Question 1

Which access control model can dynamically assign roles to subjects based on a set of defined rules?
A)Role Based Access Control
B)Mandatory Access Control
C)Rule Based Access Control
D)Discretionary Access Control

Accepted Answer

Rule Based Access Control (RBAC) can dynamically assign roles to subjects based on a set of defined rules, which allows for more flexibility in managing access control. RBAC provides access based on the subject's attributes, such as job title, time of day, or location, and the rules that have been defined for these attributes. This allows for easier management of access control and reduces the risk of errors or oversights in granting access.

Question 2

Although designed to support remote dial-in access to a corporate network, what service below is commonly used with 802.1x port security for both wired and wireless LANs?
A)RADIUS
B)ICMP
C)FTP
D)Telnet

Accepted Answer

RADIUS is commonly used with 802.1x port security for both wired and wireless LANs. Although it was originally designed to support remote dial-in access to a corporate network, it has since become widely used for authentication, authorization, and accounting (AAA) services in various network environments. ICMP, FTP, and Telnet are not commonly used with 802.1x port security.

Question 3

What authentication service commonly used on UNIX devices involves communicating user authentication information to a centralized server?
A)TACACS
B)RADIUS
C)Kerberos
D)FTP

Accepted Answer

A

Question 4

What kind of attack allows for the construction of LDAP statements based on user input statements, which can then be used to access the LDAP database or modify the database's information?
A)LDAP poisoning
B)Kerberos injection
C)LDAP injection
D)DAP hijacking

Accepted Answer

LDAP injection allows an attacker to construct LDAP statements based on user input statements, which can then be used to access or modify the LDAP database's information.

Question 5

A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as:
A)Separation of duties
B)Job rotation
C)Mandatory vacation
D)Role reversal

Accepted Answer

Separation of duties is the process of dividing a critical function between two or more individuals to prevent fraudulent activities. It helps reduce the risk of errors, fraud, and other security breaches by ensuring that one individual cannot complete a task without the assistance or knowledge of another. Job rotation involves periodically rotating an employee in different roles to prevent collusion and fraud. Mandatory vacation is another technique used to prevent fraud by requiring employees to take time off work regularly. Role reversal involves reversing the role of two individuals in a process to identify potential vulnerabilities and weaknesses. However, it is not a practical method, and it can also disrupt the normal flow of business operations.

Question 6

Entries within a Directory Information Base are arranged in a tree structure called the:
A)DAP
B)PEAP
C)EAP
D)DIT

Accepted Answer

The Directory Information Base (DIB) is arranged in a tree structure called the Directory Information Tree (DIT). Each entry in the DIT is called an object and has a unique name known as a Distinguished Name (DN). The DAP (Directory Access Protocol), PEAP (Protected Extensible Authentication Protocol), and EAP (Extensible Authentication Protocol) are all related to directory services and authentication but are not directly related to the tree structure of the DIB.

Question 7

What is the name for a predefined framework that can be used for controlling access, and is embedded into software and hardware?
A)accounting and access model
B)user control model
C)access control model
D)authorization control model

Accepted Answer

The term commonly used for a predefined framework that can be used for controlling access and is embedded into software and hardware is "access control model." Accounting and user control models are related concepts but do not fully capture the idea of a framework embedded into software and hardware. "Authorization control model" is not a commonly used term and could be confused with "access control model."

Question 8

Group policy is a Unix feature that allows for the centralized management and configuration of computers and remote users using Unix Active Directory.

Accepted Answer

Group policy is a Windows feature and is not available on Unix systems. Unix has similar features like LDAP and NIS for centralized management and configuration.

Question 9

Which access control model is considered to be the least restrictive?
A)Role Based Access Control
B)Mandatory Access Control
C)Rule Based Access Control
D)Discretionary Access Control

Accepted Answer

Discretionary Access Control (DAC) is considered to be the least restrictive access control model because it allows owners of the resources to decide who can access them. The owners of the resources have complete control over the who, what, when, and how of the resource access. This meant that owners of the resource can grant or revoke permissions at will, without having to go through a lengthy approval process.

Question 10

In a UAC prompt, what color is used to indicate the lowest level of risk?
A)red
B)gray
C)yellow
D)green

Accepted Answer

The answer of In a UAC prompt, what color is...

Question 11

User accounts that remain active after an employee has left an organization are referred to as being what type of accounts?
A)Active
B)Stale
C)Orphaned
D)Fragmented

Accepted Answer

Orphaned accounts are those user accounts that remain active even after an employee has left an organization. These accounts pose a security risk and can be misused by unauthorized users. It is important to regularly audit and disable such accounts to ensure the security of the organization's data and assets. Stale accounts typically refer to accounts that haven't been used in a while, while fragmented accounts are not a commonly used term in this context.

Question 12

Authorization and access are viewed as synonymous and in access control, they are the same step.

Accepted Answer

Authorization and access are two separate steps in access control. Authorization involves determining if a user has permission to access a resource or perform an action, while access is the actual act of being able to access the resource or perform the action granted by authorization.

Question 13

A shield icon warns users if they attempt to access any feature that requires UAC permission.

Accepted Answer

This is true. The shield icon appears when the user attempts to access a feature that requires admin privileges, and clicking on it will prompt the user to confirm the action and elevate their permissions through User Account Control (UAC).

Question 14

The Bell-LaPadula (BLP) model of MAC can be used to prevent subjects from creating a new object or performing specific functions on objects that are at a lower level than their own.​

Accepted Answer

The Bell-LaPadula model is a confidentiality model that enforces the Principle of Information Flow Control, where information flows from higher-level security levels to lower-level security levels, but not vice versa. It provides a set of rules that govern how subjects can access objects based on their security level, ensuring that sensitive information is not disclosed to unauthorized entities. The model can be used to prevent subjects from creating a new object or performing specific functions on objects that are at a lower level than their own.

Question 15

What access control model below is considered to be the most restrictive access control model, and involves assigning access controls to users strictly according to the custodian?
A)Mandatory Access Control
B)Role Based Access Control
C)Discretionary Access Control
D)Rule Based Access Control

Accepted Answer

Mandatory Access Control (MAC) is considered the most restrictive access control model. In the MAC model, access controls are assigned to users based on the custodian's security classification level. This classification level determines what data a user can access, and users cannot modify the access controls. MAC is commonly used in government and military environments to protect highly sensitive information.

Question 16

The strength of RADIUS is that messages are always directly sent between the wireless device and the RADIUS server.

Accepted Answer

RADIUS messages are typically sent through an intermediary, such as a Network Access Server (NAS), which acts as a client to the RADIUS server.

Question 17

When using Role Based Access Control (RBAC), permissions are assigned to:
A)Roles
B)Groups
C)Labels
D)Users

Accepted Answer

RBAC assigns permissions to roles, which are then assigned to users. This allows for easier management of permissions as users can be added or removed from roles as needed, without needing to change each individual user's permissions.

Question 18

Select below the access control model that uses access based on a user's job function within an organization:
A)Role Based Access Control
B)Rule Based Access Control
C)Discretionary Access Control
D)Mandatory Access Control

Accepted Answer

Role Based Access Control (RBAC) assigns permissions to users based on their job functions within an organization. This access control model helps to manage security policies efficiently by grouping users with similar tasks and assigning them a specific role with access permissions. RBAC provides a higher level of security and reduces the risk of unauthorized access. Therefore, A is the best choice.

Question 19

A user or a process functioning on behalf of the user that attempts to access an object is known as the:
A)subject
B)reference monitor
C)entity
D)label

Accepted Answer

A subject is an active entity (either a user or a process acting on behalf of a user) that requests access to a resource, such as an object or system. The reference monitor is a component of the operating system that enforces access controls, and a label is a security attribute assigned to an object. While both of these terms are related to access control, they do not refer specifically to the user or process attempting to access the object. Entity is a general term that can refer to any object or thing.

Question 20

The X.500 standard defines a protocol for a client application to access an X.500 directory known as which of the following options?
A)DIB
B)DAP
C)DIT
D)LDAP

Accepted Answer

The X.500 protocol for a client application to access an X.500 directory is defined by the DAP (Directory Access Protocol). The DIB (Directory Information Base) is the actual database structure of the X.500 directory, while the DIT (Directory Information Tree) is the hierarchical structure of objects in the directory. LDAP (Lightweight Directory Access Protocol) is a simplified version of DAP that is commonly used in modern directory services such as Active Directory. However, the question specifically asks for the protocol defined in the X.500 standard, which is DAP.

Quiz 11: Access Control Fundamentals

Which access control model can dynamically assign roles to subjects based on a set of defined rules?

Although designed to support remote dial-in access to a corporate network, what service below is commonly used with 802.1x port security for both wired and wireless LANs?

What authentication service commonly used on UNIX devices involves communicating user authentication information to a centralized server?

What kind of attack allows for the construction of LDAP statements based on user input statements, which can then be used to access the LDAP database or modify the database's information?

A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as:

Entries within a Directory Information Base are arranged in a tree structure called the:

What is the name for a predefined framework that can be used for controlling access, and is embedded into software and hardware?

Group policy is a Unix feature that allows for the centralized management and configuration of computers and remote users using Unix Active Directory.

Which access control model is considered to be the least restrictive?

In a UAC prompt, what color is used to indicate the lowest level of risk?

User accounts that remain active after an employee has left an organization are referred to as being what type of accounts?

Authorization and access are viewed as synonymous and in access control, they are the same step.

A shield icon warns users if they attempt to access any feature that requires UAC permission.

The Bell-LaPadula (BLP) model of MAC can be used to prevent subjects from creating a new object or performing specific functions on objects that are at a lower level than their own.

What access control model below is considered to be the most restrictive access control model, and involves assigning access controls to users strictly according to the custodian?

The strength of RADIUS is that messages are always directly sent between the wireless device and the RADIUS server.

When using Role Based Access Control (RBAC) , permissions are assigned to:

Select below the access control model that uses access based on a user's job function within an organization:

A user or a process functioning on behalf of the user that attempts to access an object is known as the:

The X.500 standard defines a protocol for a client application to access an X.500 directory known as which of the following options?

Quiz 11: Access Control Fundamentals

Which access control model can dynamically assign roles to subjects based on a set of defined rules?

Although designed to support remote dial-in access to a corporate network, what service below is commonly used with 802.1x port security for both wired and wireless LANs?

What authentication service commonly used on UNIX devices involves communicating user authentication information to a centralized server?

What kind of attack allows for the construction of LDAP statements based on user input statements, which can then be used to access the LDAP database or modify the database's information?

A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as:

Entries within a Directory Information Base are arranged in a tree structure called the:

What is the name for a predefined framework that can be used for controlling access, and is embedded into software and hardware?

Group policy is a Unix feature that allows for the centralized management and configuration of computers and remote users using Unix Active Directory.

Which access control model is considered to be the least restrictive?

In a UAC prompt, what color is used to indicate the lowest level of risk?

User accounts that remain active after an employee has left an organization are referred to as being what type of accounts?

Authorization and access are viewed as synonymous and in access control, they are the same step.

A shield icon warns users if they attempt to access any feature that requires UAC permission.

The Bell-LaPadula (BLP) model of MAC can be used to prevent subjects from creating a new object or performing specific functions on objects that are at a lower level than their own.​

What access control model below is considered to be the most restrictive access control model, and involves assigning access controls to users strictly according to the custodian?

The strength of RADIUS is that messages are always directly sent between the wireless device and the RADIUS server.

When using Role Based Access Control (RBAC) , permissions are assigned to:

Select below the access control model that uses access based on a user's job function within an organization:

A user or a process functioning on behalf of the user that attempts to access an object is known as the:

The X.500 standard defines a protocol for a client application to access an X.500 directory known as which of the following options?

The Bell-LaPadula (BLP) model of MAC can be used to prevent subjects from creating a new object or performing specific functions on objects that are at a lower level than their own.