Domain 1 Flashcards
(34 cards)
What are the three critical areas of security?
a) Authentication, Accreditation, and Authorization
b) Integrity, Confidentiality, and Availability
c) Confidentiality, Integrity, and Authentication
d) Non-repudiation, Availability, and Integrity
Integrity, Confidentiality, and Availability
Which of the following critical areas of security represents the unauthorized modification of information?
a) Confidentiality
b) Repudiation
c) Authorization
d) Integrity
Integrity
Which formula below accurately represents the equation for calculating the risk associated with your critical assets?
a) Risk = Vulnerability x Likelihood
b) Threat = Risk x Vulnerability
c) Risk = Threat x Vulnerability
d) Vulnerability = Threat x Risk
Risk = Threat x Vulnerability
Of the four core principles of network security, which one relates to understanding which services are running on your system?
a) Defense-in-Depth
b) Principle of Least Privilege
c) Prevention is Ideal but Detection is a Must
d) Know Thy System
Know Thy System
Giving Bob, the accountant, access only to the Accounting application required for his duties is an example of which core security principle?
a) Defense-in-Depth
b) Principle of Least Privilege
c) Know Thy User
d) Know Thy System
Principle of Least Privilege
Which principle is represented by an accountant creating a company’s books and an auditor reviewing the books for accuracy?
a) Separation of Duties
b) Principle of Least Privilege
c) Job Rotation
d) Know Thy System
Separation of Duties
Which access control measure method would be affected by an inaccessible system administrator?
a) Preventive
b) Suggestive
c) Incentive
d) Detective
Detective
Which of the following concepts relates most closely to the Principle of Least Privilege?
a) Authentication
b) Identity
c) Detection
d) Separation of Duties
Separation of Duties
If Dan, a user with level three clearance, attempts to read a document requiring a level four clearance, he is violating which of the following access control techniques?
a) The Star Property of the Bell-LaPadula Model
b) The Simple Security Property of the Bell-LaPadula Model
c) The Simple Integrity Property of the Biba Model
d) The Super Simple Star Property of Biba Model
The Simple Security Property of the Bell-LaPadula Model
Which of the following access control techniques requires the user to follow a procedure to access protected data?
a) The Clark-Wilson model
b) The Biba model
c) The Middleman model
d) The Bell-LaPadula model
The Clark-Wilson model
Which of the following characteristics makes the BIBA model the opposite of the Bell LaPadula (BLP) model?
a) No write down and no read up
b) Read up but no write down
c) No read down and no write up
d) Write down but no read up
No read down and no write up
In the process of employee termination, which access management activity most effectively controls access?
a) Account administration
b) Account maintenance
c) Account monitoring
d) Account revocation
Account revocation
Of the four ways a user can be authenticated, which presents the use of physical human attributes in the process?
a) Something you are
b) Something you have
c) Something you know
d) Something you share
Something you are
If you had a classified system located in the middle of the desert, which authentication method would serve best?
a) Something you have
b) Something you know and are
c) Something you share
d) Someplace you are
Someplace you are
What is the MOST influential factor in determining if a biometric solution is feasible for a system?
a) System size
b) Usability
c) Criticality
d) Cost
Cost
Which authentication method negotiates the validity of the user through tickets?
a) Single Sign On (SSO)
b) System Generated Passwords (SGP)
c) Challenge Handshake Authentication Protocol (CHAP)
d) Kerberos
Kerberos
Which password cracking technique will eventually figure out Jim’s hard-to-guess password?
a) Hybrid attack
b) Brute force attack
c) Dictionary attack
d) Long-term attack
Brute force attack
Stateful inspection of packets is an example of which kind of access control?
a) Prevention
b) Detection
c) Suspension
d) Eradication
Prevention
Which are the three common methods used in password cracking?
a) Dictionary, hybrid, and brute force
b) Word list, brute force, and distributed
c) John the ripper, LOphtcrack, and hydra
d) SAM, passwd, and shadow
Dictionary, hybrid, and brute force
Which of the following are among the primary design types used for access control systems today?
a) Mandatory, discretionary, and role-based
b) Interaction, fixed, and closed
c) Subject-based, object-based, and file-based
d) Mandatory, optional, and discretionary
Mandatory, discretionary, and role-based
Which of the following access control techniques associates a group of users and their privileges with each object?
a) Role Based Access Control
b) Token Based Access Control
c) List Based Access Control
d) User Based Access Control
List Based Access Control
Which of the following is NOT an example of a Mandatory Access Control (MAC) technique?
a) Secure Communications Processor (SCOMP)
b) SMURF
c) Pump
d) Purple Penelope
SMURF
Which of the following access control techniques allows the user to feel empowered and able to change security attributes?
a) Discretionary Access Control
b) Mandatory Access Control
c) Optional Access Control
d) User Access Control
Discretionary Access Control
Which of the following control types is used to provide alternatives to other controls?
a) Compensating
b) Deterrent
c) Corrective
d) Recovery
Compensating
