stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
SSCP Bootcamp - access controls / sec ops Flashcards | StudBud
Explore
/
SSCP Bootcamp - access controls / sec ops
SSCP Bootcamp - access controls / sec ops
45 terms
·
StudBud Administration
·
43 plays
SSCP Bootcamp - access controls / sec ops
Flashcards
45 cards
F
Practice quiz
P
Host live
L
Questions
45
Answers
1
Why are
preventative
controls important?
They instruct the attacker to only perform benign activities
They record the occurrence of the violation.
They discourage the attacker from performing the violation.
They attempt to stop the violation from being possible.
2
What type of technical control can be used in the process of
assessing compliance
?
Auditing
Encryption
Multifactor authentication
Security camera
3
What is a directive control?
A mechanism to record compromising activities
A system to block intrusion attempts before they succeed
A means 2 communicate instructions/guidelines/security rules
A substitution of security solution when the solution fails
4
How can an org. protect itself from compromise by accounts that belonged to previous employees?
Account lockout
Account provisioning
Account deactivation
Account audit
5
How is granular control of objects and resources implemented within a MAC environment
Logical location assessment
Need to know
ACLs on objects
Job label
6
What are the three parts of the CIA triad?
Confidentiality, Identification, Authorization
Confidentiality, Integrity, Authorization
Confidentiality, Integrity, Accountability
Confidentiality, Integrity, Availability
7
Which is
NOT
a MAC (Mandatory Access Control)?
Justin Biba
Clark Wilson
Brewer-Nash Chinese wall
Bell LaPadula
8
What are the phases of the SDLC defined in NIST SP800-64-r2 in order?
initiation, design, implementation, operation, evaluation
Trick question, there is no NIST SP800-64-r2
initiation, design/development, implementation, operation
initiation, design, implementation, operation, development
9
Why do employees have to read and sign an Authorized Use Policy (AUP) prior to network access?
To remind them of their responsibilities & accountability
To indicate which individuals can & cannot access resources
To show proof that the company has a business license
To define the laws that can be broken within this network
10
What do the AAA's of security help to support?
Irrevalancy
Non-repudiation
Repudiation
Non-redundancy
11
Which is
not
a government classification?
secret
Private
Unclassified
Top secret
12
What is the definition of the principle of least privilege?
Users determine their own privilege level.
All users are assigned the same privilege level.
Users are assigned the minimal privileges to accomplish job.
No users are assigned sufficient privilege.
13
What is Pi?
the ratio of a circle's circumference to its diameter
Personally identifying information
Personally identifiable information
a baked dish of fruit typically with top and base of pastry.
14
Which security control/control type pair is incorrect?
security guard (dog) / deflective
electronic lock / preventive
video camera / detective
video camera / deterrent
15
A good configuration management plan must be... (Choose the
wrong
answer)
actionable
achievable
anonymous to auditors
include formal testing
16
What do you put in a toaster?
Bread
Toast
Toast
Toast
17
What is Pie?
Personally identifiable information
the ratio of a circle's circumference to its diameter
a baked dish of fruit typically with top and base of pastry.
Personally identifying information
18
Remove unused software, change default passwds, apply patches, enable firewalls are examples of
Defense in depth
System softening
Busy work
System hardening
19
Which type of access control used ACL's?
MAC's
Big Macs
DAC's
Chili Macs
20
Relating to security, what is a danger of portable devices?
They make it extremely easy to move/record/transmit info.
They are susceptible to jamming.
They are typically PIN protected
They are easy to carry therefore you can carry them easily
21
How does mandatory access control determine which objects a subject can access?
By checking ACLs
Based on the job role of the user
By referencing the physical location of the workstation
Through the use of classification labels
22
What are the AAA's of security?
Authentication, Accounting, Accessability
Authentication, Authorization, Accounting
Argentina, Alaska, Alabama
Authentication, Authorization, Accessability
23
Regarding identification, which pair is
NOT
multi-factor?
Debit card and PIN code
userid/password and fingerprint
userid/password and badge
Debit Card and CVV code
24
Which of the following is a poor choice for secure password management?
Create long and complex passwords.
Use auditing tools to test password strength.
Use the default password, it has been verified to be secure.
Never share passwords.
25
What is the purpose of the user account maintenance mechanism known as account lockout?
To grant the ability to pass through a mantrap
To remove an account that was used in a system breach
To prevent password-guessing attacks from being successful
To turn off accounts for people no longer employed
26
Why are corrective controls important to the success of a company's security implementation?
They determine what took place and who the perpetrator was.
They return systems back to a state of normal security.
They effectively prevent damage from occurring.
They cause attackers to rethink actions before a violation.
27
The steps in configuration management
in order
are:
submit, review, approve/reject, implement, monitor/test
submit, approve/review, implement, monitor/test, reject
submit, approve/reject, implement, monitor/test, review
review, submit, approve/reject, implement, monitor/test
28
Regarding trust relationships, if A trusts B and B trusts C but A
does not
trust C. That is...
one way
non-transitive
two way
transitive
29
Regarding a retina scanning identification system, what is NOT a factor to consider?
FAR
FRR
PAR
CER
30
Why is multifactor authentication considered more secure than single-factor authentication?
Single-factor authentication is less compatible with OS's
Multifactor authentication is available on the Internet
It requires many distinct attacks to perform impersonation
Multifactor authentication solutions cost more
31
Relationship where resources from either side can be accessed by users from either side?
Web of trust
Two-way trust
One-way trust
Transitive trust
32
Which of the following is a tenant of the (ISC)
2
Code Of Ethics?
Act honorably, honestly, justly, responsibly, and legally.
Do not bear false witness.
Do not waste resources.
Security is constrained by societal factors.
33
How does Kerberos demonstrate to a resource host that the identity of a user is valid?
A unique session key is used to encrypt the communications.
A shared credential is issued to each principle in the realm
A TGT is issued to the resource host.
ST is issued to the user and then sent to the resource host.
34
How is subject-based access control different from object-based?
Labels on resources are the primary concern.
The focus is on an attribute or setting on the subject.
It always based on ACLs.
It is based on the content of the object.
35
How is accountability typically enforced?
By checking the hash of all files accessed by a user account
With smart cards
Through AAA services
Through the use of asymmetric encryption
36
Why is account or identity proofing necessary? It verifies that...
only authorized person is able to use a specific user acct.
privileged accounts are never used across network links.
users are logging into the assigned workstation @ their desk
people w/ criminal records or sealed histories aren't hired.
37
What is PII?
Personally identifiable information
a baked dish of fruit typically with top and base of pastry.
the ratio of a circle's circumference to its diameter
Personally identifying information
38
Which is a software development methodology/life cycle?
Fragile
Rabid application development
Spiral
Cascading
39
How is a baseline used in compliance management? By...
directing runners to the most direct path to each base.
reducing risk
comparing the current system config with the required config
protecting user privacy
40
How does an attribute-based access control system determine if a subject can access an object?
Assesses the characteristics of subject/object/environment.
Checks for classification labels.
Evaluates the ACLs.
Compares the job description.
41
What's the correct order for granting access to a system?
authorization, identification, authentication
identification, authorization, authentication
identification, authentication, authorization
identification, authorization, accounting
42
What is non-repudiation
a 13 letter word (not counting dashes)
when a system, particulary a binary system, isn't repudiated
when a person can't deny performing an action
not allowing someone to follow you w/out swiping their badge
43
Passwords should be...
Stored in a gym locker
no less than 255 characters in length
easy to remember but hard to guess
reused system to system so they wont be forgotten
44
Which is not a recommended access control policy?
mandatory vacation
annual tire rotation
separation of duties
principle of least privilege
45
Which is an
operational
security control?
Active directory
User awareness documentation
access violation digital logging
User awareness training
