Question 1

Which of the following controls can be implemented so an organization can configure multiple computers by setting a single policy for enforcement?

Accepted Answer

Group-based access control allows an organization to configure multiple computers by setting a single policy for enforcement, as it applies policies to groups of users or devices.

Question 2

Which of the following is a simpler subset of Directory Access Protocol?

Accepted Answer

X.500 Lite is a simpler subset of Directory Access Protocol, designed for small-scale applications and simpler networks. SDAP (Simple Data Access Protocol) is not a subset of Directory Access Protocol, but a protocol for accessing relational databases. DIB (Directory Information Base) is not a protocol, but a database structure used in X.500 directory services. ADS (Active Directory Service) is a Microsoft implementation of a directory service, not a subset of Directory Access Protocol.

Question 3

Although designed to support remote dial-in access to a corporate network,what service below is commonly used with 802.1x port security for both wired and wireless LANs?

Accepted Answer

RADIUS (Remote Authentication Dial-In User Service) is commonly used with 802.1x port security for both wired and wireless LANs. RADIUS provides centralized authentication and authorization for network access, making it an ideal choice for managing and securing remote access connections. ICMP (Internet Control Message Protocol) is used for network troubleshooting and diagnostic purposes, FTP (File Transfer Protocol) is used for transferring files between computers, and Telnet is used for remote command-line access to network devices. None of these services are typically used for 802.1x port security.

Question 4

What standard provides a greater degree of security by implementing port-based authentication and blocks all traffic on a port-by-port basis until the client is authenticated using credentials stored on an authentication server?

Accepted Answer

IEEE 802.1x is a standard that provides port-based authentication, which blocks all traffic on a port-by-port basis until the client is authenticated using credentials stored on an authentication server. This standard provides a greater degree of security compared to other options listed. LDAPS and TACACS are authentication protocols, but do not implement port-based authentication. IEEE 802.1a is a wireless networking standard and is not related to authentication or security.

Question 5

User accounts that remain active after an employee has left an organization are referred to as being what type of accounts?

Accepted Answer

Orphaned accounts are those that belong to former employees and are not disabled or removed after they leave the organization, hence becoming a risk for potential security breaches. Abandoned accounts refer to those that have not been used in a long time, stale accounts refer to those that have not been updated by the user, and inactive accounts refer to those that have not been used for a specific period of time.

Question 6

When LDAP traffic is made secure by using Secure Sockets Layer (SSL)or Transport Layer Security (TLS),what is this process called?

Accepted Answer

The process of securing LDAP traffic using SSL or TLS is called LDAPS. This ensures that the communication between the LDAP client and server is encrypted and protected from eavesdropping or tampering. SAML is a different protocol used for exchanging authentication and authorization data. TACACS is a protocol used for AAA (authentication, authorization, and accounting) services in network devices. SDML is not a known protocol in the context of network security.

Question 7

Select the authentication system developed by the Massachusetts Institute of Technology (MIT)to verify the identity of network users.

Accepted Answer

The authentication system developed by MIT to verify the identity of network users is called Kerberos.

Question 8

What type of computer can forward RADIUS messages between RADIUS clients and RADIUS servers?

Accepted Answer

A RADIUS proxy is specifically designed to forward RADIUS messages between RADIUS clients and RADIUS servers. Intermediate, remote or translation proxies may be able to perform this function but are not designed specifically for RADIUS protocol.

Question 9

The X.500 standard defines a protocol for a client application to access an X.500 directory known as which of the following options?

Accepted Answer

The X.500 standard defines the Directory Access Protocol (DAP) for a client application to access an X.500 directory. The Directory Information Base (DIB) is the structure and content of the directory itself, and the Directory Information Tree (DIT) is the hierarchical structure of the directory. LDAP, or Lightweight Directory Access Protocol, is a simpler and more widely used protocol that is based on DAP but has fewer features. Therefore, the best choice is B for the given question.

Question 10

Which of the following is a database stored on the network itself that contains information about users and network devices?

Accepted Answer

A directory service is a database stored on the network itself that contains information about users and network devices. It allows users to access network resources and allows network administrators to manage network resources centrally. User permissions and system registry are also important components of network management but they are not specifically associated with maintaining information about users and devices in a database on the network. Network service refers to the different types of services that are provided by a network, such as email or file sharing, and is not synonymous with a directory service.

Question 11

What is an entry in an ACL known as?

Accepted Answer

An entry in an Access Control List (ACL) is known as an Access Control Entry (ACE). A DACL (Discretionary Access Control List) is a list of ACEs that specifies the permissions for a securable object. SQL (Structured Query Language) is a programming language used to manage relational databases. A flag is a variable used to indicate a particular condition or status.

Question 12

Select the XML standard that allows secure web domains to exchange user authentication and authorization data and is used extensively for online e-commerce transactions.

Accepted Answer

SAML (Security Assertion Markup Language) is the XML standard that allows secure web domains to exchange user authentication and authorization data. It is used extensively for online e-commerce transactions to provide a secure single sign-on (SSO) mechanism. LDAPS (Lightweight Directory Access Protocol Secure) provides secure authentication and encrypted communication between LDAP (Lightweight Directory Access Protocol) clients and servers. TACACS (Terminal Access Controller Access-Control System) is a protocol that provides centralized authentication, authorization, and accounting management for network access. SDML is not a recognized XML standard.

Question 13

What framework is used for transporting authentication protocols instead of the authentication protocol itself?

Accepted Answer

EAP (Extensible Authentication Protocol) is designed as a framework to transport authentication protocols, allowing for the use of various authentication mechanisms without being tied to any specific authentication scheme.

Question 14

What policy is designed to ensure that all confidential or sensitive materials,either in paper form or electronic,are removed from a user's workspace and secured when the items not in use or when employees leave their workspace?

Accepted Answer

The policy described is commonly referred to as a "clean desk" policy. This policy is designed to reduce the risk of sensitive information being accessed or stolen in the event that an employee's workspace is left unattended or when they leave the company. The policy requires employees to ensure that all confidential or sensitive materials are removed from their workspace and secured when not in use or when they leave their workspace.

Question 15

During RADIUS authentication,what type of packet includes information such as identification of a specific AP that is sending the packet and the username and password?

Accepted Answer

The authentication request packet includes information such as identification of a specific AP that is sending the packet and the username and password.

Question 16

Which major types of access involving system resources are controlled by ACLs? (Choose all that apply. )

Accepted Answer

ACLs (Access Control Lists) are typically used to control access to system resources such as files, folders, and network shares. Therefore, system, user, and application access can all be controlled by ACLs. Remote access is usually controlled by other means such as firewalls, VPNs, or remote access policies.

Question 17

What authentication service commonly used on UNIX devices involves communicating user authentication information to a centralized server?

Accepted Answer

The answer of What authentication service commonly used on UNIX...

Question 18

What kind of attack allows for the construction of LDAP statements based on user input statements,which can then be used to access the LDAP database or modify the database's information?

Accepted Answer

LDAP injection is a type of attack in which an attacker constructs LDAP statements based on user input statements, which can then be used to access or modify the information in the LDAP database. This can lead to unauthorized access or modification of sensitive information. The other options (LDAP poisoning, Kerberos injection, and DAP hijacking) are not relevant to this type of attack.

Question 19

What process periodically validates a user's account,access control,and membership role or inclusion in a specific group?

Accepted Answer

Recertification is the process of periodically validating a user's account, access control, and membership role or inclusion in a specific group. This helps ensure that only authorized personnel have access to sensitive information or resources. Recertification is an important security control that helps organizations maintain a strong security posture. It involves the periodic review of user accounts to ensure that they are still necessary and appropriate, and checking that users still require the access rights and privileges that have been allocated to them.

Question 20

To assist with controlling orphaned and dormant accounts,what can be used to indicate when an account is no longer active?

Accepted Answer

Account expiration is the best way to indicate when an account is no longer active. This is because it completely deactivates the account and prevents any future login attempts, ensuring that no unauthorized activity can occur. Password expiration, last login, and account last used can still leave the account active and open to potential misuse.

Quiz 12: Access Management