Chapter 4 Identity and Access Management - Practice Questions
Which of the following chage option keeps a user from changing their password every two weeks?
-m 33
Which of the following BEST describes the domain controller component of Active Directory?
A domain controller is a server that holds a copy of the Active Directory database that can be written to and is responsible for copying changes to Active Directory between the domain controllers.
Which of the following terms describes the component that is generated following authentication and is used to gain access to resources following login?
Access token
You are configuring the Local Security Policy of a Windows system. You want to require users to create passwords that are at least ten characters in length. You also want to prevent login after three unsuccessful login attempts. Which policies should you configure? (Select two.)
Account lockout threshold Minimum password length
What is the name of the service included with the Windows Server operating system that manages a centralized database containing user account and security information?
Active Directory
Which access control model is based on assigning attributes to objects and using Boolean logic to grant access based on the attributes of the subject?
Attribute-based access control (ABAC)
What is the process of controlling access to resources such as computers, files, or printers called?
Authorization
You are a cybersecurity expert implementing a zero trust model in a large organization. You are tasked with designing the control and data planes. Which of the following strategies should you prioritize and why?
Balance your focus between the control and data planes, ensuring both are optimized for security and efficiency.
John, a security analyst, is using a smart card to gain access to a secure server room. He simply waves his card near the card reader and the door unlocks. Later, he uses the same card to log into his computer by inserting it into a card reader. Based on this information, is John using a contact or contactless smart card?
Both a contact and contactless smart card, because he used the card both by inserting it into a reader and by waving it near a reader.
You have hired ten new temporary employees to be with the company for three months. How can you make sure that these users can only log on during regular business hours?
Configure day/time restrictions in user accounts.
You want to ensure that all users in the Development OU have a common set of network communication security settings applied. Which action should you take?
Create a GPO computer policy for the computers in the Development OU.
You manage an Active Directory domain. All users in the domain have a standard set of internet options configured by a GPO linked to the domain, but you want users in the Administrators OU to have a different set of internet options. What should you do?
Create a GPO user policy for the Administrators OU.
You have a system that allows the owner of a file to identify users and their permissions to the file. Which type of access control model is implemented?
Discretionary access control (DAC)
A large multinational corporation has multiple domains that share the same contiguous DNS namespaces, as well as domains with different DNS namespaces. The IT department is tasked with organizing these domains. Which of the following options best describes how the domains should be grouped?
Domains with the same contiguous DNS namespaces should be grouped into a tree, and all trees should be grouped into a forest.
You want to implement an access control list in which only the users you specifically authorize have access to the resource. Anyone not on the list should be prevented from having access. Which of the following methods of access control should the access list use?
Explicit allow, implicit deny
Your financial planning company is forming a partnership with a real estate property management company. One of the requirements is that your company open up its directory services to the property management company to create and access user accounts. Which of the following authentication methods will you be implementing?
Federation
You are a security consultant tasked with implementing a biometric authentication system for a small business. The business owner wants a system that is cost-effective, non-intrusive, and relatively simple for employees to use. Which biometric authentication method would you recommend?
Fingerprint recognition
After implementing the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the chief information security officer (CISO) is assessing the company's security posture to identify deficiencies from the framework's recommendations. What process can the CISO run to get a better sense of what the company needs to improve upon?
Gap analysis
Which of the following statements correctly describe the characteristics of generic containers in Active Directory? (Select two.)
Generic containers are created by default. Generic containers are used to organize Active Directory objects.
Which of the following objects identifies a set of users with similar access needs?
Group
Marcus White has just been promoted to a manager. To give him access to the files that he needs, you make his user account a member of the Managers group, which has access to a special shared folder. Later that afternoon, Marcus tells you that he is still unable to access the files reserved for the Managers group. What should you do?
Have Marcus log off and log back in.
You are the IT security manager for a rapidly growing tech company. The company has been using simple password authentication for all systems. However, with the increasing number of employees and the sensitivity of the data being handled, you decide it's time to harden the authentication methods. Which of the following steps would be the MOST effective in achieving this goal?
Implementing multifactor authentication (MFA) for all systems.
Which of the following is the correct acronym to remember the order in which Group Policy Objects (GPOs) are applied?
LSDOU
You are a network administrator for a large multinational corporation. The corporation has offices in multiple countries and uses various software products from different vendors. The CEO wants to implement a system that stores information about users, computers, security groups/roles, and services, and allows for interoperability between different vendors' products. Which directory service would you recommend?
Lightweight Directory Access Protocol (LDAP)
Group Policy Objects (GPOs) are applied in which of the following orders?
Local Group Policy, GPO linked to site, GPO linked to domain, GPO linked to organizational unit (highest to lowest).
You are configuring the Local Security Policy of a Windows system. You want to prevent users from reusing old passwords. You also want to force them to use a new password for at least five days before changing it again. Which policies should you configure? (Select two.)
Minimum password age Enforce password history
Which of the following principles is implemented in a mandatory access control model to determine object access by classification level?
Need to know
Which of the following is the MOST common form of authentication?
Password
The IT department at a small company is revamping its password policies to bolster security. The company wants to ensure employees follow best practices for creating and managing passwords. The department aims to promote a secure environment by implementing password expiration policies. Which method for password management is BEST to promote a secure environment by requiring users to change their passwords after a certain period?
Password expiration
A leading online retail company wants to improve user experience and security for its customers. The security team aims to eliminate the need for users to remember or input complex passwords, reducing the risk of password breaches. Instead, they propose a solution where users can access their accounts seamlessly through a secure link sent to their verified email or via a push notification on a trusted device. This approach should not involve traditional passwords, fingerprint scans, or multiple validation steps. Which authentication method is the security team planning to implement for users?
Passwordless authentication
Which of the following identifies the type of access that is allowed or denied for an object?
Permissions
A corporation's IT department is integrating a new framework that permits, ascertains, and applies various resources in accordance with established company policies. Which principle should the department incorporate?
Policy-driven access control
What is the primary purpose of separation of duties?
Prevent conflicts of interest.
Which technology is primarily used by smart cards to store digital signatures, cryptography keys, and identification codes?
Public Key Infrastructure (PKI)
You have implemented an access control method that only allows users who are managers to access specific data. Which type of access control model is being used?
Role-based access control (RBAC)
Which of the following is an example of rule-based access control?
Router access control lists that allow or deny traffic based on the characteristics of an IP packet.
Which of the following is used by Microsoft for auditing in order to identify past actions performed by users on an object?
SACL
Which type of group can be used for controlling access to objects?
Security
The IT security team at a large tech company is strengthening its authentication methods to protect sensitive company data and systems. The team considered implementing various security measures and understood that each authentication method has distinct features and benefits. However, they must choose the MOST suitable option that aligns with the organization's security requirements and user convenience. Which authentication method utilizes a physical device or software to generate secure, unique codes and offers convenience and strong security?
Security keys
What is the effect of the following command? chage -M 60 -W 10 jsmith
Sets the password for jsmith to expire after 60 days and gives a warning 10 days before expiration.
You are the IT security manager for a large corporation. The company has been using shared accounts for certain systems due to ease of access and convenience. However, you are considering implementing a policy to prohibit the use of shared accounts. Which of the following are valid reasons for this decision? (Select two.)
Shared accounts can lead to accountability issues. Shared accounts can compromise the principle of least privilege.
Lori, who has been a member of the Project Management group, was recently promoted to manager of the team. She has been added as a member of the Managers group. Several days after being promoted, Lori needs to have performance reviews with the team she manages. However, she cannot access the performance management system. As a member of the Managers group, she should have the Allow permission to access this system. What is MOST likely preventing her from accessing this system?
She is still a member of the Project Management group, which has been denied permission to this system. Deny permissions always override Allow permissions.
Which of the following are examples of something you have authentication controls? (Select two.)
Smart card Photo ID
match each smart card attack on the left with the appropriate description on the right.
Software attacks Exploits vulnerabilities in a card's protocols or encryption methods. Eavesdropping Captures transmission data produced by a card as it is used. Fault generation Deliberately induces malfunctions in a card. Microprobing Accesses the chip's surface directly to observe, manipulate, and interfere with a circuit.
After finding a corporate phone unattended in a local mall, an organization decides to enhance its multi-factor authentication (MFA) procedures. What MFA philosophy applies a location-based factor for authentication?
Somewhere you are
he Hide Programs and Features page setting is configured for a specific user as follows: Policy Local Group Policy Enabled Default Domain Policy GPO Not configured GPO linked to the user's organizational unit Disabled After logging in, the user is able to see the Programs and Features page. Why does this happen?
The GPO linked to the user's organizational unit is applied last, so this setting takes precedence.
Which of the following defines the crossover error rate for evaluating biometric systems?
The point where the number of false positives matches the number of false negatives in a biometric system.
Which security mechanism uses a unique list that meets the following specifications: The list is embedded directly in the object itself. The list defines which subjects have access to certain objects. The list specifies the level or type of access allowed to certain objects.
User ACL
Which of the following is a privilege or action that can be taken on a system?
User rights
Which of the following identification and authentication factors are often well known or easily discovered by others on the same network or system?
Username
You have just configured the password policy and set the minimum password age to 10. What is the effect of this configuration?
Users cannot change the password for 10 days.
Match each Active Directory term on the left with its corresponding definition on the right.
logical organization of resources Organizational unit Collection of network resources Domain Collection of related domain trees Forest Network resource in the directory Object Group of related domains Tree
An employee named Bob Smith, whose username is bsmith, has left the company. You have been instructed to delete his user account and home directory. Which of the following commands would produce the required outcome? (Select two.)
userdel -r bsmith userdel bsmith;rm -rf /home/bsmith
You have performed an audit and found an active account for an employee with the username joer. This user no longer works for the company. Which command can you use to disable this account?
usermod -L joer
One of your users, Karen Scott, has recently married and is now Karen Jones. She has requested that her username be changed from kscott to kjones with no other values changed. Which of the following commands would accomplish this?
usermod -l kjones kscott
