IS3340 CHAPTER 3

Question 1

An individual entry in a CACL is called ___?

Answer 1

ACCESS CONTROL ENTRY (ACE)

Question 2

The list of access permissions for an object is called ___?

Answer 2

ACCESS CONTROL LIST (ACL)

Question 3

Shared database of domain users, groups, computers, resources, and other information, along with network functionality to centralize and standardize network management and interoperation is called ___?

Answer 3

ACTIVE DIRECTORY

Question 4

This is an access control approach that systematically nests individual user accounts in groups that make securing objects more general. It is an acronym for Accounts, Global groups, Universal groups, domain Local groups, and Permissions and is usually called ___?

Answer 4

AGULP

Question 5

The process of collecting performance information on what actions were taken and storing that information for later analysis is called ___?

Answer 5

AUDITING

Question 6

GUIDS used in the Windows registry to identity objects and record many of their attributes is called ___?

Answer 6

CLASS IDENTIFIERS (CLSIDs)

Question 7

An international set of standards for functionality and assurance of computer security. This is supersedes the Orange Book as well as other standards and is called ___?

Answer 7

COMMON CRITERIA

Question 8

The list of access permissions for an object, based on access granted by the object’s owner is called ___?

Answer 8

DISCRETIONARY ACCESS CONTROL LIST (DACL)

Question 9

A server computer designated to handle Active Directory requests is called ___?

Answer 9

DOMAIN CONTROLLER

Question 10

Access permissions to an object calculated based on the requesting subjects’ identification and group memberships is called ___?

Answer 10

EFFECTIVE PERMISSIONS

Question 11

Identification value that is unique across all environments to keep track of an object across many computers is called ___?

Answer 11

GLOBALLY UNIQUE ID (GUID)

Question 12

A set of named entities that define a group of users for the purposes of defining permissions that apply to multiple users is called ___?

Answer 12

GROUP

Question 13

A computer network authentication protocol which allows computers to communicate in a secure manner across an insecure network, and the default authentication protocol for Windows. This is called ___?

Answer 13

KERBEROS

Question 14

A computer designated to authenticate users and, upon authentication, issue Kerberos keys that will allow subjects to access objects is called ___?

Answer 14

KEY DISTRIBUTION CENTER (KDC)

Question 15

User accounts that are defined using the principle of least privilege is called ___?

Answer 15

LEAST PRIVILEGE USER ACCOUNTS (LUAs)

Question 16

Authentication protocol used in legacy Windows systems to support secure communication across an insecure network is called ___?

Answer 16

NETWORK TRANSLATION LAN MANAGER (NTLM)

Question 17

This was one of the early formal standards for computer security. The United States Department of Defense Trusted Computer System Evaluation Criteria (DOD-5200.28-STD) is commonly called ___.

Answer 17

ORANGE BOOK

Question 18

The practice of providing a user or process with only the necessary access required to carry out a task is called ___?

Answer 18

PRINCIPLE OF LEAST PRIVILEGE

Question 19

An encryption key that can be shared and does not need to be kept private is called ___?

Answer 19

PUBLIC KEY

Question 20

A document used by Windows to store all SIDs associated with a process is called ___?

Answer 20

SECURITY ACCESS TOKEN (SAT)

Question 21

Windows feature that prompts users for a confirmation before escalating to administrator privileges is called ___?

Answer 21

USER ACCOUNT CONTROL

Question 22

1. Which of the following best describes the principle of least privilege?
2. Providing the necessary access to carry out any task
3. Providing access to the least number of objects possible
4. Providing just the necessary access required to carry out a task
5. Providing access equivalent to the least populated security group

Answer 22

Providing just the necessary access required to carry out a task

Question 23

2. Which type of user account is designed using the principle of least privilege?
3. LUA
4. SID
5. GUID
6. KDC

Answer 23

LUA

Question 24

3. What structure does the Windows operating system use to store collections of permissions for objects?
4. ACE
5. DACL
6. GUID
7. CLSID

Answer 24

DACL

Question 25

4. If a regular user is a member of four groups, how many SIDs will be stored in the user's SAT? 1. 1 2. 4 3. 5 4. 6

Answer 25

5

Question 26

5. Which of the following best describes UAC? 1. Prompts users before escalating to administrator privileges 2. Prevents processes from escalation to administrator privileges 3. Terminates programs that attempt to escalate to administrator privileges 4. Alerts users that attempts to escalate to administrator privileges have been automatically denied

Answer 26

Prompts users before escalating to administrator privileges

Question 27

6. Which protocol does the Windows operating system use by default to authenticate computers to exchange security information? 1. Kerberos 2. NTLM 3. SAML 4. TCP/IP

Answer 27

Kerberos

Question 28

7. When viewing an object's DACL, which permission indicates that advanced permissions have been set? 1. Extended permissions 2. Advanced permissions 3. Special permissions 4. Level II permissions

Answer 28

Special permissions

Question 29

8. Which type of identifier was originally developed to identify ActiveX controls? 1. SID 2. PID 3. CLSID 4. GUID

Answer 29

GUID

Question 30

9. Which type of identifier is used to identify user groups? 1. SID 2. PID 3. CLSID 4. GUID

Answer 30

SID

Question 31

10. If a user, user A

Answer 31

No, because group B denies read access to helloWorld.c

Question 32

11. Why should you carefully design an auditing strategy before turning auditing on? 1. Auditing incomplete information wastes analysis time 2. Auditing too much information causes excessive overhead 3. Ad-hoc auditing rarely provides useful information 4. Audit log files only retain limited information without extensive configuration

Answer 32

Auditing too much information causes excessive overhead

Question 33

12. Which of the following guidelines tend to provide the most useful auditing information? 1. Always audit event success and failures 2. Never audit both event successes and failures 3. Generally audit event failures 4. Do not audit event failures unless you first audit event successes

Answer 33

Generally audit event failures

Question 34

13. What tool is most commonly used to view and search audit logs? 1. Windows Event Viewer 2. Windows Log Viewer 3. Windows Audit Viewer 4. Window ACL Viewer

Answer 34

Windows Event Viewer

Question 35

14. Which of the following Windows tools replaces previous legacy tools and allows ACL modifications 1. Cacls 2. Xcacls 3. iCacls 4. SubInACL

Answer 35

iCacls

Question 36

15. When using AGULP, for which entity type are local object permissions defined? 1. User accounts 2. Global groups 3. Universal groups 4. Domain local groups

Answer 36

Domain local groups