CHAPTER 6 QUIZ INFOSEC
True or False? An authentication, authorization, and accounting (AAA) server, such as Remote Authentication Dial-In User Service (RADIUS), is a type of decentralized access control.
False
True or False? Authentication by characteristics/biometrics is based on something you have, such as a smart card, a key, a badge, or either a synchronous or asynchronous token.
False
True or False? In mandatory access control (MAC), access rules are closely managed by the security administrator and not by the system owner or ordinary users for their own files.
False
True or False? Passphrases are less secure than passwords.
False
True or False? The four central components of access control are users, resources, actions, and features.
False
True or False? The number of failed logon attempts that trigger an account action is called an audit logon event.
False
True or False? Voice pattern biometrics are accurate for authentication because voices cannot easily be replicated by computer software. You Answered True
False
Anya is a cybersecurity engineer for a high-secrecy government installation. She is configuring biometric security that will either admit or deny entry using facial recognition software. Biometric devices have error rates and certain types of accuracy errors that are more easily tolerated depending on need. In this circumstance, which error rate is she likely to allow to be relatively high?
False rejection rate (FRR)
Devaki is evaluating different biometric systems. She understands that users might not want to subject themselves to retinal scans due to privacy concerns. Which concern of a biometric system is she considering?
Acceptability
Jackson is a cybercriminal. He is attempting to keep groups of a company's high-level users from accessing their work network accounts by abusing a policy designed to protect employee accounts. Jackson attempts to log in to their work accounts repeatedly using false passwords. What security method is he taking advantage of?
Account lockout policies
Which type of authentication includes smart cards?
Ownership
Tomahawk Industries develops weapons control systems for the military. The company designed a system that requires two different officers to enter their access codes before allowing the system to engage. Which principle of security is this following?
Separation of duties
What is an example of two-factor authentication (2FA)?
Smart card and personal identification number (PIN)
Which of the following principles is not a component of the Biba integrity model?
Subjects cannot change objects that have a lower integrity level.
True or False? A degausser creates a magnetic field that erases data from magnetic storage media
True
True or False? Authentication by action is based on something you do, such as typing.
True
True or False? Authentication by knowledge is based on something the user knows, such as a password, passphrase, or personal identification number (PIN).
True
True or False? Common methods used to identify a user to a system include username, smart card, and biometrics.
True
True or False? Content-dependent access control requires the access control mechanism to look at the data to decide who should get to see it
True
True or False? If a company informs employees that email sent over the company's network is monitored, the employees can no longer claim to have an expectation of privacy.
True
True or False? Log files are one way to prove accountability on a system or network.
True
True or False? Physically disabled users might have difficulty with biometric system accessibility, specifically with performance-based biometrics.
True
True or False? Single sign-on (SSO) can provide for greater security because with only one password to remember, users are generally willing to use stronger passwords.
True
Wen is a network engineer. For several months, he has been designing a system of controls to allow and restrict access to network assets based on various methods and information. He is currently configuring the authentication method. What does this method do?
Verifies that requestors are who they claim to be
Which of the following is the point at which two error rates of a biometric system are equal and is the measure of the system's accuracy expressed as a percentage?
Crossover error rate (CER)
True or False? A smart card is an example of a logical access control.
False
Keisha is a network administrator. She wants a cloud-based service that will allow her to load operating systems on virtual machines and manage them as if they were local servers. What service is Keisha looking for?
Infrastructure as a Service (IaaS)
What is a single sign-on (SSO) approach that relies upon the use of key distribution centers (KDCs) and ticket-granting servers (TGSs)?
Kerberos
What is an example of a logical access control?
Password
An automatic teller machine (ATM) uses a form of constrained user interface to limit the user's ability to access resources in the system. Specifically for ATMs, which method is being used?
Physically constrained user interfaces
The ___________ is the central part of a computing environment's hardware, software, and firmware that enforces access control.
security kernel
Which security model does not protect the integrity of information?
Bell-LaPadula
True or False? Kerberos is an example of a biometric method.
False
A company's IT manager has advised the business's executives to use a method of decentralized access control rather than centralized to avoid creating a single point of failure. She selects a common protocol that hashes passwords with a one-time challenge number to defeat eavesdropping-based replay attacks. What is this protocol? Kerberos
Challenge-Handshake Authentication Protocol (CHAP)
True or False? A Chinese wall security policy defines a barrier and develops a set of rules to ensure that no subject gets to objects on the other side.
True
True or False? Temporal isolation is commonly used in combination with rule-based access control.
False
Which type of password attack is used on weak passwords and compares a hashed value of the passwords to the system password file to find a match?
Dictionary attack
Arturo is a network engineer. He wants to implement an access control system in which the owner of the resource decides who can change permissions, and permission levels can be granted to specific users, groups of people in the same or similar job roles, or by project. Which of the following should Arturo choose?
Discretionary access control (DAC
Maria is using accounting software to compile sensitive financial information. She receives a phone call and then momentarily leaves her desk. While she's gone, Bill walks past her cubicle and sees that she has not locked her desktop and left data exposed. Bill uses his smartphone to take several photos of this data with the intent of selling it to the company's competitor. What access control compromise is taking place?
Eavesdropping by observation
Lincoln is a network security specialist. He is updating the password policy for his company's computing infrastructure. His primary method of improving password policy involves lowering the chance that an attacker can compromise and use the password before it expires. What does he do?
Enables a 30-day password change policy
