Chapter 6
Which type of password attack is used on weak passwords and compares a hashed value of the passwords to the system password file to find a match? Brute-force attack Dictionary attack Social engineering attack Rainbow table attack
Dictionary attack
True or False? The four central components of access control are users, resources, actions, and features. True False
False The four central components of access control are users, resources, actions, and RELATIONSHIP.
True or False? A smart card is an example of a logical access control. True False
False A smart card is an example of a PHYSICAL access control.
True or False? An authentication, authorization, and accounting (AAA) server, such as Remote Authentication Dial-In User Service (RADIUS), is a type of decentralized access control. True False
False An authentication, authorization, and accounting (AAA) server, such as Remote Authentication Dial-In User Service (RADIUS), is a type of CENTRALIZED access control.
True or False? Authentication by characteristics/biometrics is based on something you have, such as a smart card, a key, a badge, or either a synchronous or asynchronous token. True False
False Authentication by OWNERSHIP is based on something you have, such as a smart card, a key, a badge, or either a synchronous or asynchronous token.
True or False? Passphrases are less secure than passwords. True False
False Passphrases are MORE secure than passwords.
True or False? The number of failed logon attempts that trigger an account action is called an audit logon event. True False
False The number of failed logon attempts that trigger an account action is called the THRESHOLD. Audit logon events provide you with a record of when every user logs on or off a computer.
Keisha is a network administrator. She wants a cloud-based service that will allow her to load operating systems on virtual machines and manage them as if they were local servers. What service is Keisha looking for? Remote Authentication Dial-In User Service (RADIUS) Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS)
Infrastructure as a Service (IaaS)
Which type of authentication includes smart cards? Location Action Knowledge Ownership
Ownership
What is an example of a logical access control? Password Key for a lock Access card Fence
Password
What is an example of two-factor authentication (2FA)? Token and smart card PIN and password Smart card and personal identification number (PIN) Password and security questions
Smart card and personal identification number (PIN)
True or False? Authentication by action is based on something you do, such as typing. True False
True
True or False? Authentication by knowledge is based on something the user knows, such as a password, passphrase, or personal identification number (PIN). True False
True
True or False? Common methods used to identify a user to a system include username, smart card, and biometrics. True False
True
True or False? Physically disabled users might have difficulty with biometric system accessibility, specifically with performance-based biometrics. True False
True
The ___________ is the central part of a computing environment's hardware, software, and firmware that enforces access control. CPU security kernel memory coprocessor
security kernel
Devaki is evaluating different biometric systems. She understands that users might not want to subject themselves to retinal scans due to privacy concerns. Which concern of a biometric system is she considering? Acceptability Dynamism Accuracy Reaction time
Acceptability
Lincoln is a network security specialist. He is updating the password policy for his company's computing infrastructure. His primary method of improving password policy involves lowering the chance that an attacker can compromise and use the password before it expires. What does he do? Requires all passwords to contain at least eight alphanumeric characters Mandates that no password includes words common in an English dictionary Enables a 30-day password change policy Forbids a password being changed to any of the previous 10 passwords listed in the password history
Enables a 30-day password change policy
True or False? Voice pattern biometrics are accurate for authentication because voices cannot easily be replicated by computer software. True False
False Voice patterns biometrics are not accurate for authentication because voices can be too easily replicated by computer software and accuracy can be further diminished by background noise.
Wen is a network engineer. For several months, he has been designing a system of controls to allow and restrict access to network assets based on various methods and information. He is currently configuring the authentication method. What does this method do? Determines how actions can be traced to an individual Grants or denies a requestor access and what they can do on a network Answers the question "who is asking to access the asset?" Verifies that requestors are who they claim to be
Verifies that requestors are who they claim to be
