Chapter 2 Practice Questions
Lisa is a training instructor and she maintains a training lab with 18 computers. She has enough rights and permissions on these machines so that she can configure them as needed for classes. However, she does not have he rights to add them to the organization's domain. Which of the following choices BEST describes this example? a. Least Privilege b. Need to know c. group-based privileges d. location-based policies
A. Least privilege When following the principle of lease privilege, individuals have only enough rights and permissions to perform their job, and this is exactly what is described in this scenario. Need to know typically refers to data and information rather than the privileges required to perform and action, such as adding computers to a domain. Group-based privileges refer to giving permissions to groups, and then adding the users to the groups to give them appropriate privileges. A location-based policy allows or blocks access based on location, but the scenario doesn't indicate that location is being checked.
Your organization recently updated an online application employees use to log on when working from home. Employees enter their username and password into the application from their smartphone and the application logs their location using GPS. Which type of authentication is being used? A. One-factor B. Dual-Factor C. something you are D. somewhere you are
A. One-factor This is using one-factor authentication - something you know. The application uses the username for identification and the password for authentication. Note that even though the application is logging the location using Global positioning system (GPS), there isn't any indication that it is using this information for authentication. Dual-factor authentication requires another factor of authentication. If the application verified you were logging on from a specific GPS location as part of the authentication, it would be dual-factor authentication (Something you know and somewhere you are). Something you are refers to biometric authentication methods. The somewhere you are authentication methods verifies you are somewhere, such as in a specific GPS location, but this isn't being used for authentication in this scenario.
A security administrator needs to implement an access control system that will protect data based on the following matrix. Document Type: Security Level Security Label Employment Documents Private Employee Salary and Compensation documents Private Payroll Internal Phone listing documents Private Employee Which of the following models is the administrator implementing A.DAC B. MAC C. Role-BAC D. ABAC
B. MAC This is mandatory access control (MAC) model. You can tell because it us using security labels. None of the other models listed use labels. A discretionary access control (DAC) model has an owner, and the owner establishes access for the objects. A role-based access control (Role-BAC) model uses roles or groups to assign rights and permissions. An attribute-based access control (ABAC) model uses attributes assigned to subjects and objects within a policy to grant access.
Your organization is planning to implement remote access capabilities. Management wants strong authentication and wants to ensure that passwords expire after a predefined time interval. Which of he following choices BEST meets this requirement? A. HOTP B. TOTP C. CAC D. Kerberos
B. TOTP A Time-based One-Time Password (TOTP) meets this requirement. Passwords created with TOTP expire after 30 seconds. An HMAC-based One-Time Password (HOTP) creates passwords that do not expire. A Common Access Card (CAC) is a type of smart card, but it does not create passwords. Kerberos uses tickets instead of passwords.
You need to create an account for a contractor who will be working at your company for 60 days. Which of the following is the BEST security step to take when creating this account? a. Configure history on the account b. Configure a password expiration date on the account c. Configure the expiration date on the account d. configure complexity
C. Configure an expiration date on the account When creating temporary accounts, it's best to configure expiration dates so that the system will automatically disable the accounts on the specified date. History, password expiration, and complexity all refer to password policy settings. However, it's rare to configure a specific password policy on a single account
A company recently hired you as a security administrator. You notice that some former accounts used by temporary employees are currently enabled. Which of the following choices is the BEST response? a. Disable all temporary accounts b. disable the temporary accounts you've noticed are enabled c. Craft a script to identify inactive accoutns based on the last time they logged on d. Set account expiration dates for all accounts when creating them
C. Craft a script to identify inactive accounts based on the last time they logged on. running a last logon script allows you to identify inactive accounts, such as accounts that haven't been logged on to in the last 30 days. It's appropriate to disable unused accounts, but it isn't necessarily appropriate to disable all temporary, because some might still be in use. If you disable the accounts you notice, you might disable accounts that some employees are still using, and you might miss some accounts that should be disabled. Setting expiration dates for newly created accounts is a good step, but it doesn't address previously created accounts.
Members of a project team chose to meet at a local library to complete some work on a key project. All of them are authorized to work from home using a VPN connection and have connected from home successfully. However, they found that they were unable to connect to the network using the VPN from the library and they could not access any of the project data. Which of the following choices is the most likely reason why they can't access this data? a. Role-based access control b. Time-of-day access control c. Location-based policy d. Discretionary access control
C. Location-based policy A location-based policy restricts access based on location, such as with an IP address, and this is the best possible answer of those given. The scenario indicates they could use the virtual private network (VPN) connection from home, but it was blocked when they tried to access it from the library. A time-of-day access control restricts access based on the time of day, but the scenario doesn't indicate the time. Neither a discretionary access control model nor a role-based access control model restricts access based on location.
Developers are planning to develop an application using role-based access control. Which of the following would they MOST likely include in their planning? A. A listing of labels reflecting classification levels B. A requirements list identifying need to know C. A listing of owners D. A matrix of functions matched with their required privileges
D. A matrix of functions matched with their required privileges A matrix of functions, roles, or job titles matched with the required access privileges for each of the functions, roles, or job titles is a common planning document for a role based access control (role-BAC) model. The mandatory access control (MAC) model uses sensitivity labels and classification levels. MAC is effective at restricting access based on a need to know. The discretionary access control (DAC) model specifies that every object has an owner and it might identify owners in a list
Your organization is implementing an SDN. Management wants to use an access control model that controls access based on attributes. Which of the following is the BEST solution? A. DAC B. MAC C. Role-BAC D. ABAC
D. ABAC A software defined network (SDN) typically uses an attribute-based access control (ABAC) model, which is based on attributes that identify subjects and objects within a policy. A discretionary access control (DAC) model has an owner, and the owner establishes access for the objects. A mandatory access control (MAC) model uses labels assigned to subjects and objects. A role-based access control (role-BAC) model uses roles or groups to assign rights and permissions.
A recent security audit discovered several apparently dormant user accounts. Although users could log on to the accounts, no one had logged on to them for more than 60 days. You later discovered that these accounts are for contractors who work approximately one week every quarter. Which of the following is the BEST response to this situation A. Remove the account expiration from the accounts B. delete the accounts C. Reset the accounts D. disable the accounts
D. Disable the accounts The best response is to disable the accounts and then enable them when needed by the contractors. Ideally, the accounts would include an expiration date so that they would automatically expire when no longer needed, but the scenario doesn't indicate the accoutns have an expiration date. Because the contractors need to access the accounts periodically, it's better to disable them rather than delete them. Reset the accounts implies you are changing the password, but this isn't needed
A network includes a ticket-granting ticket server used for authentication. Which authentication service does this network use? a. Shibboleth b. SAML c. LDAP d. Kerberos
D. Kerberos Kerberos uses a ticket-granting ticket (TGT) server, which create tickets for authentication. Shibboleth is a federated identity solution used in some single sign-on (SSO) solutions. Security Assertion Markup Language (SAML) is an Extensible Markup Language (XML) used for some SSO solutions. Lightweight Directory Access Protocol (LDAP) is an X.500-based authentication service used to identify objects.
Marge is reviewing an organization's account management processes. She wants to ensure that security log entries accurately report the identity of personnel taking specific actions. Which of the following steps would BEST meet this requirement? A. Update ACLs for all files and folders B. Implement role-based privileges C. Use an SSO solutions D. Remove all shared accounts
D. Remove all shared accounts Removing all shared accounts is the best answer of the available choices. If two employees are using the same account, and one employee maliciously deletes data in a database, it isn't possible to identify which employee deleted the data. File and folder access control lists (ACLs) identify permissions for users, but don't control the user identity. Role-based (or group-based) privileges assign the same permissions to all members of a group, which simplifies administration. A single sign-on (SSO) solution allows a user to log on once and access multiple resources.
Ned is reviewing password security for employees of the Leftorium. The password policy has the following settings: -The password maximum age is 30 days -The password minimum length is 14 characters. -The passwords cannot be reused until five other passwords have been used -Password must include at least one of each of the following four character types: Uppercase letters, lowercase letters, numbers, and special characters. Ned discovers that despite having this password policy in place, users are still using the same password that they were using more than a month ago. Which of the following actions will resolve the issue a. create a rule in the password policy for the password minimum age to be 7 days. b. change the password history to 10 c. require the use of complex passwords d. Change the maximum age setting to 60 days
a. create a rule in the password policy for the password minimum age to be 7 days. The best solution is to create a rule in the password policy for the password minimum age. Currently, users can change their passwords five more times in just a couple of minutes, changing it back to their original password on the sixth change. None of the other settings prevent the user from doing this. A password history of 10 forces the users to take a couple more minutes to get back to the original password. The password policy currently requires complex passwords. A maximum age of 60 days increases how long a user can keep the same password.
Your organization has decided to implement a biometric solution for authentication. One of the goals is to ensure that the biometric system is highly accurate. Which of the following provides the BEST indication of accuracy with the biometric system? a. The lowest possible FRR b. The highest possible FAR c. The lowest possible CER d. The highest possible CER
c. The lowest possible CER A lower crossover error rate (CER) indicates a more accurate biometric system. The false acceptance rate (FAR) and the false rejection rate (FRR) vary based on the sensitivity of the biometric system and don't indicate accuracy by themselves. A higher CER indicates a less accurate biometric system.
Developers in your organization have created an application designed for the sales team. Salespeople can log on to the application using a simple password of 1234. However, this password does not meet the organization's password policy. What is the BEST response by the security administrator after learning about this? a. Nothing. Strong passwords aren't required in applications b. Modify the security policy to accept this password c. Document this as an exception in the application's documentation d. Direct the application team manager to ensure the application adheres to the organization's password policy
d. Direct the application team manager to ensure the application adheres to the organization's password policy The application should be recoded to adhere to the company's password policy, so the best response is to direct the application team manager to do so. Application passwords should be strong and should adhere to an organization's security policy. It is not appropriate to weaken a security policy to match a weakness in an application. Nor is it appropriate to simply document that the application uses a weak password
