MIS 170 Ch. 10

What would you use to control the traffic that is allowed in or out of a network? (Select the best answer.) A. Access control lists B. Firewall C. Address Resolution Protocol D. Discretionary access control

A. Access control lists can be used to control the traffic that is allowed in or out of a network. They are usually included as part of a firewall, and they are the better answer because they specifically will control the traffic.

Which of the following is the most common authentication model? A. Username and password B. Biometrics C. Key cards D. Tokens

A. By far the username and password combination is the most common authentication model.

In a discretionary access control model, who is in charge of setting permissions to a resource? A. The owner of the resource B. The administrator C. Any user of the computer D. The administrator and the owner

A. In the discretionary access control (DAC) model, the owner of the resource is in charge of setting permissions. In a mandatory access control model, the administrator is in charge.

When using the mandatory access control model, what component is needed? A. Labels B. Certificates C. Tokens D. RBAC

A. Labels are required in the mandatory access control (MAC) model.

Your organization has enacted a policy where employees are required to create passwords with at least 15 characters. What type of policy does this define? A. Password length B. Password expiration C. Minimum password age D. Password complexity

A. Password length is the policy that deals with how many characters are in a password.

In an environment where administrators, the accounting department, and the marketing department all have different levels of access, which of the following access control models is being used? A. Role-based access control (RBAC) B. Mandatory access control (MAC) C. Discretionary access control (DAC) D. Rule-based access control (RBAC)

A. Role-based access control is when different groups or roles are assigned different levels of permissions; rights and permissions are based on job function.

Which of the following access control methods uses rules to govern whether object access will be allowed? (Select the best answer.) A. Rule-based access control B. Role-based access control C. Discretionary access control D. Mandatory access control

A. Rule-based access control uses rules to govern whether an object can be accessed. It is a type of mandatory access control.

A company has a high attrition rate. What should you ask the network administrator to do first? (Select the best answer.) A. Review user permissions and access control lists. B. Review group policies. C. Review Performance logs. D. Review the Application log.

A. The first thing administrators should do when they notice that the company has a high attrition rate (high turnover of employees) is to conduct a thorough review of user permissions, rights, and access control lists.

Which of these is a security component of Windows? A. UAC B. UPS C. Gadgets D. Control Panel

A. User Account Control (UAC) adds a layer of security to Windows that protects against malware and user error and conserves resources. It enforces a type of separation of duties.

Robert needs to access a resource. In the DAC model, what is used to identify him or other users? A. Roles B. ACLs C. MAC D. Rules

B. Access control lists (ACLs) are used in the discretionary access control model. This is different from role-based, rule-based, and MAC (mandatory access control) models.

In the DAC model, how are permissions identified? A. Role membership. B. Access control lists. C. They are predefined. D. It is automatic.

B. In the discretionary access control model, permissions to files are identified by access control lists (ACLs). Role membership is used in RBAC. The mandatory access control model predefines permissions. Either way, it is not identified automatically.

A security administrator implements access controls based on the security classification of the data and need-to-know information. Which of the following would best describe this level of access control? A. Least privilege B. Mandatory access control C. Role-based access control D. Implicit deny

B. When you are dealing with access controls based on the classification of data and need-to-know information, you are most likely working with a mandatory access control (MAC) system.

Jason needs to add several users to a group. Which of the following will help him to get the job done faster? A. Propagation B. Inheritance C. Template D. Access control lists

C. By using a template, you can add many users to a group at once simply by applying the template to the users.

You want to mitigate the possibility of privilege creep among your long-term users. What procedure should you employ? A. Mandatory vacations B. Job rotation C. User permission reviews D. Separation of duties

C. Conduct user permission reviews to ensure that long-term users are getting the proper permissions to data.

What key combination helps to secure the logon process? A. Windows+R B. Ctrl+Shift+Esc C. Ctrl+Alt+Del D. Alt+F4

C. Ctrl+Alt+Del is the key combination used to help secure the logon process. It can be added by configuring the Local Security policy.

Which of the following methods could identify when an unauthorized access has occurred? A. Two-factor authentication B. Session termination C. Previous logon notification D. Session lock

C. Previous logon notification can identify whether unauthorized access has occurred.

Which of the following is the strongest password? A. |ocrian# B. Marqu1sD3S0d C. This1sV#ryS3cure D. Thisisverysecure

C. The answer This1sV#ryS3cure incorporates case-sensitive letters, numbers, and special characters and is 16 characters long.

You are consulting for a small organization that relies on employees who work from home and on the road. A hacker has compromised the network by denying remote access to the company using a script. Which of the following security controls did the hacker exploit? A. Password complexity B. DoS C. Account lockout D. Password length

C. The hacker most likely exploited the account lockout policy, a security control originally implemented by the organization.

Users are required to change their passwords every 30 days. Which policy should be configured? A. Password length B. Password recovery C. Password expiration D. Account lockout

C. The password expiration policy should be configured.

In an attempt to detect fraud and defend against it, your company cross-trains people in each department. What is this an example of? A. Separation of duties B. Chain of custody C. Job rotation D. Least privilege

C. When a company cross-trains people, it is known as job rotation.

You administer a bulletin board system for a rock and roll band. While reviewing logs for the board, you see one particular IP address posting spam multiple times per day. What is the best way to prevent this type of problem? A. Block the IP address of the user. B. Ban the user. C. Disable ActiveX. D. Implement CAPTCHA.

D. By implementing CAPTCHA, another level of security is added that users have to complete before they can register to and/or post to a bulletin board.

Which security measure should be included when implementing access control? A. Disabling SSID broadcast B. Time-of-day restrictions C. Changing default passwords D. Password complexity requirements

D. By implementing password complexity requirements, users will be forced to select and enter complex passwords—for example, eight characters or more, uppercase characters, special characters, and more.

Which of the following access control models would be found in a firewall? A. Mandatory access control B. Discretionary access control C. Role-based access control D. Rule-based access control

D. Firewalls are most often considered to be based off of the rule-based access control model. This is because you indeed create rules (ACLs) that govern how data is transmitted through the firewall.

Which password management system best provides for a system with a large number of users? A. Locally saved passwords management system B. Synchronized passwords management system C. Multiple access methods management system D. Self-service password reset management system

D. If a network has a large number of users, the administrator should set up a system, and policies to enforce the system, that will allow for users to reset their own passwords.

What is a definition of implicit deny? A. Everything is denied by default. B. All traffic from one network to another is denied. C. ACLs are used to secure the firewall. D. Resources that are not given access are denied by default.

D. If a resource is not given specific access, it will be implicitly denied by default.

Which of the following statements regarding the MAC model is true? A. Mandatory access control is a dynamic model. B. Mandatory access control enables an owner to establish access privileges to a resource. C. Mandatory access control is not restrictive. D. Mandatory access control users cannot share resources dynamically.

D. In the MAC (mandatory access control) model, users cannot share resources dynamically. MAC is not a dynamic model; it is a static model. Owners cannot establish access privileges to a resource; this would be done by the administrator. MAC is indeed very restrictive, as restrictive as the administrator wants it to be.

Your company has 1000 users. Which of the following password management systems will work best for your company? A. Multiple access methods B. Synchronize passwords C. Historical passwords D. Self-service password resetting

D. It would be difficult for administrators to deal with thousands of users' passwords; therefore, the best management system for a company with 1,000 users would be self-service password resetting.

Of the following access control models, which uses object labels? (Select the best answer.) A. Discretionary access control B. Role-based access control C. Rule-based access control D. Mandatory access control

D. The mandatory access control (MAC) model uses object and subject labels. DAC and RBAC (role-based access control) do not.

How are permissions defined in the mandatory access control model? A. Access control lists B. User roles C. Defined by the user D. Predefined access privileges

D. The mandatory access control model uses predefined access privileges to define which users have permission to resources.

Which of the following would lower the level of password security? A. After a set number of failed attempts, the server will lock the user out, forcing her to call the administrator to re-enable her account. B. Passwords must be greater than eight characters and contain at least one special character. C. All passwords are set to expire after 30 days. D. Complex passwords that users cannot change are randomly generated by the administrator.

D. To have a secure password scheme, passwords should be changed by the user. They should not be generated by the administrator. If an administrator were to generate the password for the user, it would have to be submitted in written (and unencrypted) form in some way to the user. This creates a security issue, especially if the user does not memorize the password and instead leaves a written version of it lying around. All the other answers would increase the level of password security.