allows queries to be made of directories (specifically, pared-down X.500-based directories)?

page 147
Lightweight Directory Access Protocol (LDAP)