Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Domain 1 - Access Control > Flashcards

Domain 1 - Access Control Flashcards

1
Q

Is an active entity in an Information System

A

Subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A Passive data file

A

Object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Is an access control that gives subjects full control of objects they
have been given access to, including sharing the objects with other subjects

A

Discretionary Access Control - DAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

System-enforced access control based on

subject’s clearances and object’s labels

A

Mandatory Access Control - MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Is an access control where subjects are grouped into roles and each
defined role has access permissions based upon the role, not the individual

A

Role-Based Access Control - RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Its purpose is to allow authorized users access to appropriate data and
deny access to unauthorized users.

A

Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

is keeping data secret. Data must only be accessible to users who
have the clearance, formal access approval, and the need to know

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Threat to confidentiality

A

Disclosure of Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Protects against unauthorized alteration of data

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Ensures that information is readily accessible to authorized users or
programs as the information is needed

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Occurs when subjects not only maintain old access rights but gain new
ones as they move from one division to another within an organization.

A

Authorization Creep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

is another non-discretionary access control model, related to RBAC. It is is based on the tasks each subject must
perform, such as writing prescriptions, or restoring data from a backup tape, or
opening a help desk ticket.

A

Task-based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Concentrates access control in one logical point for a system or organization.

A

Centralized Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Local sites support and maintain

independent systems, access control databases, and data.

A

Decentralized Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Is a 3rd party authentication system described in RFC 2865, 2866. Its uses UDP ports 1812 and 1813.

A

Remote Authentication Dial In User Service (RADIUS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

is RADIUS’ successor, designed to provide an improved (AAA) framework. RADIUS provides limited accountability, and has problems with flexibility, scalability, reliability, and security.

A

Diameter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the number of Attribute Value Pairs (AVP) of Radius and Diameter.

A 
Radius = 8
Diameter = 32
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The cornerstone concept of InfoSecurity

A

The CIA triad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Opposing forces to CIA

A

DAD - Disclosure, Alteration and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

True or false. Our mission as information security professionals is to balance the needs of CIA and make trade offs as needed

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Is the unauthorised disclosure of information

A

Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Is the unauthorised modification of data

A

Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Making systems in available

A

Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

—— is a claim of who you are

A

Identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Proving an identity is called ------
Authentication
26
------ describes the actions you can perform on a system once you have identified and authenticated. Actions may include reading, writing, or executing files or programs
Authorisation
27
----- holds a user accountable of his actions. This is typically done by logging and analysing audit data
Accountability
28
It means a user cannot deny having performed a transaction. It combined authentication and integrity
Non repudiation
29
True of false. You must have both authentication and integrity to have non repudiation
True
30
It means users should be granted the minimum amount of access (authorisation) required to do their jobs
Least Privilege
31
Is an active entity on a data system
Subject
32
This applies multiple safeguards also called controls, measures taken to reduce risk to protect an asset
Defence in depth or layered defenses
33
True or false. All controls can fail, and sometimes multiple control will fail. Deploying a range of different Defense in depth safeguards in your your organisation lowers the chance that all control will fail.
True
34
---- give subjects full control of objects they have been given access to, including sharing the objects with other subjects
Discretionary Access Control - DAC
35
Is a system enforced access control based on subject clearances and object labels
Mandatory Access Control -MAC
36
True or false. A subject may access an object only if the subjects clearance is equal to or greater than the objects label.
True
37
It defines how information is accessed on a system based on the role of the object
Role Based Access Control - RBAC
38
True or false. RBAC is a type of non discretionary access control because users do not have discretion regarding the group of objects they are allowed to access and are unable to transfer objects to other subjects.
True
39
Is another non discretionary access control model, related to RBAC based on the tasks each subject must perform, such as writing prescriptions, restoring data from a backup tape, or opening a help a help desk ticket.
Task Based Access Control
40
Concentrates access control in one logical point for a system or organisation
Centralised Access Control
41
Is an access control where organisations spans to multiple location. The local sites support and maintain independent systems, access control database and data
Decentralised Access Control
42
This occurs as individual users gain more access to more systems
Access aggregation
43
Users gain more entitlements without shedding the old ones.
Authorisation creep
44
Is a centralised access control system that requires users to send an ID and static (reusable) password for authentication. It uses UDP or TCP port 49.
TACACS
45
In Microsoft trust relationship, if A trust B, then A will trust all B's trusted partners. What type of relationship is this?
Transitive trust
46
This means limiting the access of authorised users to data they require to perform their duties
Least Privilege
47
This allows an organisation to maintain checks and balances among the employees with privileged access by having more than one individual to perform part of a sensitive transaction.
Separation of Duties
48
This describes a process that requires different staff perform the same duty.
Rotation of Duties
49
Is a label that shall be applied to information,the unauthorised disclosure of which reasonably could be effected to cause exceptionally grave damage to the national security.
Top Secret
50
Is a label that shall be applied to information,the unauthorised disclosure of which reasonably could be effected to cause serious damage to the national security.
Secret
51
Is a label that shall be applied to information,the unauthorised disclosure of which reasonably could be effected to cause damage to the national security.
Confidential
52
Is a determination about whether or not a user can be trusted with a specific level of information
Clearance. Remember objects have labels, subject have clearances
53
Is documented approval from data owner for a subject to access certain objects, requiring the subject to understand all of the rules , and requirements for accessing data and consequences should the data become lost, destroyed or compromised
Formal Access Approval
54
What are the six access control types?
``` Preventive Detective Corrective Recovery Deterrent Compensating ```
55
Three access control categories
Administrative Technical Physical
56
Is a type of access control that prevents actions from occurring.
Preventive
57
Are controls that alert during or after a successful attack
Detective
58
Is control that works by correcting a damaged system or process
Corrective
59
After a security incident has occurred, this control may have to be taken in order to restore the functionality of the system and organisation.
Recovery
60
This control deter users from performing an actions on a system
Deterrent
61
Is an additional security control put in place to compensate for weaknesses in other control
Compensating
62
These controls are implemented by creating and following organisational policy, procedure, or regulation. User training and awareness also fall into this category
Administrative
63
These controls are implemented using software, hardware, or firmware that restricts logical access on an information technology system . Examples includes firewalls, routers, encryption, etc
Technical
64
These controls are implemented with physical devices such as locks, fences, gates, security guards, etc...
Physical
65
Is a term used for the combination of both identification and authentication of a user
Credential set
66
Three basic authentication methods
Type 1 - something that you know Type 2 - something that you have Type 3 - something you are
67
Is reusable password that may or may not expire
Static password
68
----- Are long static passwords, comprises of words in phrases or sentence
Passphrase
69
This password may be used for single authentication, impossible to reuse and is valid for single use
One time password
70
----passwords that change at regular intervals
Dynamic Passwords
71
This requires that user present more than one authentication factor
Strong authentication or multifactor authentication

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions