OBJ 4.1 X

Question 1

Confidentiality, integrity, availability (CIA)

Answer 1

CIA Triad

Question 2

Common vulnerabilities and exposures (CVE)

Answer 2

A list of publicly disclosed computer security weaknesses

Question 3

Zero-day

Answer 3

Brand new vulnerability

Question 4

Exploits

Answer 4

Piece of software code that takes advantage of a security flaw or
vulnerability within a system or network

Question 5

Least privilege

Answer 5

Using the lowest level of permissions or privileges needed in order to
complete a job function or admin task

Question 6

Role-based access

Answer 6

Discretionary Access Control (DAC) -An access control method where access is determined by the
owner of the resource

Mandatory Access Control (MAC)
● An access control policy where the computer system gets to decide who gets access to what objects

Role-Based Access Control (RBAC)
▪ An access model that is controlled by the system but focuses on a set of
permissions versus an individual’s permissions
▪ Creating groups makes it easy to control permissions based around actual job functions

Question 7

Zero Trust

Answer 7

A security framework that requires users to be authenticated and
authorized before being granted access to applications and data

Question 8

Defense in depth

Answer 8

Cybersecurity approach in which a series of defensive mechanisms are layered in order to protect valuable data and information
▪ Physical
▪ Logic
▪ Administrative

Question 9

Terminal Access Controller Access-
Control System Plus (TACACS+)

Answer 9

Used to perform the role of an authenticator in an 802.1x network

Question 10

Remote Authentication Dial-in User Service (RADIUS)

Answer 10

Provides centralized administration of dial-up, VPN, and wireless network
authentication

Question 11

LDAP

Answer 11

Validates a username and password combination against an LDAP server
as a form of authentication
● Port 389 LDAP
● Port 636 LDAP Secure

Question 12

Kerberos

Answer 12

▪ Focused on authentication and authorization within a Windows domain environment

▪ Provides secure authentication over an insecure network

Question 13

Local authentication

Answer 13

Process of determining whether someone or something is who or what it
● Claims itself to be
● Simplified version of X.500

Question 14

Extensible Authentication Protocol (EAP)

Answer 14

Allows for numerous different mechanisms of authentication

Question 15

Risk Management

Answer 15

The identification, evaluation, and prioritization of risks to minimize, monitor, and control the vulnerability exploited by a threat