Access Control

11/12/2016 techbus.safaribooksonline.com/print?
xmlid=9781118105948%2Fdomain_1_access_control0001
Username:AdityaMishraBook:CISSPPractice:2,250Questions,Answers,andExplanationsforPassingtheTest.Nopartofanychapterorbookmaybe
reproducedortransmittedinanyformbyanymeanswithoutthepriorwrittenpermissionforreprintsandexcerptsfromthepublisherofthebookorchapter.
RedistributionorotherusethatviolatesthefairuseprivilegeunderU.S.copyrightlaws(see17USC107)orthatotherwiseviolatestheseTermsofServiceis
strictlyprohibited.ViolatorswillbeprosecutedtothefullextentofU.S.FederalandMassachusettslaws.
DOMAIN1
AccessControl
1.Forintrusiondetectionandpreventionsystemcapabilities,statefulprotocolanalysisuseswhichofthefollowing?
1.Blacklists
2.Whitelists
3.Threshold
4.Programcodeviewing
a.1and2
b.1,2,and3
c.3only
d.1,2,3,and4
1.d.Statefulprotocolanalysis(alsoknownasdeeppacketinspection)istheprocessofcomparingpredeterminedprofilesofgenerallyaccepteddefinitionsofbenign
protocolactivityforeachprotocolstateagainstobservedeventstoidentifydeviations.Statefulprotocolanalysisusesblacklists,whitelists,thresholds,andprogram
codeviewingtoprovidevarioussecuritycapabilities.
Ablacklistisalistofdiscreteentities,suchashostsorapplicationsthathavebeenpreviouslydeterminedtobeassociatedwithmaliciousactivity.Awhitelistisa
listofdiscreteentities,suchashostsorapplicationsknowntobebenign.Thresholdssetthelimitsbetweennormalandabnormalbehavioroftheintrusiondetection
andpreventionsystems(IDPS).ProgramcodeviewingandeditingfeaturesareestablishedtoseethedetectionrelatedprogrammingcodeintheIDPS.
2.Electronicauthenticationbeginswithwhichofthefollowing?
a.Token
b.Credential
c.Subscriber
d.Credentialserviceprovider
2.c.Anapplicantappliestoaregistrationauthority(RA)tobecomeasubscriberofacredentialserviceprovider(CSP)and,asasubscriber,isissuedorregistersa
secret,calledatoken,andacredential(publickeycertificate)thatbindsthetokentoanameandotherattributesthattheRAhasverified.Thetokenandcredentialmay
beusedinsubsequentauthenticationevents.
3.Intheelectronicauthenticationprocess,whoperformstheidentityproofing?
a.Subscriber
b.Registrationauthority
c.Applicant
d.Credentialserviceprovider
3.b.TheRAperformstheidentityproofingafterregisteringtheapplicantwiththeCSP.AnapplicantbecomesasubscriberoftheCSP.
4.Inelectronicauthentication,whichofthefollowingprovidestheauthenticatedinformationtotherelyingpartyformakingaccesscontrol
decisions?
a.Claimant/subscriber
b.Applicant/subscriber
c.Verifier/claimant
d.Verifier/credentialserviceprovider
4.d.Therelyingpartycanusetheauthenticatedinformationprovidedbytheverifier/CSPtomakeaccesscontroldecisionsorauthorizationdecisions.Theverifier
verifiesthattheclaimantisthesubscriber/applicantthroughanauthenticationprotocol.Theverifierpassesonanassertionabouttheidentityofthesubscribertothe
relyingparty.TheverifierandtheCSPmayormaynotbelongtothesameidentity.
http://techbus.safaribooksonline.com/print?xmlid=9781118105948%2Fdomain_1_access_control0001 1/72
11/12/2016 techbus.safaribooksonline.com/print?xmlid=9781118105948%2Fdomain_1_access_control0001
5.Inelectronicauthentication,anauthenticatedsessionisestablishedbetweenwhichofthefollowing?
a.Claimantandtherelyingparty
b.Applicantandtheregistrationauthority
c.Subscriberandthecredentialserviceprovider
d.Certifyingauthorityandtheregistrationauthority
5.a.Anauthenticatedsessionisestablishedbetweentheclaimantandtherelyingparty.Sometimestheverifierisalsotherelyingparty.Theotherthreechoicesare
incorrectbecausethecorrectanswerisbasedonfacts.
6.UnderwhichofthefollowingelectronicauthenticationcircumstancesdoestheverifierneedtodirectlycommunicatewiththeCSPto
completetheauthenticationactivity?
a.Useofadigitalcertificate
b.AphysicallinkbetweentheverifierandtheCSP
c.Distributedfunctionsfortheverifier,relyingparty,andtheCSP
d.AlogicallinkbetweentheverifierandtheCSP
6.b.TheuseofdigitalcertificatesrepresentsalogicallinkbetweentheverifierandtheCSPratherthanaphysicallink.Insomeimplementations,theverifier,relying
party,andtheCSPfunctionsmaybedistributedandseparated.TheverifierneedstodirectlycommunicatewiththeCSPonlywhenthereisaphysicallinkbetween
them.Inotherwords,theverifierdoesnotneedtodirectlycommunicatewiththeCSPfortheotherthreechoices.
7.Inelectronicauthentication,whomaintainstheregistrationrecordstoallowrecoveryofregistrationrecords?
a.Credentialserviceprovider
b.Subscriber
c.Relyingparty
d.Registrationauthority
7.a.TheCSPmaintainsregistrationrecordsforeachsubscribertoallowrecoveryofregistrationrecords.OtherresponsibilitiesoftheCSPincludethefollowing:
TheCSPisresponsibleforestablishingsuitablepoliciesforrenewalandreissuanceoftokensandcredentials.Duringrenewal,theusageorvalidityperiodofthe
token and credential is extended without changing the subscriber's identity or token. During reissuance, a new credential is created for a subscriber with a new
identityand/oranewtoken.
TheCSPisresponsibleformaintainingtherevocationstatusofcredentialsanddestroyingthecredentialattheendofitslife.Forexample,publickeycertificatesare
revokedusingcertificaterevocationlists(CRLs)afterthecertificatesaredistributed.TheverifierandtheCSPmayormaynotbelongtothesameentity.
The CSP is responsible for mitigating threats to tokens and credentials and managing their operations. Examples of threats include disclosure, tampering,
unavailability,unauthorizedrenewalorreissuance,delayedrevocationordestructionofcredentials,andtokenuseafterdecommissioning.
Theotherthreechoicesareincorrectbecausethe(i)subscriberisapartywhohasreceivedacredentialortokenfromaCSP,(ii)relyingpartyisanentitythatrelies
uponthesubscriber'scredentialsorverifier'sassertionofanidentity,and(iii)registrationauthority(RA)isatrustedentitythatestablishesandvouchesforthe
identityofasubscribertoaCSP.TheRAmaybeanintegralpartofaCSP,oritmaybeindependentofaCSP,butithasarelationshiptotheCSP(s).
8.Whichofthefollowingisusedintheuniqueidentificationofemployeesandcontractors?
a.Personalidentityverificationcardtoken
b.Passwords
c.PKIcertificates
d.Biometrics
8.a.Itissuggestedthatapersonalidentityverification(PIV)cardtokenisusedintheuniqueidentificationofemployeesandcontractors.ThePIVisaphysical
artifact (e.g., identity card or smart card) issued to an individual that contains stored identity credentials (e.g., photograph, cryptographic keys, or digitized
fingerprint).
Theotherthreechoicesareusedinuserauthenticatormanagement,notinuseridentifiermanagement.Examplesofuserauthenticatorsincludepasswords,tokens,
cryptographickeys,personalidentificationnumbers (PINs), biometrics, public key infrastructure (PKI) certificates, and key cards. Examples of user identifiers
includeinternalusers,externalusers,contractors,guests,PIVcards,passwords,tokens,andbiometrics.
9.Inelectronicauthentication,whichofthefollowingproducesanauthenticatorusedintheauthenticationprocess?
a.Encryptedkeyandpassword
b.Tokenandcryptographickey
c.Publickeyandverifier
d.Privatekeyandclaimant
9.b.Thetokenmaybeapieceofhardwarethatcontainsacryptographickeythatproducestheauthenticatorusedintheauthenticationprocesstoauthenticatethe
claimant.Thekeyisprotectedbyencryptingitwithapassword.
Theotherthreechoicescannotproduceanauthenticator.Apublickeyisthepublicpartofanasymmetrickeypairtypicallyusedtoverifysignaturesorencryptdata.
Averifierisanentitythatverifiesaclaimant'sidentity.Aprivatekeyisthesecretpartofanasymmetrickeypairtypicallyusedtodigitallysignordecryptdata.A
claimantisapartywhoseidentityistobeverifiedusinganauthenticationprotocol.
10.Inelectronicauthentication,sharedsecretsarebasedonwhichofthefollowing?
1.Asymmetrickeys
2.Symmetrickeys
3.Passwords
4.Publickeypairs
a.1only
b.1or4
c.2or3
d.3or4
10.c.Sharedsecretsarebasedoneithersymmetrickeysorpasswords.Theasymmetrickeysareusedinpublickeypairs.Inaprotocolsense,allsharedsecretsare
similarandcanbeusedinsimilarauthenticationprotocols.
11. Forelectronicauthentication,whichofthefollowingisnotanexampleofassertions?
a.Cookies
b.Securityassertionsmarkuplanguage
c.X.509certificates
d.Kerberostickets
11.c.Anassertionisastatementfromaverifiertoarelyingpartythatcontainsidentityinformationaboutasubscriber.Assertionsmaybedigitallysignedobjects,or
theymaybeobtainedfromatrustedsourcebyasecureprotocol.X.509certificatesareexamplesofelectroniccredentials,notassertions.Cookies,securityassertions
markuplanguage(SAML),andKerberosticketsareexamplesofassertions.
12.Inelectronicauthentication,electroniccredentialsarestoredasdatainadirectoryordatabase.Whichofthefollowingreferstowhenthe
directoryordatabaseistrusted?
a.Signedcredentialsarestoredassigneddata.
b.Unsignedcredentialsarestoredasunsigneddata.
c.Signedcredentialsarestoredasunsigneddata.
d.Unsignedcredentialsarestoredassigneddata.
12.b.Electroniccredentialsaredigitallysignedobjects,inwhichcasetheirintegrityisverified.Whenthedirectoryordatabaseserveristrusted,unsignedcredentials
maybestoredasunsigneddata.
13.Inelectronicauthentication,electroniccredentialsarestoredasdatainadirectoryordatabase.Whichofthefollowingreferstowhenthe
directoryordatabaseisuntrusted?
a.Selfauthenticating
b.Authenticationtotherelyingparty
c.Authenticationtotheverifier
d.Authenticationtothecredentialserviceprovider
13.a.Whenelectroniccredentialsarestoredinadirectoryordatabaseserver,thedirectoryordatabasemaybeanuntrustedentitybecausethedataitsuppliesisself
authenticated.Alternatively,thedirectoryordatabaseservermaybeatrustedentitythatauthenticatesitselftotherelyingpartyorverifier,butnottotheCSP.
14.Thecorrectflowsandproperinteractionsbetweenpartiesinvolvedinelectronicauthenticationinclude:
a.Applicant RegistrationAuthority Subscriber Claimant
b.RegistrationAuthority Applicant Claimant Subscriber
c.Subscriber Applicant RegistrationAuthority Claimant
d.Claimant Subscriber RegistrationAuthority Applicant
14.a.Thecorrectflowsandproperinteractionsbetweenthevariouspartiesinvolvedinelectronicauthenticationincludethefollowing:
Anindividualapplicantappliestoaregistrationauthority(RA)througharegistrationprocesstobecomeasubscriberofacredentialservice
provider(CSP)
TheRAidentityproofsthatapplicant
Onsuccessfulidentityproofing,theRAsendstheCSParegistrationconfirmationmessage
AsecrettokenandacorrespondingcredentialareestablishedbetweentheCSPandthenewsubscriberforuseinsubsequentauthentication
events
Thepartytobeauthenticatediscalledaclaimant(subscriber)andthepartyverifyingthatidentityiscalledaverifier
Theotherthreechoicesareincorrectbecausetheydonotrepresentthecorrectflowsandproperinteractions.
15.Inelectronicauthentication,whichofthefollowingrepresentsthecorrectorderofpassinginformationaboutassertions?
a.Subscriber CredentialServiceProvider RegistrationAuthority
b.Verifier Claimant RelyingParty
c.RelyingParty Claimant RegistrationAuthority
d.Verifier CredentialServiceProvider RelyingParty
15.b.Anassertionisastatementfromaverifiertoarelyingpartythatcontainsidentityinformationaboutasubscriber(i.e.,claimant).Theseassertionsareusedto
passinformationabouttheclaimantfromtheverifiertoarelyingparty.Assertionsmaybedigitallysignedobjectsortheymaybeobtainedfromatrustedsourcebya
secureprotocol.Whentheverifierandtherelyingpartiesareseparateentities,theverifierconveystheresultoftheauthenticationprotocoltotherelyingparty.The
objectcreatedbytheverifiertoconveytheresultoftheauthenticationprotocoliscalledanassertion.Thecredentialserviceproviderandtheregistrationauthorityare
notpartoftheassertionprocess.
16.Fromanaccesscontrolviewpoint,whichofthefollowingarerestrictedaccesscontrolmodels?
1.Identitybasedaccesscontrolpolicy
2.Attributebasedaccesscontrolpolicy
3.BellLaPadulaaccesscontrolmodel
4.Domaintypeenforcementaccesscontrolmodel
a.1and2
b.2and3
c.3and4
d.1,2,3,and4
16.c.BoththeBellLaPadulamodelanddomaintypeenforcementmodelusesrestrictedaccesscontrolmodelsbecausetheyareemployedinsafetycriticalsystems,
suchasmilitaryandairlinesystems.Inarestrictedmodel,theaccesscontrolpoliciesareexpressedonlyoncebyatrustedprincipalandfixedforthelifeofthesystem.
Theidentitybasedandattributebasedaccesscontrolpoliciesarenotbasedonrestrictedaccesscontrolmodelsbutbasedonidentitiesandattributesrespectively.
17.Regardingpasswordguessingandcrackingthreats,whichofthefollowingcanhelpmitigatesuchthreats?
a.Passwordswithlowentropy,largersalts,andsmallerstretching
b.Passwordswithhighentropy,smallersalts,andsmallerstretching
c.Passwordswithhighentropy,largersalts,andlargerstretching
d.Passwordswithlowentropy,smallersalts,andlargerstretching
17.c.Entropyinaninformationsystemisthemeasureofthedisorderorrandomnessinthesystem.Passwordsneedhighentropybecauselowentropyismorelikely
toberecoveredthroughbruteforceattacks.
Saltingistheinclusionofarandomvalueinthepasswordhashingprocessthatgreatlydecreasesthelikelihoodofidenticalpasswordsreturningthesamehash.
Larger salts effectively make the use of Rainbow Tables (lookup tables) by attackers infeasible. Many operating systems implement salted password hashing
mechanismstoreducetheeffectivenessofpasswordcracking.
Stretching,whichisanothertechniquetomitigatetheuseofrainbowtables,involveshashingeachpasswordanditssaltthousandsoftimes.Largerstretchingmakes
thecreationofrainbowtablesmoretimeconsuming,whichisnotgoodfortheattacker,butgoodfortheattackedorganization.Rainbowtablesarelookuptablesthat
contain precomputed password hashes. Therefore, passwords with high entropy, larger salts, and larger stretching can mitigate password guessing and cracking
attemptsbyattackers.
18.Inelectronicauthenticationusingtokens,theauthenticatorinthegeneralcaseisafunctionofwhichofthefollowing?
a.Tokensecretandsaltorchallenge
b.Tokensecretandseedorchallenge
c.Tokensecretandnonceorchallenge
d.Tokensecretandshimorchallenge
18.c.Theauthenticatorisgeneratedthroughtheuseofatoken.Inthetrivialcase,theauthenticatormaybethetokensecretitselfwherethetokenisapassword.Inthe
generalcase,anauthenticatorisgeneratedbyperformingamathematicalfunctionusingthetokensecretandoneormoreoptionaltokeninputvaluessuchasanonce
orchallenge.
Asaltisanonsecretvalueusedinacryptographicprocess,usuallytoensurethattheresultsofcomputationsforoneinstancecannotbereusedbyanattacker.
Aseedisastartingvaluetogenerateinitializationvectors.Anonceisanidentifier,avalue,oranumberusedonlyonce.Usinganonceasachallengeisadifferent
requirementthanarandomchallengingbecauseanonceispredictable.
Ashimisalayerofhostbasedintrusiondetectionandpreventioncodeplacedbetweenexistinglayersofcodeonahostthatinterceptsdataandanalyzesit.
19.Inelectronicauthentication,usingonetokentogainaccesstoasecondtokeniscalleda:
a.Singletoken,multifactorscheme
b.Singletoken,singlefactorscheme
c.Multitoken,multifactorscheme
d.Multistageauthenticationscheme
19.b.Usingonetokentogainaccesstoasecondtokenisconsideredasingletokenandasinglefactorschemebecauseallthatisneededtogainaccessistheinitial
token.Therefore,whenthisschemeisused,thecompoundsolutionisonlyasstrongasthetokenwiththelowestassurancelevel.Theotherchoicesareincorrect
becausetheyarenotapplicabletothesituationhere.
20.Asapartofcentralizedpasswordmanagementsolutions,whichofthefollowingstatementsaretrueaboutpasswordsynchronization?
1.Nocentralizeddirectory
2.Noauthenticationserver
3.Easiertoimplementthansinglesignontechnology
4.Lessexpensivethansinglesignontechnology
a.1and3
b.2and4
c.3and4
d.1,2,3,and4
20.d.Apasswordsynchronizationsolutiontakesapasswordfromauserandchangesthepasswordsonotherresourcestobethesameasthatpassword.Theuserthen
authenticatesdirectlytoeachresourceusingthatpassword.Thereisnocentralizeddirectoryornoauthenticationserverperformingauthenticationonbehalfofthe
resources.Theprimarybenefitofpasswordsynchronizationisthatitreducesthenumberofpasswordsthatusersneedtorememberthismaypermituserstoselect
strongerpasswordsandrememberthemmoreeasily.Unlikesinglesignon(SSO)technology,passwordsynchronizationdoesnotreducethenumberoftimesthat
usersneedtoauthenticate.Passwordsynchronizationsolutionsaretypicallyeasier,lessexpensive,andlesssecuretoimplementthanSSOtechnologies.
21.Asapartofcentralizedpasswordmanagementsolutions,passwordsynchronizationbecomesasinglepointoffailureduetowhichofthe
following?
a.Itusesthesamepasswordformanyresources.
b.Itcanenableanattackertocompromisealowsecurityresourcetogainaccesstoahighsecurityresource.
c.Itusesthelowestcommondenominatorapproachtopasswordstrength.
d.Itcanleadpasswordstobecomeunsynchronized.
21.a.Allfourchoicesareproblemswithpasswordsynchronizationsolution.Becausethesamepasswordisusedformanyresources,thecompromiseofanyone
instanceofthepasswordcompromisesalltheinstances,thereforebecomingasinglepointoffailure.Passwordsynchronizationforcestheuseofthelowestcommon
denominatorapproachtopasswordstrength,resultinginweakerpasswordsduetocharacterandlengthconstraints.Passwordscanbecomeunsynchronizedwhena
userchangesaresourcepassworddirectlywiththatresourceinsteadofgoingthroughthepasswordsynchronizationuserinterface.Apasswordcouldalsobechanged
duetoaresourcefailurethatrequiresrestorationofabackup.
22.RuBACisrulebasedaccesscontrolRAdACisriskadaptiveaccesscontrolUDACisuserdirectedaccesscontrolMACismandatory
accesscontrolABACisattributebasedaccesscontrolRBACisrolebasedaccesscontrolIBACisidentitybasedaccesscontroland
PBACispolicybasedaccesscontrol.Fromanaccesscontrolviewpoint,separationofdomainsisachievedthroughwhichofthe
following?
a.RuBACorRAdAC
b.UDACorMAC
c.ABACorRBAC
d.IBACorPBAC
22.c.AccesscontrolpolicymaybenefitfromseparatingWebservicesintovariousdomainsorcompartments.ThisseparationcanbeimplementedinABACusing
resourceattributesorthroughadditionalrolesdefinedinRBAC.Theotherthreechoicescannothandleseparationofdomains.
23.Regardinglocaladministratorpasswordselection,whichofthefollowingcanbecomeasinglepointoffailure?
a.Usingthesamelocalrootaccountpasswordacrosssystems
b.Usingbuiltinrootaccounts
c.Storinglocalpasswordsonthelocalsystem
d.Authenticatinglocalpasswordsonthelocalsystem
23.a.Havingacommonpasswordsharedamongalllocaladministratororrootaccountsonallmachineswithinanetworksimplifiessystemmaintenance,butitisa
widespreadsecurityweakness,becomingasinglepointoffailure.Ifasinglemachineiscompromised,anattackermayrecoverthepasswordanduseittogainaccess
toallothermachinesthatusethesharedpassword.Therefore,itisgoodtoavoidusingthesamelocaladministratororrootaccountpasswordsacrossmanysystems.
Theotherthreechoices,althoughriskyintheirownway,donotyieldasinglepointoffailure.
24.Inelectronicauthentication,whichofthefollowingstatementsisnottrueaboutamultistagetokenscheme?
a.Anadditionaltokenisusedforelectronictransactionreceipt.
b.Multistageschemeassuranceishigherthanthemultitokenschemeassuranceusingthesamesetoftokens.
c.Anadditionaltokenisusedasaconfirmationmechanism.
d.Twotokensareusedintwostagestoraisetheassurancelevel.
24.b.Inamultistagetokenscheme,twotokensareusedintwostages,andadditionaltokensareusedfortransactionreceiptandconfirmationmechanismtoachieve
therequiredassurancelevel.Thelevelofassuranceofthecombinationofthetwostagescanbenohigherthanthatpossiblethroughamultitokenauthentication
schemeusingthesamesetoftokens.
25.Onlineguessingisathreattothetokensusedforelectronicauthentication.Whichofthefollowingisacountermeasuretomitigatethe
onlineguessingthreat?
a.Usetokensthatgeneratehighentropyauthenticators.
b.Usehardwarecryptographictokens.
c.Usetokenswithdynamicauthenticators.
d.Usemultifactortokens.
25.a.Entropyistheuncertaintyofarandomvariable.Tokensthatgeneratehighentropyauthenticatorspreventonlineguessingofsecrettokensregisteredtoa
legitimateclaimantandofflinecrackingoftokens.Theotherthreechoicescannotpreventonlineguessingoftokensorpasswords.
26.Tokenduplicationisathreattothetokensusedforelectronicauthentication.Whichofthefollowingisacountermeasuretomitigatethe
tokenduplicationthreat?
26.b.Intokenduplication,thesubscriber'stokenhasbeencopiedwithorwithoutthesubscriber'sknowledge.Acountermeasureistousehardwarecryptographic
tokensthataredifficulttoduplicate.Physicalsecuritymechanismscanalsobeusedtoprotectastolentokenfromduplicationbecausetheyprovidetamperevidence,
detection,andresponsecapabilities.Theotherthreechoicescannothandleaduplicatetokensproblem.
27.Eavesdroppingisathreattothetokensusedforelectronicauthentication.Whichofthefollowingisacountermeasuretomitigatethe
eavesdroppingthreat?
27.c.Acountermeasuretomitigatetheeavesdroppingthreatistousetokenswithdynamicauthenticatorswhereknowledgeofoneauthenticatordoesnotassistin
derivingasubsequentauthenticator.Theotherchoicesareincorrectbecausetheycannotprovidedynamicauthentication.
28.Identifiermanagementisapplicabletowhichofthefollowingaccounts?
a.Groupaccounts
b.Localuseraccounts
c.Guestaccounts
d.Anonymousaccounts
28.b.Allusersaccessinganorganization'sinformationsystemsmustbeuniquelyidentifiedandauthenticated.Identifiermanagementisapplicabletolocaluser
accounts where the account is valid only on a local computer, and its identity can be traced to an individual. Identifier management is not applicable to shared
informationsystemaccounts,suchasgroup,guest,default,blank,anonymous,andnonspecificuseraccounts.
29.Phishingorpharmingisathreattothetokensusedforelectronicauthentication.Whichofthefollowingisacountermeasuretomitigate
thephishingorpharmingthreat?
29.c.Acountermeasuretomitigatethephishingorpharmingthreatistousetokenswithdynamicauthenticatorswhereknowledgeofoneauthenticatordoesnot
assistinderivingasubsequentauthenticator.Theotherchoicesareincorrectbecausetheycannotprovidedynamicauthentication.
Phishingistrickingindividualsintodisclosingsensitivepersonalinformationthroughdeceptivecomputerbasedmeans.Phishingattacksusesocialengineeringand
technicalsubterfugetostealconsumers'personalidentitydataandfinancialaccountcredentials.ItinvolvesInternetfraudsterswhosendspamorpopupmessagesto
lurepersonalinformation(e.g.,creditcardnumbers,bankaccountinformation,socialsecuritynumbers,passwords,orothersensitiveinformation)fromunsuspecting
victims.Pharmingismisdirectinguserstofraudulentwebsitesorproxyservers,typicallythroughDNShijackingorpoisoning.
30.Theftisathreattothetokensusedforelectronicauthentication.Whichofthefollowingisacountermeasuretomitigatethetheftthreat?
30.d.AcountermeasuretomitigatethethreatoftokentheftistousemultifactortokensthatneedtobeactivatedthroughaPINorbiometric.Theotherchoicesare
incorrectbecausetheycannotprovidemultifactortokens.
31.Socialengineeringisathreattothetokensusedforelectronicauthentication.Whichofthefollowingisacountermeasuretomitigatethe
socialengineeringthreat?
31.c.Acountermeasuretomitigatethesocialengineeringthreatistousetokenswithdynamicauthenticatorswhereknowledgeofoneauthenticatordoesnotassistin
derivingasubsequentauthenticator.Theotherchoicesareincorrectbecausetheycannotprovidedynamicauthentication.
32.Inelectronicauthentication,whichofthefollowingisusedtoverifyproofofpossessionofregistereddevicesoridentifiers?
a.Lookupsecrettoken
b.Outofbandtoken
c.Tokenlockupfeature
d.Physicalsecuritymechanism
32.b.Outofbandtokenscanbeusedtoverifyproofofpossessionofregistereddevices(e.g.,cellphones)oridentifiers(e.g.,emailIDs).Theotherthreechoices
cannot verify proofofpossession. Lookup secret tokens can be copied. Some tokens can lock up after a number of repeated failed activation attempts. Physical
securitymechanismscanbeusedtoprotectastolentokenfromduplicationbecausetheyprovidetamperevidence,detection,andresponsecapabilities.
33.Inelectronicauthentication,whichofthefollowingareexamplesofweaklyboundcredentials?
1.Unencryptedpasswordfiles
2.Signedpasswordfiles
3.Unsignedpublickeycertificates
4.Signedpublickeycertificates
a.1only
b.1and3
c.1and4
d.2and4
33.b.Unencryptedpasswordfilesandunsignedpublickeycertificatesareexamplesofweaklyboundcredentials.Theassociationbetweentheidentityandthetoken
withinaweaklyboundcredentialcanbereadilyundone,andanewassociationcanbereadilycreated.Forexample,apasswordfileisaweaklyboundcredential
becauseanyonewhohaswriteaccesstothepasswordfilecanpotentiallyupdatetheassociationcontainedwithinthefile.
34.Inelectronicauthentication,whichofthefollowingareexamplesofstronglyboundcredentials?
1.Unencryptedpasswordfiles
2.Signedpasswordfiles
3.Unsignedpublickeycertificates
4.Signedpublickeycertificates
a.1only
b.1and3
c.1and4
d.2and4
34.d.Signedpasswordfilesandsignedpublickeycertificatesareexamplesofstronglyboundcredentials.Theassociationbetweentheidentityandthetokenwithin
astronglyboundcredentialcannotbeeasilyundone.Forexampleadigitalsignaturebindstheidentitytothepublickeyinapublickeycertificatetamperingofthis
signaturecanbeeasilydetectedthroughsignatureverification.
35.Inelectronicauthentication,whichofthefollowingcanbeusedtoderive,guess,orcrackthevalueofthetokensecretorspoofthe
possessionofthetoken?
a.Privatecredentials
b.Publiccredentials
c.Papercredentials
d.Electroniccredentials
35.a.Aprivatecredentialobjectlinksauser'sidentitytoarepresentationofthetokeninawaythattheexposureofthecredentialtounauthorizedpartiescanleadto
anyexposureofthetokensecret.Aprivatecredentialcanbeusedtoderive,guess,orcrackthevalueofthetokensecretorspoofthepossessionofthetoken.Therefore,
itisimportantthatthecontentsoftheprivatecredentialbekeptconfidential(e.g.,ahashedpasswordvalues).
Publiccredentialsaresharedwidely,donotleadtoanexposureofthetokensecret,andhavelittleornoconfidentialityrequirements.Papercredentialsaredocuments
thatattesttotheidentityofanindividual(e.g.,passports,birthcertificates,andemployeeidentitycards)andarebasedonwrittensignatures,seals,specialpapers,and
specialinks.Electroniccredentialsbindanindividual'snametoatokenwiththeuseofX.509certificatesandKerberostickets.
36.Authorizationcontrolsareapartofwhichofthefollowing?
a.Directivecontrols
b.Preventivecontrols
c.Detectivecontrols
d.Correctivecontrols
36.b.Authorizationcontrolssuchasaccesscontrolmatricesandcapabilitytestsareapartofpreventivecontrolsbecausetheyblockunauthorizedaccess.Preventive
controlsdetersecurityincidentsfromhappeninginthefirstplace.
Directive controls are broadbased controls to handle security incidents, and they include management's policies, procedures, and directives. Detective controls
enhancesecuritybymonitoringtheeffectivenessofpreventivecontrolsandbydetectingsecurityincidentswherepreventivecontrolswerecircumvented.Corrective
controlsareprocedurestoreacttosecurityincidentsandtotakeremedialactionsonatimelybasis.Correctivecontrolsrequireproperplanningandpreparationasthey
relymoreonhumanjudgment.
37.Inelectronicauthentication,afteracredentialhasbeencreated,whichofthefollowingisresponsibleformaintainingthecredentialin
storage?
a.Verifier
b.Relyingparty
c.Credentialserviceprovider
d.Registrationauthority
37.c.Thecredentialserviceprovider(CSP)istheonlyoneresponsibleformaintainingthecredentialinstorage.TheverifierandtheCSPmayormaynotbelongtothe
sameentity.Theotherthreechoicesareincorrectbecausetheyarenotapplicabletothesituationhere.
38.Whichofthefollowingisthecorrectdefinitionofprivilegemanagement?
a.Privilegemanagement=Entityattributes+Entitypolicies
b.Privilegemanagement=Attributemanagement+Policymanagement
c.Privilegemanagement=Resourceattributes+Resourcepolicies
d.Privilegemanagement=Environmentattributes+Environmentpolicies
38.bPrivilegemanagementisdefinedasaprocessthatcreates,manages,andstorestheattributesandpoliciesneededtoestablishcriteriathatcanbeusedtodecide
whether an authenticated entity's request for access to some resource should be granted. Privilege management is conceptually split into two parts: attribute
management and policy management. The attribute management is further defined in terms of entity attributes, resource attributes, and environment attributes.
Similarly,thepolicymanagementisfurtherdefinedintermsofentitypolicies,resourcepolicies,andenvironmentpolicies.
39.Theextensibleaccesscontrolmarkuplanguage(XACML)doesnotdefineorsupportwhichofthefollowing?
a.Trustmanagement
b.Privilegemanagement
c.Policylanguage
d.Querylanguage
39.a. The extensible access control markup language (XACML) is a standard for managing access control policy and supports the enterpriselevel privilege
management.Itincludesapolicylanguageandaquerylanguage.However,XACMLdoesnotdefineauthoritydelegationandtrustmanagement.
40.Forintrusiondetectionandpreventionsystem(IDPS)securitycapabilities,whichofthefollowingpreventionactionsshouldbeperformed
firsttoreducetheriskofinadvertentlyblockingbenignactivity?
1.Alertenablingcapability.
2.Alertdisablingcapability.
3.Sensorlearningmodeability.
4.Sensorsimulationmodeability.
a.1and2
b.1and3
c.2and4
d.3and4
40.d.Someintrusiondetectionandpreventionsystem(IDPS)sensorshavealearningmodeorsimulationmodethatsuppressesallpreventionactionsandinstead
indicateswhenapreventionactionshouldhavebeenperformed.Thisabilityenablesadministratorstomonitorandfinetunetheconfigurationoftheprevention
capabilitiesbeforeenablingpreventionactions,whichreducestheriskofinadvertentlyblockingbenignactivity.Alertscanbeenabledordisabledlater.
41.Intheelectronicauthenticationprocess,whichofthefollowingisweaklyresistanttomaninthemiddle(MitM)attacks?
a.Accountlockoutmechanism
b.Randomdata
c.SendingapasswordoverserverauthenticatedTLS
d.Nonce
41.c.AprotocolissaidtohaveweakresistancetoMitMattacksifitprovidesamechanismfortheclaimanttodeterminewhetherheisinteractingwiththereal
verifier,butstillleavestheopportunityforthenonvigilantclaimanttorevealatokenauthenticatortoanunauthorizedpartythatcanbeusedtomasqueradeasthe
claimanttotherealverifier.Forexample,sendingapasswordoverserverauthenticatedtransportlayersecurity(TLS)isweaklyresistanttoMitMattacks.Thebrowser
enablestheclaimanttoverifytheidentityoftheverifierhowever,iftheclaimantisnotsufficientlyvigilant,thepasswordwillberevealedtoanunauthorizedparty
whocanabusetheinformation.TheotherthreechoicesdonotdealwithMitMattacks,buttheycanenhancetheoverallelectronicauthenticationprocess.
An account lockout mechanism is implemented on the verifier to prevent online guessing of passwords by an attacker who tries to authenticate as a legitimate
claimant.Randomdataandnoncecanbeusedtodisguisetherealdata.
42.Intheelectronicauthenticationprocess,whichofthefollowingisstronglyresistanttomaninthemiddle(MitM)attacks?
a.Encryptedkeyexchange(EKE)
b.Simplepasswordexponentialkeyexchange(SPEKE)
c.Secureremotepasswordprotocol(SRP)
d.Clientauthenticatedtransportlayersecurity(TLS)
42.d.Aprotocolissaidtobehighlyresistanttomaninthemiddle(MitM)attacksifitdoesnotenabletheclaimanttoreveal,toanattackermasqueradingasthe
verifier,information(e.g.,tokensecretsandauthenticators)thatcanbeusedbythelattertomasqueradeasthetrueclaimanttotherealverifier.Forexample,inclient
authenticatedtransportlayersecurity(TLS),thebrowserandtheWebserverauthenticateoneanotherusingpublickeyinfrastructure(PKI)credentials,thusstrongly
resistant to MitM attacks. The other three choices are incorrect, because they are examples of being weakly resistant to MitM attacks and are examples of zero
knowledgepasswordprotocolwheretheclaimantisauthenticatedtoaverifierwithoutdisclosingthetokensecret.
43.Inelectronicauthentication,whichofthefollowingcontrolsiseffectiveagainstcrosssitescripting(XSS)vulnerabilities?
a.Sanitizeinputstomakethemnonexecutable.
b.Insertrandomdataintoanylinkeduniformresourcelocator.
c.Insertrandomdataintoahiddenfield.
d.Useapersessionsharedsecret.
43.a.Inacrosssitescripting(XSS)vulnerability,anattackermayuseanextensiblemarkuplanguage(XML)injectiontoperformtheequivalentofanXSS,inwhich
requestersofavalidWebservicehavetheirrequeststransparentlyreroutedtoanattackercontrolledWebservicethatperformsmaliciousoperations.TopreventXSS
vulnerabilities,therelyingpartyshouldsanitizeinputsfromclaimantsorsubscriberstoensuretheyarenotexecutable,orattheveryleastnotmalicious,before
displayingthemascontenttothesubscriber'sbrowser.Theotherthreechoicesareincorrectbecausetheyarenotapplicabletothesituationhere.
44.Inelectronicauthentication,whichofthefollowingcontrolsisnoteffectiveagainstacrosssiterequestforgery(CSRF)attack?
a.Sanitizeinputstomakethemnonexecutable.
b.Insertrandomdataintoanylinkeduniformresourcelocator.
c.Insertrandomdataintoahiddenfield.
d.Generateapersessionsharedsecret.
44.a.Acrosssiterequestforgery(CSRF)isatypeofsessionhijackingattackwhereamaliciouswebsitecontainsalinktotheURLofthelegitimaterelyingparty.
Webapplications,eventhoseprotectedbysecuresocketslayer/transportlayersecurity(SSL/TLS),canstillbevulnerabletotheCSRFattack.Onecontroltoprotect
theCSRFattackisbyinsertingrandomdata,suppliedbytherelyingparty,intoanylinkeduniformresourcelocatorwithsideeffectsandintoahiddenfieldwithin
any form on the relying party's website. Generating a persession shared secret is effective against a session hijacking problem. Sanitizing inputs to make them
nonexecutableiseffectiveagainstcrosssitescripting(XSS)attacks,notCSRFattacks.
45.Inelectronicauthentication,whichofthefollowingcanmitigatethethreatofassertionmanufactureand/ormodification?
a.DigitalsignatureandTLS/SSL
b.Timestampandshortlifetimeofvalidity
c.Digitalsignaturewithakeysupportingnonrepudiation
d.HTTPandTLS
45.a.Anassertionisastatementfromaverifiertoarelyingpartythatcontainsidentityinformationaboutasubscriber.Tomitigatethethreatofassertionmanufacture
and/ormodification,theassertionmaybedigitallysignedbytheverifierandtheassertionsentoveraprotectedchannelsuchasTLS/SSL.Theotherthreechoicesare
incorrectbecausetheyarenotapplicabletothesituationhere.
46.Inelectronicauthentication,whichofthefollowingcanmitigatethethreatofassertionreuse?
d.HTTPandTLS
46.b.Anassertionisastatementfromaverifiertoarelyingpartythatcontainsidentityinformationaboutasubscriber.Tomitigatethethreatofassertionreuse,the
assertionshouldincludeatimestampandashortlifetimeofvalidity.Theotherthreechoicesareincorrectbecausetheyarenotapplicabletothesituationhere.
47.Inelectronicauthentication,whichofthefollowingcanmitigatethethreatofassertionrepudiation?
d.HTTPandTLS
47.c.Anassertionisastatementfromaverifiertoarelyingpartythatcontainsidentityinformationaboutasubscriber.Tomitigatethethreatofassertionrepudiation,
theassertionmaybedigitallysignedbytheverifierusingakeythatsupportsnonrepudiation.Theotherthreechoicesareincorrectbecausetheyarenotapplicableto
thesituationhere.
48.Inelectronicauthentication,whichofthefollowingcanmitigatethethreatofassertionsubstitution?
d.HTTPandTLS
48.d. An assertion is a statement from a verifier to a relying party that contains identity information about a subscriber. To mitigate the threat of assertion
substitution,theassertionmayincludeacombinationofHTTPtohandlemessageorderandTLStodetectanddisallowmaliciousreorderingofpackets.Theother
threechoicesareincorrectbecausetheyarenotapplicabletothesituationhere.
49.Seriousvulnerabilitiesexistwhen:
a.Anuntrustedindividualhasbeengrantedanunauthorizedaccess.
b.Atrustedindividualhasbeengrantedanauthorizedaccess.
c.Anuntrustedindividualhasbeengrantedanauthorizedaccess.
d.Atrustedindividualhasbeengrantedanunauthorizedaccess.
49.a.Vulnerabilitiestypicallyresultwhenanuntrustedindividualisgrantedunauthorizedaccesstoasystem.Grantingunauthorizedaccessisriskierthangranting
authorizedaccesstoanuntrustedindividual,andtrustedindividualsarebetterthanuntrustedindividuals.Bothtrustandauthorizationareimportanttominimize
vulnerabilities.Theotherthreechoicesareincorrectbecauseseriousvulnerabilitiesmaynotexistwiththem.
50.Inmobiledeviceauthentication,passwordandpersonalidentificationnumber(PIN)authenticationisanexampleofwhichofthefollowing?
a.Proofbypossession
b.Proofbyknowledge
c.Proofbyproperty
d.Proofoforigin
50.b. Proofbyknowledge is where a claimant authenticates his identity to a verifier by the use of a password or PIN (i.e., something you know) that he has
knowledgeof.
Proofbypossessionandproofbyproperty,alongwithproofbyknowledge,areusedinmobiledeviceauthenticationandrobustauthentication.Proofoforiginis
thebasistoproveanassertion.Forexample,aprivatesignaturekeyisusedtogeneratedigitalsignaturesasaproofoforigin.
51.Inmobiledeviceauthentication,fingerprintauthenticationisanexampleofwhichofthefollowing?
a.Proofbypossession
b.Proofbyknowledge
c.Proofbyproperty
d.Proofoforigin
51.c.Proofbypropertyiswhereaclaimantauthenticateshisidentitytoaverifierbytheuseofabiometricsamplesuchasfingerprints(i.e.,somethingyouare).
Proofbypossessionandproofbyknowledge,alongwithproofbyproperty,areusedinmobiledeviceauthenticationandrobustauthentication.Proofoforiginis
thebasistoproveanassertion.Forexample,aprivatesignaturekeyisusedtogeneratedigitalsignaturesasaproofoforigin.
52.Whichofthefollowingactionsiseffectiveforreviewingguest/anonymousaccounts,temporaryaccounts,inactiveaccounts,andemergency
accounts?
a.Disabling
b.Auditing
c.Notifying
d.Terminating
52.b. All the accounts mentioned in the question can be disabled, notified, or terminated, but it is not effective. Auditing of account creation, modification,
notification,disabling,andtermination(i.e.,theentireaccountcycle)iseffectivebecauseitcanidentifyanomaliesintheaccountcycleprocess.
53.Regardingaccessenforcement,whichofthefollowingmechanismsshouldnotbeemployedwhenanimmediateresponseisnecessaryto
ensurepublicandenvironmentalsafety?
a.Dualcable
b.Dualauthorization
c.Dualusecertificate
d.Dualbackbone
53.b. Dual authorization mechanisms require two forms of approval to execute. The organization should not employ a dual authorization mechanism when an
immediateresponseisnecessarytoensurepublicandenvironmentalsafetybecauseitcouldslowdowntheneededresponse.Theotherthreechoicesareappropriate
whenanimmediateresponseisnecessary.
54.Whichofthefollowingisnotanexampleofnondiscretionaryaccesscontrol?
a.Identitybasedaccesscontrol
b.Mandatoryaccesscontrol
c.Rolebasedaccesscontrol
d.Temporalconstraints
54.a. Nondiscretionary access control policies have rules that are not established at the discretion of the user. These controls can be changed only through
administrativeactionandnotbyusers.Anidentitybasedaccesscontrol(IBAC)decisiongrantsordeniesarequestbasedonthepresenceofanentityonanaccess
controllist(ACL).IBACanddiscretionaryaccesscontrolareconsideredequivalentandarenotexamplesofnondiscretionaryaccesscontrols.
Theotherthreechoicesareexamplesofnondiscretionaryaccesscontrols.Mandatoryaccesscontroldealswithrules,rolebasedaccesscontroldealswithjobtitlesand
functions,andtemporalconstraintsdealwithtimebasedrestrictionsandcontroltimesensitiveactivities.
55.Encryptionisusedtoreducetheprobabilityofunauthorizeddisclosureandchangestoinformationwhenasystemisinwhichofthe
followingsecure,nonoperablesystemstates?
a.Troubleshooting
b.Offlineformaintenance
c.Bootup
d.Shutdown
55.b.Secure,nonoperablesystemstatesarestatesinwhichtheinformationsystemisnotperformingbusinessrelatedprocessing.Thesestatesincludeofflinefor
maintenance,troubleshooting,bootup,andshutdown.Offlinedatashouldbestoredwithencryptioninasecurelocation.Removinginformationfromonlinestorage
toofflinestorageeliminatesthepossibilityofindividualsgainingunauthorizedaccesstothatinformationviaanetwork.
56.Bitmapobjectsandtextualobjectsarepartofwhichofthefollowingsecuritypolicyfilters?
a.Filetypecheckingfilters
b.Metadatacontentfilters
c.Unstructureddatafilters
d.Hiddencontentfilters
56.c. Unstructured data consists of two basic categories: bitmap objects (e.g., image, audio, and video files) and textual objects (e.g., emails and spreadsheets).
Securitypolicyfiltersincludefiletypecheckingfilters,dirtywordfilters,structuredandunstructureddatafilters,metadatacontentfilters,andhiddencontentfilters.
57.Informationflowcontrolenforcementemployingrulesetstorestrictinformationsystemservicesprovides:
1.Structureddatafilters
2.Metadatacontentfilters
3.Packetfilters
4.Messagefilters
a.1and2
b.2and3
c.3and4
d.1,2,3,and4
57.c.Packetfiltersarebasedonheaderinformationwhereasmessagefiltersarebasedoncontentusingkeywordsearches.Bothpacketfiltersandmessagefiltersuse
rulesets.Structureddatafiltersandmetadatacontentfiltersdonotuserulesets.
58.Forinformationflowenforcement,whatareexplicitsecurityattributesusedtocontrol?
a.Releaseofsensitivedata
b.Datacontent
c.Datastructure
d.Sourceobjects
58.a. Information flow enforcement using explicit security attributes are used to control the release of certain types of information such as sensitive data. Data
content,datastructure,andsourceanddestinationobjectsareexamplesofimplicitsecurityattributes.
59.Whatdopolicyenforcementmechanisms,usedtotransferinformationbetweendifferentsecuritydomainspriortotransfer,include?
1.Embeddingrules
2.Releaserules
3.Filteringrules
4.Sanitizationrules
a.1and2
b.2and3
c.3and4
d.1,2,3,and4
59.c.Policyenforcementmechanismsincludethefilteringand/orsanitizationrulesthatareappliedtoinformationpriortotransfertoadifferentsecuritydomain.
Embeddingrulesandreleaserulesdonothandleinformationtransfer.
60.Whichofthefollowingisnotanexampleofpolicyrulesforcrossdomaintransfers?
a.Prohibitingmorethantwolevelsofembedding
b.Facilitatingpolicydecisionsonsourceanddestination
c.Prohibitingthetransferofarchivedinformation
d.Limitingembeddedcomponentswithinothercomponents
60.b.Parsingtransferfilesfacilitatespolicydecisionsonsource,destination,certificates,classificationsubject,orattachments.Theotherthreechoicesareexamples
ofpolicyrulesforcrossdomaintransfers.
61.Whichofthefollowingarethewaystoreducetherangeofpotentialmaliciouscontentwhentransferringinformationbetweendifferent
securitydomains?
1.Constrainfilelengths
2.Constraincharactersets
3.Constrainschemas
4.Constraindatastructures
a.1and3
b.2and3
c.3and4
d.1,2,3,and4
61.d. The information system, when transferring information between different security domains, implements security policy filters that constrain file lengths,
charactersets,schemas,datastructures,andallowedenumerationstoreducetherangeofpotentialmaliciousand/orunsanctionedcontent.
62.Whichofthefollowingcannotdetectunsanctionedinformationandprohibitthetransferofsuchinformationbetweendifferentsecurity
domains(i.e.,domaintypeenforcement)?
a.Implementingonewayflows
b.Checkinginformationformalware
c.Implementingdirtywordlistsearches
d.Applyingsecurityattributestometadata
62.a.Onewayflowsareimplementedusinghardwaremechanismsforcontrollingtheflowofinformationwithinasystemandbetweeninterconnectedsystems.As
suchtheycannotdetectunsanctionedinformation.
The other three choices do detect unsanctioned information and prohibit the transfer with actions such as checking all transferred information for malware,
implementingdirtywordlistsearchesontransferredinformation,andapplyingsecurityattributestometadatathataresimilartoinformationpayloads.
63.Whichofthefollowingbindssecurityattributestoinformationtofacilitateinformationflowpolicyenforcement?
a.Securitylabels
b.Resolutionlabels
c.Headerlabels
d.Filelabels
63.b.Meanstobindandenforcetheinformationflowincluderesolutionlabelsthatdistinguishbetweeninformationsystemsandtheirspecificcomponents,and
betweenindividuals involved in preparing, sending, receiving, or disseminating information. The other three types of labels cannot bind security attributes to
information.
64.Whichofthefollowingaccessenforcementmechanismsprovidesincreasedinformationsecurityforanorganization?
a.Accesscontrollists
b.Businessapplicationsystem
c.Accesscontrolmatrices
d.Cryptography
64.b.Normalaccessenforcementmechanismsincludeaccesscontrollists,accesscontrolmatrices,andcryptography.Increasedinformationsecurityisprovidedatthe
applicationsystemlevel(i.e.,accountingandmarketingsystems)duetotheuseofpasswordandPIN.
65.Whatdoarchitecturalsecuritysolutionstoenforcesecuritypoliciesaboutinformationoninterconnectedsystemsinclude?
1.Implementingaccessonlymechanisms
2.Implementingonewaytransfermechanisms
3.Employinghardwaremechanismstoprovideunitaryflowdirections
4.Implementingregradingmechanismstoreassignsecurityattributes
a.1only
b.2only
c.3only
d.1,2,3,and4
65.d.Specificarchitecturalsecuritysolutionscanreducethepotentialforundiscoveredvulnerabilities.Thesesolutionsincludeallfouritemsmentioned.
66.Fromanaccesscontrolpointofview,separationofdutyisoftwotypes:staticanddynamic.Whichofthefollowingareexamplesofstatic
separationofduties?
1.Rolebasedaccesscontrol
2.Workflowpolicy
3.Rulebasedaccesscontrol
4.ChineseWallpolicy
a.1and2
b.1and3
c.2and4
d.3and4
66.b.Separationofdutyconstraintsrequirethattworolesbemutuallyexclusivebecausenousershouldhavetheprivilegesfrombothroles.Bothrolebasedandrule
basedaccesscontrolsareexamplesofstaticseparationofduty.
Dynamicseparationofdutyisenforcedataccesstime,andthedecisiontograntaccessreferstothepastaccesshistory.Examplesofdynamicseparationofduty
includeworkflowpolicyandtheChineseWallpolicy.
67.Inbiometricsbasedidentificationandauthenticationtechniques,whichofthefollowingstatementsaretrueaboutbiometricerrors?
1.Highfalserejectionrateispreferred.
2.Lowfalseacceptancerateispreferred.
3.Highcrossovererrorraterepresentslowaccuracy.
4.Lowcrossovererrorraterepresentslowaccuracy.
a.1and3
b.1and4
c.2and3
d.2and4
67.c.Thegoalofbiometricsbasedidentificationandauthenticationtechniquesaboutbiometricerrorsistoobtainlownumbersforbothfalserejectionrateandfalse
acceptancerateerrors.Anothergoalistoobtainalowcrossovererrorratebecauseitrepresentshighaccuracyorahighcrossovererrorratebecauseitrepresentslow
accuracy.
68.Forpasswordmanagement,userselectedpasswordsgenerallycontainwhichofthefollowing?
1.Lessentropy
2.Easierforuserstoremember
3.Weakerpasswords
4.Easierforattackerstoguess
a.2only
b.2and3
c.2,3,and4
d.1,2,3,and4
68.d.Userselectedpasswordsgenerallycontainlessentropy,areeasierforuserstoremember,useweakerpasswords,andatthesametimeareeasierforattackersto
guessorcrack.
69.Asapartofcentralizedpasswordmanagementsolution,whichofthefollowingarchitecturesforsinglesignontechnologybecomesa
singlepointoffailure?
a.Kerberosauthenticationservice
b.Lightweightdirectoryaccessprotocol
c.Domainpasswords
d.Centralizedauthenticationserver
69.d.Acommonarchitectureforsinglesignon(SSO)istohaveanauthenticationservice,suchasKerberos,forauthenticatingSSOusers,andadatabaseordirectory
service such as lightweight directory access protocol (LDAP) that stores authentication information for the resources the SSO handles authentication for. By
definition,theSSOtechnologyusesapassword,andanSSOsolutionusuallyincludesoneormorecentralizedserverscontainingauthenticationcredentialsformany
users.Suchaserverbecomesasinglepointoffailureforauthenticationtomanyresources,sotheavailabilityoftheserveraffectstheavailabilityofalltheresources
thatrelyonthatserver.
70.Ifpropermutualauthenticationisnotperformed,whatisthesinglesignontechnologyvulnerableto?
a.Maninthemiddleattack
b.Replayattack
c.Socialengineeringattack
d.Phishingattack
70.a.Userauthenticationtothesinglesignon(SSO)technologyisimportant.Ifpropermutualauthenticationisnotperformed,theSSOtechnologyusingpasswords
isvulnerabletoamaninthemiddle(MitM)attack.Socialengineeringandphishingattacksarebasedonpasswords,andreplayattacksdonotusepasswords.
71.Fromanaccesscontrolpointofview,separationofdutyisoftwotypes:staticanddynamic.Whichofthefollowingareexamplesof
dynamicseparationofduties?
1.Twopersonrule
2.Historybasedseparationofduty
3.Designtime
4.Runtime
a.1and2
b.1and3
c.2and4
d.3and4
71.a.Thetwopersonrulestatesthatthefirstusercanbeanyauthorizeduser,butthesecondusercanbeanyauthorizeduserdifferentfromthefirst.Historybased
separationofdutyregulatesthatthesamesubject(roleoruser)cannotaccessthesameobject(programordevice)foravariablenumberoftimes.Designtimeandrun
timeareusedintheworkflowpolicy.
72.Fromanaccesscontrolpointofview,theChineseWallpolicyfocusesonwhichofthefollowing?
a.Confidentiality
b.Integrity
c.Availability
d.Assurance
72.a.TheChineseWallpolicyisusedwherecompanysensitiveinformation(i.e.,confidentiality)isdividedintomutuallydisjointedconflictofinterestcategories.
TheBibamodelfocusesonintegrity.Availability,assurance,andintegrityareothercomponentsofsecurityprinciplesthatarenotrelevanttotheChineseWallpolicy.
73.Fromanaccesscontrolpointofview,whichofthefollowingmaintainsconsistencybetweentheinternaldataandusers'expectationsofthat
data?
a.Securitypolicy
b.Workflowpolicy
c.Accesscontrolpolicy
d.ChineseWallpolicy
73.b.Thegoalofworkflowpolicyistomaintainconsistencybetweentheinternaldataandexternal(users')expectationsofthatdata.Thisisbecausetheworkflowis
aprocess,consistingoftasks,documents,anddata.TheChineseWallpolicydealswithdividingsensitivedataintoseparatecategories.Thesecuritypolicyandthe
accesscontrolpolicyaretoogeneraltobeofanyimportancehere.
74.Fromanaccesscontrolpointofview,separationofdutyisnotrelatedtowhichofthefollowing?
a.Safety
b.Reliability
c.Fraud
d.Security
74.b.Computersystemsmustbedesignedanddevelopedwithsecurityandsafetyinmindbecauseunsecureandunsafesystemscancauseinjurytopeopleand
damagetoassets(e.g.,militaryandairlinesystems).Withseparationofduty(SOD),fraudcanbeminimizedwhensensitivetasksareseparatedfromeachother(e.g.,
signingacheckfromrequestingacheck).Reliabilityismoreofanengineeringterminthatacomputersystemisexpectedtoperformwiththerequiredprecisionona
consistentbasis.Ontheotherhand,SODdealswithpeopleandtheirworkrelatedactions,whicharenotpreciseandconsistent.
75.Whichofthefollowingstatementsaretrueaboutaccesscontrols,safety,trust,andseparationofduty?
1.Noleakageofaccesspermissionsareallowedtoanunauthorizedprincipal.
2.Noaccessprivilegescanbeescalatedtoanunauthorizedprincipal.
3.Noprincipals'trustmeansnosafety.
4.Noseparationofdutymeansnosafety.
a.1only
b.2only
c.1,2,and3
d.1,2,3,and4
75.d.Ifcompletetrustbyaprincipalisnotpractical,thereisapossibilityofasafetyviolation.Theseparationofdutyconceptisusedtoenforcesafetyandsecurityin
some access control models. In an event where there are many users (subjects), objects, and relations between subjects and objects, safety needs to be carefully
considered.
76.Fromasafetyconfigurationviewpoint,theseparationofdutyconceptisnotenforcedinwhichofthefollowing?
a.Mandatoryaccesscontrolpolicy
b.BellLaPadulaaccesscontrolmodel
c.Accesscontrolmatrixmodel
d.Domaintypeenforcementaccesscontrolmodel
76.c.Theseparationofdutyconceptisnotenforcedbytheaccesscontrolmatrixmodelbecauseitisnotsafetyconfiguredandisbasedonanarbitraryconstraint.The
otherthreechoicesuserestrictedaccesscontrolmodelswithaccessconstraintsthatdescribethesafetyrequirementsofanyconfiguration.
77.Whichofthefollowingstatementsaretrueaboutaccesscontrolsandsafety?
1.Morecomplexsafetypoliciesneedmoreflexibleaccesscontrols.
2.Addingflexibilitytorestrictedaccesscontrolmodelsincreasessafetyproblems.
3.Atradeoffexistsbetweentheexpressivepowerofanaccesscontrolmodelandtheeaseofsafetyenforcement.
4.Intheimplicitaccessconstraintsmodel,safetyenforcementisrelativelyeasierthaninthearbitraryconstraintsmodel.
a.1and3
b.2and3
c.3and4
d.1,2,3,and4
77.d.Ingeneral,accesscontrolpolicyexpressionmodels,suchasrolebasedandaccesscontrolmatrixmodels,operateonarbitraryconstraintsandsafetyenforcement
isdifficult.Inimplicit(restricted)accessconstraintsmodels(e.g.,BellLaPadula),thesafetyenforcementisattainable.
78.Thepurposeofstaticseparationofdutyistoaddressproblems,suchasstaticexclusivityandtheassuranceprinciple.Whichofthe
followingreferstothestaticexclusivityproblem?
1.Toreducethelikelihoodoffraud.
2.Topreventthelossofuserobjectivity.
3.Oneuserislesslikelytocommitfraudwhenthisuserisapartofmanyusersinvolvedinabusinesstransaction.
4.Fewusersarelesslikelytocommitcollusionwhentheseusersareapartofmanyusersinvolvedinabusinesstransaction.
a.1and2
b.2and3
c.3and4
d.1,2,3,and4
78.a.Astaticexclusivityproblemistheconditionforwhichitisconsidereddangerousforanyusertogainauthorizationforaconflictingsetofaccesscapabilities.
Themotivationforexclusivityrelationsincludesreducingthelikelihoodoffraudorpreventingthelossofuserobjectivity.Theassuranceprincipledealswith
committingfraudorcollusionwhenmanyusersareinvolvedinhandlingabusinesstransaction.
79.Rolebasedaccesscontrolandtheleastprivilegeprincipledonotenablewhichofthefollowing?
a.Readaccesstoaspecifiedfile
b.Writeaccesstoaspecifieddirectory
c.Connectaccesstoagivenhostcomputer
d.Oneadministratorwithsuperuseraccesspermissions
79.d.Theconceptoflimitingaccessorleastprivilegeissimplytoprovidenomoreauthorizationthannecessarytoperformrequiredfunctions.Bestpracticesuggests
itisbettertohaveseveraladministratorswithlimitedaccesstosecurityresourcesratherthanoneadministratorwithsuperuseraccesspermissions.Theprincipleof
leastprivilegeisconnectedtotherolebasedaccesscontrolinthateachroleisassignedthoseaccesspermissionsneededtoperformitsfunctions,asmentionedinthe
otherthreechoices.
80.Extensibleaccesscontrolmarkuplanguage(XACML)frameworkincorporatesthesupportofwhichofthefollowing?
a.Rulebasedaccesscontrol(RuBAC)
b.Mandatoryaccesscontrol(MAC)
c.Rolebasedaccesscontrol(RBAC)
d.Discretionaryaccesscontrol(DAC)
80.c.Theextensibleaccesscontrolmarkuplanguage(XACML)frameworkdoesnotprovidesupportforrepresentingthetraditionalaccesscontrols(e.g.,RuBAC,
MAC,andDAC),butitdoesincorporatetherolebasedaccesscontrol(RBAC)support.TheXACMLspecificationdescribesbuildingblocksfromwhichanRBAC
solutionisdeveloped.
81.Fromanaccesscontrolviewpoint,whichofthefollowingrequiresanauditthemost?
a.Publicaccessaccounts
b.Nonpublicaccounts
c.Privilegedaccounts
d.Nonprivilegedaccounts
81.c.Thegoalistolimitexposureduetooperatingfromwithinaprivilegedaccountorrole.Achangeofroleforauserorprocessshouldprovidethesamedegreeof
assuranceinthechangeofaccessauthorizationsforthatuserorprocess.Thesamedegreeofassuranceisalsoneededwhenachangebetweenaprivilegedaccountand
nonprivilegedaccounttakesplace.Auditingofprivilegedaccountsisrequiredmostlytoensurethatprivilegedaccountusersuseonlytheprivilegedaccountsand
that nonprivileged account users use only the nonprivileged accounts. An audit is not required for public access accounts due to little or no risk involved.
Privilegedaccountsareriskierthannonpublicaccounts.
82.Fromaninformationflowpolicyenforcementviewpoint,whichofthefollowingallowsforensicreconstructionofevents?
1.Securityattributes
2.Securitypolicies
3.Sourcepoints
4.Destinationpoints
a.1and2
b.2and3
c.3and4
d.1,2,3,and4
82.c.Theabilitytoidentifysourceanddestinationpointsforinformationflowinginaninformationsystemallowsforforensicreconstructionofeventsandincreases
compliancetosecuritypolicies.Securityattributesarecriticalcomponentsoftheoperationssecurityconcept.
83.Fromanaccesscontrolpolicyenforcementviewpoint,whichofthefollowingshouldnotbegivenaprivilegeduseraccounttoaccess
securityfunctionsduringthecourseofnormaloperations?
1.Networkadministrationdepartment
2.Securityadministrationdepartment
3.Enduserdepartment
4.Internalauditdepartment
a.1and2
b.3only
c.4only
d.3and4
83.d.Privilegeduseraccountsshouldbeestablishedandadministeredinaccordancewitharolebasedaccessschemetoaccesssecurityfunctions.Privilegedroles
includenetworkadministration,securityadministration,systemadministration,databaseadministration,andWebadministration,andshouldbegivenaccessto
securityfunctions.Endusersandinternalauditorsshouldnotbegivenaprivilegedaccounttoaccesssecurityfunctionsduringthecourseofnormaloperations.
84.Fromanaccesscontrolaccountmanagementpointofview,serviceorientedarchitectureimplementationsrelyonwhichofthefollowing?
a.Dynamicuserprivileges
b.Staticuserprivileges
c.Predefineduserprivileges
d.Dynamicuseridentities
84.a. Serviceoriented architecture (SOA) implementations rely on runtime access control decisions facilitated by dynamic privilege management. In contrast,
conventionalaccesscontrolimplementationsemploystaticinformationaccountsandpredefinedsetsofuserprivileges.Althoughuseridentitiesremainrelatively
constantovertime,userprivilegesmaychangemorefrequentlybasedontheongoingbusinessrequirementsandoperationalneedsoftheorganization.
85.Forprivilegemanagement,whichofthefollowingisthecorrectorder?
a.Accesscontrol Accessmanagement Authenticationmanagement Privilegemanagement
b.Accessmanagement Accesscontrol Privilegemanagement Authenticationmanagement
c.Authenticationmanagement Privilegemanagement Accesscontrol Accessmanagement
d.Privilegemanagement Accessmanagement Accesscontrol Authenticationmanagement
85.c.Privilegemanagementisdefinedasaprocessthatcreates,manages,andstorestheattributesandpoliciesneededtoestablishcriteriathatcanbeusedtodecide
whetheranauthenticatedentity'srequestforaccesstosomeresourceshouldbegranted.Authenticationmanagementdealswithidentities,credentials,andanyother
authentication data needed to establish an identity. Access management, which includes privilege management and access control, encompasses the science and
technologyofcreating,assigning,storing,andaccessingattributesandpolicies.Theseattributesandpoliciesareusedtodecidewhetheranentity'srequestforaccess
shouldbeallowedordenied.Inotherwords,atypicalaccessdecisionstartswithauthenticationmanagementandendswithaccessmanagement,whereasprivilege
managementfallsinbetween.
86.Fromanaccesscontrolviewpoint,whichofthefollowingareexamplesofsuperuseraccounts?
a.Rootandguestaccounts
b.Administratorandrootaccounts
c.Anonymousandrootaccounts
d.Temporaryandenduseraccounts
86.b.Superuseraccountsaretypicallydescribedasadministratororrootaccounts.Accesstosuperuseraccountsshouldbelimitedtodesignatedsecurityandsystem
administrationstaffonly,andnottotheenduseraccounts,guestaccounts,anonymousaccounts,ortemporaryaccounts.Securityandsystemadministrationstaffuse
thesuperuseraccountstoaccesskeysecurity/systemparametersandcommands.
87.Responsestounsuccessfulloginattemptsandsessionlocksareimplementedwithwhichofthefollowing?
a.Operatingsystemandfirmware
b.Applicationsystemandhardware
c.Operatingsystemandapplicationsystem
d.Hardwareandfirmware
87.c.Responsetounsuccessfulloginattemptscanbeimplementedatboththeoperatingsystemandtheapplicationsystemlevels.Thesessionlockisimplemented
typicallyattheoperatingsystemlevelbutmaybeattheapplicationsystemlevel.Hardwareandfirmwarearenotusedforunsuccessfulloginattemptsandsession
lock.
88.Whichofthefollowingstatementsisnottrueaboutasessionlockinaccesscontrol?
a.Asessionlockisasubstituteforloggingoutofthesystem.
b.Asessionlockcanbeactivatedonadevicewithadisplayscreen.
c.Asessionlockplacesapubliclyviewablepatternontothedevicedisplayscreen.
d.Asessionlockhideswhatwaspreviouslyvisibleonthedevicedisplayscreen.
88.a.Asessionlockpreventsfurtheraccesstoaninformationsystemafteradefinedtimeperiodofinactivity.Asessionlockisnotasubstituteforloggingoutofthe
systemasinloggingoutattheendoftheworkday.Theotherthreechoicesaretruestatementsaboutasessionlock.
89.Whichofthefollowinguseractionsarepermittedwithoutidentificationorauthentication?
1.Accesstopublicwebsites
2.Emergencysituations
3.Unsuccessfulloginattempts
4.Reestablishingasessionlock
a.1only
b.2only
c.1and2
d.3and4
89.c.Accesstopublicwebsitesandemergencysituationsareexamplesofuserpermittedactionsthatdon'trequireidentificationorauthentication.Bothunsuccessful
loginattemptsandreestablishingasessionlockrequireproperidentificationorauthenticationprocedures.Asessionlockisretaineduntilproperidentificationor
authenticationissubmitted,accepted,andreestablished.
90.Whichofthefollowingcircumstancesrequireadditionalsecurityprotectionsformobiledevicesafterunsuccessfulloginattempts?
a.Whenamobiledevicerequiresalogintoitself,andnotauseraccountonthedevice
b.Whenamobiledeviceisaccessingaremovablemediawithoutalogin
c.Wheninformationonthemobiledeviceisencrypted
d.Whentheloginismadetoanyoneaccountonthemobiledevice
90.a.Additionalsecurityprotectionisneededforamobiledevice(e.g.,PDA)requiringaloginwheretheloginismadetothemobiledeviceitself,nottoanyone
accountonthedevice.Additionalprotectionisnotneededwhenremovablemediaisaccessedwithoutaloginandwhentheinformationonthemobiledeviceis
encrypted.Asuccessfullogintoanyaccountonthemobiledeviceresetstheunsuccessfullogincounttozero.
91.Aninformationsystemdynamicallyreconfigureswithwhichofthefollowingasinformationiscreatedandcombined?
a.Securityattributesanddatastructures
b.Securityattributesandsecuritypolicies
c.Securityattributesandinformationobjects
d.Securityattributesandsecuritylabels
91.b.Aninformationsystemdynamicallyreconfiguressecurityattributesinaccordancewithanidentifiedsecuritypolicyasinformationiscreatedandcombined.The
systemsupportsandmaintainsthebindingofsecurityattributestoinformationinstorage,inprocess,andintransmission.Thetermsecuritylabelisoftenusedto
associateasetofsecurityattributeswithaspecificinformationobjectaspartofthedatastructures(e.g.,records,buffers,andfiles)forthatobject.
92.Foridentitymanagement,internationalstandardsdonotusewhichofthefollowingaccesscontrolpoliciesformakingaccesscontrol
decisions?
1.Discretionaryaccesscontrol(DAC)
2.Mandatoryaccesscontrol(MAC)
3.Identitybasedaccesscontrol(IBAC)
4.Rulebasedaccesscontrol(RuBAC)
a.1and2
b.1and3
c.2and3
d.3and4
92.a.InternationalstandardsforaccesscontroldecisionsdonotusetheU.S.baseddiscretionaryormandatoryaccesscontrolpolicies.Instead,theyuseidentitybased
andrulebasedaccesscontrolpolicies.
93.Whichofthefollowingisanexampleoflessthansecurenetworkingprotocolsforremoteaccesssessions?
a.Secureshell2
b.Virtualprivatenetworkwithblockingmodeenabled
c.Bulkencryption
d.Peertopeernetworkingprotocols
93.d.Anorganizationmustensurethatremoteaccesssessionsforaccessingsecurityfunctionsemploysecuritymeasuresandthattheyareaudited.Bulkencryption,
sessionlayerencryption,secureshell2(SSH2),andvirtualprivatenetworking(VPN)withblockingenabledarestandardsecuritymeasures.Bluetoothandpeerto
peer(P2P)networkingareexamplesoflessthansecurenetworkingprotocols.
94.Forwirelessaccess,inwhichofthefollowingwaysdoesanorganizationconfinewirelesscommunicationstoorganizationcontrolled
boundaries?
1.Reducingthepowerofthewirelesstransmissionandcontrollingwirelessemanations
2.Configuringthewirelessaccesspathsuchthatitispointtopointinnature
3.Usingmutualauthenticationprotocols
4.Scanningforunauthorizedwirelessaccesspointsandconnections
a.1only
b.3only
c.2and4
d.1,2,3,and4
94.d.Actionsthatmaybetakentoconfinewirelesscommunicationtoorganizationcontrolledboundariesincludeallthefouritemsmentioned.Mutualauthentication
protocolsincludeEAP/TLSandPEAP.Reducingthepowerofthewirelesstransmissionmeansthatthetransmissioncannotgobeyondthephysicalperimeterofthe
organization.ItalsoincludesinstallingTEMPESTmeasurestocontrolemanations.
95.Foraccesscontrolformobiledevices,whichofthefollowingassignsresponsibilityandaccountabilityforaddressingknown
vulnerabilitiesinthemedia?
a.Useofwritable,removablemedia
b.Useofpersonallyownedremovablemedia
c.Useofprojectownedremovablemedia
d.Useofnonownerremovablemedia
95.c. An identifiable owner (e.g., employee, organization, or project) for removable media helps to reduce the risk of using such technology by assigning
responsibility and accountability for addressing known vulnerabilities in the media (e.g., malicious code insertion). Use of projectowned removable media is
acceptablebecausethemediaisassignedtoaproject,andtheotherthreechoicesarenotacceptablebecausetheyhavenoaccountabilityfeatureattachedtothem.
Restrictingtheuseofwritable,removablemediaisagoodsecuritypractice.
96.Foraccesscontrolformobiledevices,whichofthefollowingactionscantriggeranincidentresponsehandlingprocess?
a.Useofexternalmodemsorwirelessinterfaceswithinthedevice
b.Connectionofunclassifiedmobiledevicestounclassifiedsystems
c.Useofinternalmodemsorwirelessinterfaceswithinthedevice
d.Connectionofunclassifiedmobiledevicestoclassifiedsystems
96.d.Whenunclassifiedmobiledevicesareconnectedtoclassifiedsystemscontainingclassifiedinformation,itisariskysituationbecauseasecuritypolicyis
violated.Thisactionshouldtriggeranincidentresponsehandlingprocess.Connectionofanunclassifiedmobiledevicetoanunclassifiedsystemstillrequiresan
approvalalthough,itislessrisky.Useofinternalorexternalmodemsorwirelessinterfaceswithinthemobiledeviceshouldbeprohibited.
97.Forleastfunctionality,organizationsutilizewhichofthefollowingtoidentifyandpreventtheuseofprohibitedfunctions,ports,protocols,
andservices?
1.Networkscanningtools
2.Intrusiondetectionandpreventionsystems
3.Firewalls
4.Hostbasedintrusiondetectionsystems
a.1and3
b.2and4
c.3and4
d.1,2,3,and4
97.d.Organizationscanutilizenetworkscanningtools,intrusiondetectionandpreventionsystems(IDPS),endpointprotectionssuchasfirewalls,andhostbased
intrusiondetectionsystemstoidentifyandpreventtheuseofprohibitedfunctions,ports,protocols,andservices.
98.Aninformationsystemusesmultifactorauthenticationmechanismstominimizepotentialrisksforwhichofthefollowingsituations?
1.Networkaccesstoprivilegedaccounts
2.Localaccesstoprivilegedaccounts
3.Networkaccesstononprivilegedaccounts
4.Localaccesstononprivilegedaccounts
a.1and2
b.1and3
c.3and4
d.1,2,3,and4
98.d.Aninformationsystemmustusemultifactorauthenticationmechanismsforbothnetworkaccess(privilegedandnonprivileged)andlocalaccess(privileged
andnonprivileged)becausebothsituationsarerisky.System/networkadministratorshaveadministrative(privileged)accounts,andtheseindividualshaveaccessto
asetofaccessrightsonagivensystem.Maliciousnonprivilegedaccountusersareasriskyasprivilegedaccountusersbecausetheycancausedamagetodataand
programfiles.
99.Whichofthefollowingstatementsisnottrueaboutidentificationandauthenticationrequirements?
a.Groupauthenticatorsshouldbeusedwithanindividualauthenticator
b.Groupauthenticatorsshouldbeusedwithauniqueauthenticator
c.Uniqueauthenticatorsingroupaccountsneedgreateraccountability
d.Individualauthenticatorsshouldbeusedatthesametimeasthegroupauthenticators
99.d.Youneedtorequirethatindividualsareauthenticatedwithanindividualauthenticatorpriortousingagroupauthenticator.Theotherthreechoicesaretrue
statements.
100.Whichofthefollowingcanpreventreplayattacksinanauthenticationprocessfornetworkaccesstoprivilegedandnonprivileged
accounts?
1.Nonces
2.Challenges
3.Timesynchronousauthenticators
4.Challengeresponseonetimeauthenticators
a.1and2
b.2and3
c.3and4
d.1,2,3,and4
100.d.Anauthenticationprocessresistsreplayattacksifitisimpracticaltoachieveasuccessfulauthenticationbyrecordingandreplayingapreviousauthentication
message.Techniquesusedtoaddressthereplayattacksincludeprotocolsthatusenoncesorchallenges(e.g.,TLS)andtimesynchronousorchallengeresponseone
timeauthenticators.
101.Fordeviceidentificationandauthentication,theauthenticationbetweendevicesandconnectionstonetworksisanexampleofa(n):
a.Bidirectionalauthentication
b.Groupauthentication
c.Deviceuniqueauthentication
d.Individualauthentication
101.a.Aninformationsystemauthenticatesdevicesbeforeestablishingremoteandwirelessnetworkconnectionsusingbidirectionalauthenticationbetweendevices
thatarecryptographicallybased.Examplesofdeviceidentifiersincludemediaaccesscontrol(MAC)addresses,IPaddresses,emailIDs,anddeviceuniquetoken
identifiers. Examples of device authenticators include digital/PKI certificates and passwords. The other three choices are not correct because they lack twoway
authentication.
102.Fordeviceidentificationandauthentication,dynamicaddressallocationprocessfordevicesisstandardizedwithwhichofthefollowing?
a.Dynamichostconfigurationprotocol
b.Dynamicauthentication
c.Dynamichypertextmarkuplanguage
d.Dynamicbinding
102.a.Fordynamicaddressallocationfordevices,dynamichostconfigurationprotocol(DHCP)enabledclientsobtainleasesforInternetProtocol(IP)addressesfrom
DHCPservers.Therefore,thedynamicaddressallocationprocessfordevicesisstandardizedwithDHCP.Theotherthreechoicesdonothavethecapabilitytoobtain
leasesforIPaddresses.
103.Foridentifiermanagement,serviceorientedarchitectureimplementationsdonotreplyonwhichofthefollowing?
a.Dynamicidentities
b.Dynamicattributesandprivileges
c.Preregisteredusers
d.Preestablishedtrustrelationships
103.c.Conventionalapproachestoidentificationsandauthenticationsemploystaticinformationsystemaccountsforknownpreregisteredusers.Serviceoriented
architecture(SOA)implementationsdonotrelyonstaticidentitiesbutdorelyonestablishingidentitiesatruntimeforentities(i.e.,dynamicidentities)thatwere
previouslyunknown.Dynamicidentitiesareassociatedwithdynamicattributesandprivilegesastheyrelyonpreestablishedtrustrelationships.
104.Forauthenticatormanagement,whichofthefollowingpresentsasignificantsecurityrisk?
a.Storedauthenticators
b.Defaultauthenticators
c.Reusedauthenticators
d.Refreshedauthenticators
104.b. Organizations should change the default authenticators upon information system installation or require vendors and/or manufacturers to provide unique
authenticatorspriortodelivery.Thisisbecausedefaultauthenticatorcredentialsareoftenwellknown,easilydiscoverable,andpresentasignificantsecurityrisk,and
therefore,shouldbechangeduponinstallation.Astoredorembeddedauthenticatorcanberiskydependingonwhetheritisencryptedorunencrypted.Bothreused
andrefreshedauthenticatorsarelessriskycomparedtodefaultandstoredauthenticatorsbecausetheyareunderthecontroloftheuserorganization.
105.Forauthenticatormanagement,useofwhichofthefollowingisriskyandleadstopossiblealternatives?
a.Asinglesignonmechanism
b.Sameuseridentifieranddifferentuserauthenticatorsonallsystems
c.Sameuseridentifierandsameuserauthenticatoronallsystems
d.Differentuseridentifiersanddifferentuserauthenticatorsoneachsystem
105.c.Examplesofuseridentifiersincludeinternalusers,contractors,externalusers,guests,passwords,tokens,andbiometrics.Examplesofuserauthenticators
includepasswords,PINs,tokens,biometrics,PKI/digitalcertificates,andkeycards.Whenanindividualhasaccountsonmultipleinformationsystems,thereisthe
riskthatifoneaccountiscompromisedandtheindividualusesthesameuseridentifierandauthenticator,otheraccountswillbecompromisedaswell.Possible
alternativesinclude(i)havingthesameuseridentifierbutdifferentauthenticatorsonallsystems,(ii)havingdifferentuseridentifiersanddifferentuserauthenticators
oneachsystem,(iii)employingasinglesignonmechanism,or(iv)havingonetimepasswordsonallsystems.
106.Forauthenticatormanagement,whichofthefollowingistheleastriskysituationwhencomparedtotheothers?
a.Authenticatorsembeddedinanapplicationsystem
b.Authenticatorsembeddedinaccessscripts
c.Authenticatorsstoredonfunctionkeys
d.Identifierscreatedatruntime
106.d.Itislessriskytodynamicallymanageidentifiers,attributes,andaccessauthorizations.Runtimeidentifiersarecreatedontheflyforpreviouslyunknown
entities.Informationsecuritymanagementshouldensurethatunencrypted,staticauthenticatorsarenotembeddedinapplicationsystemsoraccessscriptsornot
storedonfunctionkeys.Thisisbecausetheseapproachesarerisky.Here,theconcernistodeterminewhetheranembeddedorstoredauthenticatorisintheencrypted
orunencryptedform.
107.Whichofthefollowingaccessauthorizationpoliciesappliestowhenanorganizationhasalistofsoftwarenotauthorizedtoexecuteonan
informationsystem?
a.Denyall,permitbyexception
b.Allowall,denybyexception
c.Allowall,denybydefault
d.Denyall,acceptbypermission
107.a.Anorganizationemploysadenyall,permitbyexceptionauthorizationpolicytoidentifysoftwarenotallowedtoexecuteonthesystem.Theotherthree
choicesareincorrectbecausethecorrectanswerisbasedonspecificaccessauthorizationpolicy.
108.Encryptionisapartofwhichofthefollowing?
a.Directivecontrols
c.Detectivecontrols
108.b.Encryptionpreventsunauthorizedaccessandprotectsdataandprogramswhentheyareinstorage(atrest)orintransit.Preventivecontrolsdetersecurity
incidentsfromhappeninginthefirstplace.
109.Whichofthefollowingaccessauthorizationpoliciesappliestoexternalnetworksthroughmanagedinterfacesemployingboundary
protectiondevicessuchasgatewaysorfirewalls?
a.Denyall,permitbyexception
b.Allowall,denybyexception
c.Allowall,denybydefault
d.Denyall,acceptbypermission
109.a.Examplesofmanagedinterfacesemployingboundaryprotectiondevicesincludeproxies,gateways,routers,firewalls,hardware/softwareguards,andencrypted
tunnelsonademilitarizedzone(DMZ).Thispolicydenyall,permitbyexceptiondeniesnetworktrafficbydefaultandenablesnetworktrafficbyexceptiononly.
Theotherthreechoicesareincorrectbecausethecorrectanswerisbasedonspecificaccessauthorizationpolicy.Accesscontrollists(ACL)canbeappliedtotraffic
enteringtheinternalnetworkfromexternalsources.
110. Whichofthefollowingareneededwhentheenforcementofnormalsecuritypolicies,procedures,andrulesaredifficulttoimplement?
1.Compensatingcontrols
2.Closesupervision
3.Teamreviewofwork
4.Peerreviewofwork
a.1only
b.2only
c.1and2
d.1,2,3,and4
110.d. When the enforcement of normal security policies, procedures, and rules is difficult, it takes on a different dimension from that of requiring contracts,
separationofduties,andsystemaccesscontrols.Underthesesituations,compensatingcontrolsintheformofclosesupervision,followedbypeerandteamreviewof
qualityofworkareneeded.
111. Whichofthefollowingiscriticaltounderstandinganaccesscontrolpolicy?
a.Reachablestate
b.Protectionstate
c.Userstate
d.Systemstate
111.b.Aprotectionstateisthatpartofthesystemstatecriticaltounderstandinganaccesscontrolpolicy.Asystemmustbeeitherinaprotectionstateorreachable
state.Userstateisnotcriticalbecauseitistheleastprivilegedmode.
112. WhichofthefollowingshouldnotbeusedinKerberosauthenticationimplementation?
a.Dataencryptionstandard(DES)
b.Advancedencryptionstandard(AES)
c.Rivest,Shamir,andAdelman(RSA)
d.DiffieHellman(DH)
112.a.DESisweakandshouldnotbeusedbecauseofseveraldocumentedsecurityweaknesses.Theotherthreechoicescanbeused.AEScanbeusedbecauseitis
strong.RSAisusedinkeytransportwheretheauthenticationservergeneratestheusersymmetrickeyandsendsthekeytotheclient.DHisusedinkeyagreement
betweentheauthenticationserverandtheclient.
113. Fromanaccesscontroldecisionviewpoint,failuresduetoflawsinpermissionbasedsystemstendtodowhichofthefollowing?
a.Authorizepermissibleactions
b.Failsafewithpermissiondenied
c.Unauthorizeprohibitedactions
d.Grantunauthorizedpermissions
113.b.Whenfailuresoccurduetoflawsinpermissionbasedsystems,theytendtofailsafewithpermissiondenied.Therearetwotypesofaccesscontroldecisions:
permissionbasedandexclusionbased.
114. Hostandapplicationsystemhardeningproceduresareapartofwhichofthefollowing?
a.Directivecontrols
c.Detectivecontrols
114.b.Hostandapplicationsystemhardeningproceduresareapartofpreventivecontrols,astheyincludeantivirussoftware,firewalls,anduseraccountmanagement.
Preventivecontrolsdetersecurityincidentsfromhappeninginthefirstplace.
115. Fromanaccesscontroldecisionviewpoint,failsafedefaultsoperateonwhichofthefollowing?
1.Excludeanddeny
2.Permitandallow
3.Noaccess,yesdefault
4.Yesaccess,yesdefault
a.1only
b.2only
c.2and3
d.4only
115.c.Failsafedefaultsmeanthataccesscontroldecisionsshouldbebasedonpermitandallowpolicy(i.e.,permissionratherthanexclusion).Thisequatestothe
conditioninwhichlackofaccessisthedefault(i.e.,noaccess,yesdefault).Allowallanddenybydefaultreferstoyesaccess,yesdefaultsituations.
116. Forpasswordmanagement,automaticallygeneratedrandompasswordsusuallyprovidewhichofthefollowing?
1.Greaterentropy
2.Passwordsthatarehardforattackerstoguess
3.Strongerpasswords
4.Passwordsthatarehardforuserstoremember
a.2only
b.2and3
c.2,3,and4
d.1,2,3,and4
116.d.Automaticallygeneratedrandom(orpseudorandom)passwordsusuallyprovidegreaterentropy,arehardforattackerstoguessorcrack,strongerpasswords,
butatthesametimearehardforuserstoremember.
117. Inbiometricsbasedidentificationandauthenticationtechniques,whichofthefollowingindicatesthatsecurityisunacceptablyweak?
a.Lowfalseacceptancerate
b.Lowfalserejectionrate
c.Highfalseacceptancerate
d.Highfalserejectionrate
117.c.Thetrickisbalancingthetradeoffbetweenthefalseacceptancerate(FAR)andfalserejectionrate(FRR).AhighFARmeansthatsecurityisunacceptablyweak.
AFARistheprobabilitythatabiometricsystemcanincorrectlyidentifyanindividualorfailtorejectanimposter.TheFARgivennormallyassumespassiveimposter
attempts,andalowFARisbetter.TheFARisstatedastheratioofthenumberoffalseacceptancesdividedbythenumberofidentificationattempts.
AnFRRistheprobabilitythatabiometricsystemwillfailtoidentifyanindividualorverifythelegitimateclaimedidentityofanindividual.AlowFRRisbetter.
TheFRRisstatedastheratioofthenumberoffalserejectionsdividedbythenumberofidentificationattempts.
118. Inbiometricsbasedidentificationandauthenticationtechniques,whichofthefollowingindicatesthattechnologyusedinabiometric
systemisnotviable?
a.Lowfalseacceptancerate
b.Lowfalserejectionrate
c.Highfalseacceptancerate
d.Highfalserejectionrate
118.d. A high false rejection rate (FRR) means that the technology is creating a (PP) nuisance to falsely rejected users thereby undermining user acceptance and
questioningtheviabilityofthetechnologyused.Thiscouldalsomeanthatthetechnologyisobsolete,inappropriate,and/ornotmeetingtheuser'schangingneeds.
Afalseacceptancerate(FAR)istheprobabilitythatabiometricsystemwillincorrectlyidentifyanindividualorfailtorejectanimposter.TheFARgivennormally
assumespassiveimposterattempts,andalowFARisbetterandahighFARisanindicationofapoorlyoperatingbiometricsystem,notrelatedtotechnology.The
FARisstatedastheratioofthenumberoffalseacceptancesdividedbythenumberofidentificationattempts.
AFRRistheprobabilitythatabiometricsystemwillfailtoidentifyanindividualorverifythelegitimateclaimedidentityofanindividual.AlowFRRisbetter.The
FRRisstatedastheratioofthenumberoffalserejectionsdividedbythenumberofidentificationattempts.
119. Inbiometricsbasedidentificationandauthenticationtechniques,whatisacountermeasuretomitigatethethreatofidentityspoofing?
a.Livenessdetection
b.Digitalsignatures
c.Rejectingexactmatches
d.Sessionlock
119.a.Anadversarymaypresentsomethingotherthanhisownbiometrictotrickthesystemintoverifyingsomeoneelse'sidentity,knownasspoofing.Onetypeof
mitigationforanidentityspoofingthreatislivenessdetection(e.g.,pulseorlipreading).Theotherthreechoicescannotperformlivenessdetection.
120.Inbiometricsbasedidentificationandauthenticationtechniques,whatisacountermeasuretomitigatethethreatofimpersonation?
a.Livenessdetection
b.Digitalsignatures
d.Sessionlock
120.b.Attackerscanuseresidualdataonthebiometricreaderorinmemorytoimpersonatesomeonewhoauthenticatedpreviously.Cryptographicmethodssuchas
digitalsignaturescanpreventattackersfrominsertingorswappingbiometricdatawithoutdetection.Theotherthreechoicesdonotprovidecryptographicmeasures
topreventimpersonationattacks.
121.Inbiometricsbasedidentificationandauthenticationtechniques,whatisacountermeasuretomitigatethethreatofreplayattack?
a.Livenessdetection
b.Digitalsignatures
d.Sessionlock
121.c.Areplayattackoccurswhensomeonecancaptureavaliduser'sbiometricdataanduseitatalatertimeforunauthorizedaccess.Apotentialsolutionistoreject
exactmatches,therebyrequiringtheusertoprovideanotherbiometricsample.Theotherthreechoicesdonotprovideexactmatches.
122.Inbiometricsbasedidentificationandauthenticationtechniques,whatisacountermeasuretomitigatethethreatofasecuritybreachfrom
unsuccessfulauthenticationattempts?
a.Livenessdetection
b.Digitalsignatures
d.Sessionlock
122.d.Itisgoodtolimitthenumberofattemptsanyusercanunsuccessfullyattempttoauthenticate.Asessionlockshouldbeplacedwherethesystemlockstheuser
outandlogsasecurityeventwheneverauserexceedsacertainamountoffailedlogonattemptswithinaspecifiedtimeframe.
Theotherthreechoicescannotstopunsuccessfulauthenticationattempts.Forexample,ifanadversarycanrepeatedlysubmitfakebiometricdatahopingforanexact
match,itcreatesasecuritybreachwithoutasessionlock.Inaddition,rejectingexactmatchescreatesillwillwiththegenuineuser.
123.Inthesinglesignontechnology,timestampsthwartwhichofthefollowing?
a.Maninthemiddleattack
b.Replayattack
c.Socialengineeringattack
d.Phishingattack
123.b.Timestampsorothermechanismstothwartreplayattacksshouldbeincludedinthesinglesignon(SSO)credentialtransmissions.Maninthemiddle(MitM)
attacksarebasedonauthenticationandsocialengineering,andphishingattacksarebasedonpasswords.
124.Whichofthefollowingcorrectlyrepresentstheflowintheidentityandauthenticationprocessinvolvedintheelectronicauthentication?
a.Claimant AuthenticationProtocol Verifier
b.Claimant Authenticator Verifier
c.Verifier Claimant RelyingParty
d.Claimant Verifier RelyingParty
124.d. The party to be authenticated is called a claimant and the party verifying that identity is called a verifier. When a claimant successfully demonstrates
possessionandcontrolofatokeninanonlineauthenticationtoaverifierthroughanauthenticationprotocol,theverifiercanverifythattheclaimantisthesubscriber.
Theverifierpassesonanassertionabouttheidentityofthesubscribertotherelyingparty.Theverifiermustverifythattheclaimanthaspossessionandcontrolofthe
tokenthatverifieshisidentity.Aclaimantauthenticateshisidentitytoaverifierbytheuseofatokenandanauthenticationprotocol,calledproofofpossession
protocol.
Theotherthreechoicesareincorrectasfollows:
TheflowofauthenticationprocessinvolvingClaimant AuthenticationProtocol Verifier:Theauthenticationprocessestablishes

theidentityoftheclaimanttotheverifierwithacertaindegreeofassurance.Itisimplementedthroughanauthenticationprotocolmessage
exchange,aswellasmanagementmechanismsateachendthatfurtherconstrainorsecuretheauthenticationactivity.Oneormoreofthe
messagesoftheauthenticationprotocolmayneedtobecarriedonaprotectedchannel.
TheflowoftokensandcredentialsinvolvingClaimant Authenticator Verifier:Tokensgenerallyaresomethingtheclaimant

possessesandcontrolsthatmaybeusedtoauthenticatetheclaimant'sidentity.InEauthentication,theclaimantauthenticatestoasystemor
applicationoveranetworkbyprovingthathehaspossessionofatoken.Thetokenproducesanoutputcalledanauthenticatorandthisoutput
isusedintheauthenticationprocesstoprovethattheclaimantpossessesandcontrolsthetoken.
TheflowofassertionsinvolvingVerifier Claimant RelyingParty:Assertionsarestatementsfromaverifiertoarelyingpartythat

containinformationaboutasubscriber(claimant).Assertionsareusedwhentherelyingpartyandtheverifierarenotcollocated(e.g.,theyare
connectedthroughasharednetwork).Therelyingpartyusestheinformationintheassertiontoidentifytheclaimantandmakeauthorization
decisionsabouthisaccesstoresourcescontrolledbytherelyingparty.
125.WhichofthefollowingauthenticationtechniquesisappropriateforaccessingnonsensitiveITassetswithmultipleusesofthesame
authenticationfactor?
a.Singlefactorauthentication
b.Twofactorauthentication
c.Threefactorauthentication
d.Multifactorauthentication
125.a.Multipleusesofthesameauthenticationfactor(e.g.,usingthesamepasswordmorethanonce)isappropriateforaccessingnonsensitiveITassetsandisknown
asasinglefactorauthentication.Theotherthreefactorsarenotneededforauthenticationoflowsecurityriskandnonsensitiveassets.
126.Fromanaccesscontroleffectivenessviewpoint,whichofthefollowingrepresentsbiometricverificationwhenausersubmitsacombination
ofapersonalidentificationnumber(PIN)firstandbiometricsamplenextforauthentication?
a.Onetoonematching
b.Onetomanymatching
c.Manytoonematching
d.Manytomanymatching
126.a.Thiscombinationofauthenticationrepresentssomethingthatyouknow(PIN)andsomethingthatyouare(biometric).Attheauthenticationsystemprompt,
theuserentersthePINandthensubmitsabiometriclivecapturedsample.Thesystemcomparesthebiometricsampletothebiometricreferencedataassociatedwith
thePINentered,whichisaonetoonematchingofbiometricverification.Theotherthreechoicesareincorrectbecausethecorrectanswerisbasedonitsdefinition.
127.Fromanaccesscontroleffectivenessviewpoint,whichofthefollowingrepresentsbiometricidentificationwhenausersubmitsa
combinationofabiometricsamplefirstandapersonalidentificationnumber(PIN)nextforauthentication?
a.Onetoonematching
b.Onetomanymatching
c.Manytoonematching
127.b.Thiscombinationofauthenticationrepresentssomethingthatyouknow(PIN)andsomethingthatyouare(biometric).Theuserpresentsabiometricsample
firsttothesensor,andthesystemconductsaonetomanymatchingofbiometricidentification.TheuserispromptedtosupplyaPINthatprovidedthebiometric
referencedata.Theotherthreechoicesareincorrectbecausethecorrectanswerisbasedonitsdefinition.
128.Duringbiometricidentification,whichofthefollowingcanresultinslowsystemresponsetimesandincreasedexpense?
a.Onetoonematching
b.Onetomanymatching
c.Manytoonematching
128.b.Thebiometricidentificationwithonetomanymatchingcanresultinslowsystemresponsetimesandcanbemoreexpensivedependingonthesizeofthe
biometric database. That is, the larger the database size, the slower the system response time. A personal identification number (PIN) is entered as a second
authenticationfactor,andthematchingisslow.
129.Duringbiometricverification,whichofthefollowingcanresultinfastersystemresponsetimesandcanbelessexpensive?
a.Onetoonematching
b.Onetomanymatching
c.Manytoonematching
129.a.Thebiometricverificationwithonetoonematchingcanresultinfastersystemresponsetimesandcanbelessexpensivebecausethepersonalidentification
number(PIN)isenteredasafirstauthenticatorandthematchingisquick.
130.Fromanaccesscontroleffectivenessviewpoint,whichofthefollowingisrepresentedwhenausersubmitsacombinationofhardware
tokenandapersonalidentificationnumber(PIN)forauthentication?
1.Aweakformoftwofactorauthentication
2.Astrongformoftwofactorauthentication
3.Supportsphysicalaccess
4.Supportslogicalaccess
a.1only
b.2only
c.1and3
d.2and4
130.c.Thiscombinationrepresentssomethingthatyouhave(i.e.,hardwaretoken)andsomethingthatyouknow(i.e.,PIN).Thehardwaretokencanbelostorstolen.
Therefore,thisisaweakformoftwofactorauthenticationthatcanbeusedtosupportunattendedaccesscontrolsforphysicalaccessonly.Logicalaccesscontrolsare
softwarebasedandassuchdonotsupportahardwaretoken.
131.Fromanaccesscontroleffectivenessviewpoint,whichofthefollowingisrepresentedwhenausersubmitsacombinationofpublickey
infrastructure(PKI)keysandapersonalidentificationnumber(PIN)forauthentication?
1.Aweakformoftwofactorauthentication
2.Astrongformoftwofactorauthentication
3.Supportsphysicalaccess
4.Supportslogicalaccess
a.1only
b.2only
c.1and3
d.2and4
131.d.Thiscombinationrepresentssomethingthatyouhave(i.e.,PKIkeys)andsomethingthatyouknow(i.e.,PIN).Thereisnohardwaretokentoloseorsteal.
Therefore,thisisastrongformoftwofactorauthenticationthatcanbeusedtosupportlogicalaccess.
132.RuBACisrulebasedaccesscontrol,ACLisaccesscontrollist,IBACisidentitybasedaccesscontrol,DACisdiscretionaryaccesscontrol,
andMACismandatoryaccesscontrol.Foridentitymanagement,whichofthefollowingequatestheaccesscontrolpoliciesanddecisions
betweentheU.S.terminologyandtheinternationalstandards?
1.RuBAC=ACL
2.IBAC=ACL
3.IBAC=DAC
4.RuBAC=MAC
a.1only
b.2only
c.3only
d.3and4
132.d.Identitybasedaccesscontrol(IBAC)anddiscretionaryaccesscontrol(DAC)areconsideredequivalent.Therulebasedaccesscontrol(RuBAC)andmandatory
accesscontrol(MAC)areconsideredequivalent.IBACusesaccesscontrollists(ACLs)whereasRuBACdoesnot.
133.Foridentitymanagement,mostnetworkoperatingsystemsarebasedonwhichofthefollowingaccesscontrolpolicy?
b.Identitybasedaccesscontrol(IBAC)
d.Attributebasedaccesscontrol(ABAC)
133.b.Mostnetworkoperatingsystemsareimplementedwithanidentitybasedaccesscontrol(IBAC)policy.Entitiesaregrantedaccesstoresourcesbasedonany
identityestablishedduringnetworklogon,whichiscomparedwithoneormoreaccesscontrollists(ACLs).Theselistsmaybeindividuallyadministered,maybe
centrally administered and distributed to individual locations, or may reside on one or more central servers. Attributebased access control (ABAC) deals with
subjectsandobjects,rulebased(RuBAC)dealswithrules,androlebased(RBAC)dealswithrolesorjobfunctions.
134.RBACisrolebasedaccesscontrol,MACismandatoryaccesscontrol,DACisdiscretionaryaccesscontrol,ABACisattributebasedaccess
control,PBACispolicybasedaccesscontrol,IBACisidentitybasedaccesscontrol,RuBACisrulebasedaccesscontrol,RAdACisrisk
adaptiveaccesscontrol,andUDACisuserdirectedaccesscontrol.Foridentitymanagement,RBACpolicyisdefinedaswhichofthe
following?
a.RBAC=MAC+DAC
b.RBAC=ABAC+PBAC
c.RBAC=IBAC+RuBAC
d.RBAC=RAdAC+UDAC
134.c.Rolebasedaccesscontrolpolicy(RBAC)isacompositeaccesscontrolpolicybetweenidentitybasedaccesscontrol(IBAC)policyandrulebasedaccess
control(RuBAC)policyandshouldbeconsideredasavariantofboth.Inthiscase,anidentityisassignedtoagroupthathasbeengrantedauthorizations.Identities
canbemembersofoneormoregroups.
135.Acombinationofsomethingyouhave(onetime),somethingyouhave(secondtime),andsomethingyouknowisusedtorepresentwhich
ofthefollowingpersonalauthenticationproofingscheme?
a.Onefactorauthentication
d.Fourfactorauthentication
135.b.Thissituationillustratesthatmultipleinstancesofthesamefactor(i.e.,somethingyouhaveisusedtwotimes)resultsinonefactorauthentication.Whenthis
iscombinedwithsomethingyouknow,itresultsinatwofactorauthenticationscheme.
136.Remoteaccesscontrolsareapartofwhichofthefollowing?
a.Directivecontrols
c.Detectivecontrols
136.b.Remoteaccesscontrolsareapartofpreventivecontrols,astheyincludeInternetProtocol(IP)packetfilteringbyborderroutersandfirewallsusingaccess
controllists.Preventivecontrolsdetersecurityincidentsfromhappeninginthefirstplace.
137.Whatisusingtwodifferentpasswordsforaccessingtwodifferentsystemsinthesamesessioncalled?
137.b. Requiring two different passwords for accessing two different systems in the same session is more secure than requiring one password for two different
systems.Thisequatestotwofactorauthentication.Requiringmultipleproofsofauthenticationpresentsmultiplebarrierstoentryaccessbyintruders.Ontheother
hand,usingthesamepassword(onefactor)foraccessingmultiplesystemsinthesamesessionisaonefactorauthentication,becauseonlyonetype(andthesame
type)ofproofisused.Thekeypointiswhetherthetypeofproofpresentedissameordifferent.
138.Whatisusingapersonalidentitycardwithattendedaccess(e.g.,asecurityguard)andaPINcalled?
138.b.Onthesurface,thissituationmayseemathreefactorauthentication,butinrealityitisatwofactorauthentication,becauseonlyacard(proofofonefactor)and
PIN(proofofsecondfactor)areused,resultinginatwofactorauthentication.Notethatitisnotthestrongesttwofactorauthenticationbecauseoftheattendedaccess.
Asecurityguardisanexampleofattendedaccess,whoischeckingforthevalidityofthecard,andiscountedasonefactorauthentication.Otherexamplesofattended
accessincludepeers,colleagues,andsupervisorswhowillvouchfortheidentifyofavisitorwhoisaccessingphysicalfacilities.
139.Atruckdriver,whoisanemployeeofadefensecontractor,transportshighlysensitivepartsandcomponentsfromadefensecontractor's
manufacturingplanttoamilitaryinstallationatahighlysecurelocation.Themilitary'sreceivingdepartmenttracksthedriver'sphysical
locationtoensurethattherearenosecurityproblemsonthewaytotheinstallation.Uponarrivalattheinstallation,thetruckdrivershows
hisemployeebadgewithphotoIDissuedbythedefensecontractor,entershispasswordandPIN,andtakesabiometricsampleofhis
fingerprintpriortoenteringtheinstallationandunloadingthetruck'scontent.Whatdoesthisdescribedscenariorepresents?
139.d.Trackingthedriver'sphysicallocation(perhapswithGPSorwirelesssensornetwork)isanexampleofsomewhereyouare(proofoffirstfactor).Showingthe
employeeaphysicalbadgewithphotoIDisanexampleofsomethingyouhave(proofofsecondfactor).EnteringapasswordandPINisanexampleofsomethingyou
know(proofofthirdfactor).Takingabiometricsampleoffingerprintisanexampleofsomethingyouare(proofoffourthfactor).Therefore,thisscenariorepresentsa
fourfactorauthentication.Thekeypointisthatitdoesnotmatterwhethertheproofpresentedisoneitemormoreitemsinthesamecategory(e.g,somewhereyouare,
somethingyouhave,somethingyouknow,andsomethingyouare).
140.Whichofthefollowingisachievedwhentwoauthenticationproofsofsomethingthatyouhaveisimplemented?
a.Leastassurance
b.Increasedassurance
c.Maximumassurance
d.Equivalentassurance
140.a.Leastassuranceisachievedwhentwoauthenticationproofsofsomethingthatyouhave(e.g.,card,key,andmobileIDdevice)areimplementedbecausethecard
andthekeycanbelostorstolen.Consequently,multipleusesofsomethingthatyouhaveofferlesseraccesscontrolassurancethanusingacombinationofmultifactor
authenticationtechniques.Equivalentassuranceisneutralanddoesnotrequireanyfurtheraction.
141.Whichofthefollowingisachievedwhentwoauthenticationproofsofsomethingthatyouknowareimplemented?
a.Leastassurance
c.Maximumassurance
141.b.Increasedassuranceisachievedwhentwoauthenticationproofsofsomethingthatyouknow(e.g.,usingtwodifferentpasswordswithorwithoutPINs)are
implemented.Multipleproofsofsomethingthatyouknowoffergreaterassurancethandoesmultipleproofsofsomethingthatyouhave.However,multipleusesof
somethingthatyouknowprovideequivalentassurancetoacombinationofmultifactorauthenticationtechniques.
142.Whichofthefollowingisachievedwhentwoauthenticationproofsofsomethingthatyouareisimplemented?
a.Leastassurance
c.Maximumassurance
142.c.Maximumassuranceisachievedwhentwoauthenticationproofsofsomethingthatyouare(e.g.,personalrecognitionbyacolleague,user,orguard,anda
biometricverificationcheck)areimplemented.Multipleproofsofsomethingthatyouareofferthegreatestassurancethandoesmultipleproofsofsomethingthatyou
haveorsomethingthatyouknow,usedeitheraloneorcombined.Equivalentassuranceisneutralanddoesnotrequireanyfurtheraction.
143.Forkeyfunctionsofintrusiondetectionandpreventionsystem(IDPS)technologies,whichofthefollowingisreferredtowhenanIDPS
configurationisaltered?
a.Tuning
b.Evasion
c.Blocking
d.Normalization
143.a.Alteringtheconfigurationofanintrusiondetectionandpreventionsystem(IDPS)toimproveitsdetectionaccuracyisknownastuning.IDPStechnologies
cannotprovidecompletelyaccuratedetectionatalltimes.AccesstothetargetedhostisblockedfromtheoffendinguseraccountorIPaddress.
Evasionismodifyingtheformatortimingofmaliciousactivitysothatitsappearancechangesbutitseffectisthesame.Attackersuseevasiontechniquestotryto
prevent intrusion detection and prevention system (IDPS) technologies from detecting their attacks. Most IDPS technologies can overcome common evasion
techniquesbyduplicatingspecialprocessingperformedbythetargetedhost.IftheIDPSconfigurationissameasthetargetedhost,thenevasiontechniqueswillbe
unsuccessfulathidingattacks.
Someintrusionpreventionsystem(IPS)technologiescanremoveorreplacemaliciousportionsofanattacktomakeitbenign.AcomplexexampleisanIPSthatactsas
aproxyandnormalizesincomingrequests,whichmeansthattheproxyrepackagesthepayloadsoftherequests,discardingheaderinformation.Thismightcause
certainattackstobediscardedaspartofthenormalizationprocess.
144.Areuseofauser'soperatingsystempasswordforprebootauthenticationshouldnotbepracticedinthedeploymentofwhichofthe
followingstorageencryptionauthenticationproducts?
a.Fulldiskencryption
b.Volumeencryption
c.Virtualdiskencryption
d.File/folderencryption
144.a.Reusingauser'operatingsystempasswordforprebootauthenticationinafull(whole)diskencryptiondeploymentwouldallowanattackertolearnonlya
singlepasswordtogainfullaccesstothedevice'sinformation.Thepasswordcouldbeacquiredthroughtechnicalmethods,suchasinfectingthedevicewithmalware,
orthroughphysicalmeans,suchaswatchingausertypeinapasswordinapubliclocation.Thecorrectchoiceisriskycomparedtotheincorrectchoicesbecausethe
latterdonotdealwithbootingacomputerorprebootauthentication.
145.Allthefollowingstorageencryptionauthenticationproductsmayusetheoperatingsystem'sauthenticationforsinglesignonexcept:
a.Fulldiskencryption
b.Volumeencryption
c.Virtualdiskencryption
d.File/folderencryption
145.a.Productssuchasvolumeencryption,virtualdiskencryption,orfile/folderencryptionmayusetheoperatingsystem'sauthenticationforsinglesignon(SSO).
Afterauserauthenticatestotheoperatingsystematlogintime,theusercanaccesstheencryptedfilewithoutfurtherauthentication,whichisrisky.Youshouldnot
usethesamesinglefactorauthenticatorformultiplepurposes.Afulldiskencryptionprovidesbettersecuritythantheotherthreechoicesbecausetheentirediskis
encrypted,asopposedtopartofit.
146.Whichofthefollowingsecuritymechanismsforhighriskstorageencryptionauthenticationproductsprovidesprotectionagainst
authenticationguessingattemptsandfavorssecurityoverfunctionality?
a.Alertconsecutivefailedloginattempts.
b.Lockthecomputerforaspecifiedperiodoftime.
c.Increasethedelaybetweenattempts.
d.Deletetheprotecteddatafromthedevice.
146.d.Forhighsecuritysituations,storageencryptionauthenticationproductscanbeconfiguredsothattoomanyfailedattemptscausetheproducttodeleteallthe
protecteddatafromthedevice.Thisapproachstronglyfavorssecurityoverfunctionality.Theotherthreechoicescanbeusedforlowsecuritysituations.
147.Recoverymechanismsforstorageencryptionauthenticationsolutionsrequirewhichofthefollowing?
a.Atradeoffbetweenconfidentialityandsecurity
b.Atradeoffbetweenintegrityandsecurity
c.Atradeoffbetweenavailabilityandsecurity
d.Atradeoffbetweenaccountabilityandsecurity
147.c.Recoverymechanismsincreasetheavailabilityofthestorageencryptionauthenticationsolutionsforindividualusers,buttheycanalsoincreasethelikelihood
thatanattackercangainunauthorizedaccesstoencryptedstoragebyabusingtherecoverymechanism.Therefore,informationsecuritymanagementshouldconsider
thetradeoffbetweenavailabilityandsecuritywhenselectingandplanningrecoverymechanisms.Theotherthreechoicesdonotproviderecoverymechanisms.
148.Foridentitymanagement,whichofthefollowingrequiresmultifactorauthentication?
a.Usertohostarchitecture
b.Peertopeerarchitecture
c.Clienthosttoserverarchitecture
d.Trustedthirdpartyarchitecture
148.a.Whenauserlogsontoahostcomputerorworkstation,theusermustbeidentifiedandauthenticatedbeforeaccesstothehostornetworkisgranted.This
processrequiresamechanismtoauthenticatearealpersontoamachine.Thebestmethodsofdoingthisinvolvemultipleformsofauthenticationwithmultiple
factors,suchassomethingyouknow(password),somethingyouhave(physicaltoken),andsomethingyouare(biometricverification).Theotherthreechoicesdonot
requiremultifactorauthenticationbecausetheyusedifferentauthenticationmethods.
Peertopeer architecture, sometimes referred to as mutual authentication protocol, involves the direct communication of authentication information between the
communicatingentities(e.g.,peertopeerorclienthosttoserver).
Thearchitecturefortrustedthirdparty(TTP)authenticationusesathirdentity,trustedbyallentities,toprovideauthenticationinformation.Theamountoftrust
giventhethirdentitymustbeevaluated.MethodstoestablishandmaintainaleveloftrustinaTTPincludecertificationpracticestatements(CPS)thatestablishes
rules,processes,andproceduresthatacertificateauthority(CA)usestoensuretheintegrityoftheauthenticationprocessanduseofsecureprotocolstointerfacewith
authenticationservers.ATTPmayprovideauthenticationinformationineachinstanceofauthentication,inrealtime,orasaprecursortoanexchangewithaCA.
149.Forpasswordmanagement,whichofthefollowingensurespasswordstrength?
a.Passwordswithmaximumkeyspace,shorterpassphrases,lowentropy,andsimplepassphrases
b.Passwordswithbalancedkeyspace,longerpassphrases,highentropy,andcomplexpassphrases
c.Passwordswithminimumkeyspace,shorterpassphrases,highentropy,andsimplepassphrases
d.Passwordswithmostlikelykeyspace,longerpassphrases,lowentropy,andcomplexpassphrases
149.b.Passwordstrengthisdeterminedbyapassword'slengthanditscomplexity,whichisdeterminedbytheunpredictabilityofitscharacters.Passwordsbasedon
patternssuchaskeyspacemaymeetpasswordcomplexityandlengthrequirement,buttheysignificantlyreducethekeyspacebecauseattackersareawareofthese
patterns.Theidealkeyspaceisabalancedonebetweenmaximum,mostlikely,andminimumscenarios.Simpleandshortpassphraseshavelowentropybecausethey
consist of concatenated dictionary words, which are easy to guess and attack. Therefore, passphrases should be complex and longer to provide high entropy.
Passwordswithbalancedkeyspace,longerpassphrases,highentropy,andcomplexpassphrasesensurepasswordstrength.
150.Regardingpasswordmanagement,whichofthefollowingenforcespasswordstrengthrequirementseffectively?
a.Educateusersonpasswordstrength.
b.Runapasswordcrackerprogramtoidentifyweakpasswords.
c.Performacrackingoperationoffline.
d.Useapasswordfilterutilityprogram.
150.d.Onewaytoensurepasswordstrengthistoaddapasswordfilterutilityprogram,whichisspecificallydesignedtoverifythatapasswordcreatedbyauser
complieswiththepasswordpolicy.Addingapasswordfilterisamorerigorousandproactivesolution,whereastheotherthreechoicesarelessrigorousandreactive
solutions.
Thepasswordfilterutilityprogramisalsoreferredtoasapasswordcomplexityenforcementprogram.
151.Whichofthefollowingcontrolsovertelecommutingusetokensand/oronetimepasswords?
a.Firewalls
b.Robustauthentication
c.Portprotectiondevices
d.Encryption
151.b.Robustauthenticationincreasessecurityintwosignificantways.Itcanrequiretheusertopossessatokeninadditiontoapasswordorpersonalidentification
number(PIN).Tokens,whenusedwithPINs,providesignificantlymoresecuritythanpasswords.Forahackerorotherwouldbeimpersonatortopretendtobe
someoneelse,theimpersonatormusthavebothavalidtokenandthecorrespondingPIN.ThisismuchmoredifficultthanobtainingavalidpasswordanduserID
combination.Robustauthenticationcanalsocreateonetimepasswords.Electronicmonitoring(eavesdroppingorsniffing)orobservingausertypeinapasswordis
notathreatwithonetimepasswordsbecauseeachtimeauserisauthenticatedtothecomputer,adifferentpasswordisused.(Ahackercouldlearntheonetime
passwordthroughelectronicmonitoring,butitwouldbeofnovalue.)
Thefirewallisincorrectbecauseitusesasecuregatewayorseriesofgatewaystoblockorfilteraccessbetweentwonetworks,oftenbetweenaprivatenetworkanda
larger,morepublicnetworksuchastheInternetorpublicswitchednetwork(e.g.,thetelephonesystem).Firewalldoesnotusetokensandpasswordsasmuchas
robustauthentication.
Aportprotectiondevice(PPD)isincorrectbecauseitisfittedtoacommunicationsportofahostcomputerandauthorizesaccesstotheportitself,priortoand
independent of the computer's own access control functions. A PPD can be a separate device in the communications stream or may be incorporated into a
communicationsdevice(e.g.amodem).PPDstypicallyrequireaseparateauthenticator,suchasapassword,toaccessthecommunicationsport.Oneofthemost
commonPPDsisthedialbackmodem.PPDdoesnotusetokensandpasswordsasmuchasrobustauthentication.
Encryptionisincorrectbecauseitismoreexpensivethanrobustauthentication.Itismostusefulifhighlyconfidentialdataneedstobetransmittedorifmoderately
confidentialdataistransmittedinahighthreatarea.Encryptionismostwidelyusedtoprotecttheconfidentialityofdataanditsintegrity(itdetectschangestofiles).
Encryptiondoesnotusetokensandpasswordsasmuchasrobustauthentication.
152.Whichofthefollowingstatementsaboutanaccesscontrolsystemisnottrue?
a.Itistypicallyenforcedbyaspecificapplication.
b.Itindicateswhataspecificusercouldhavedone.
c.Itrecordsfailedattemptstoperformsensitiveactions.
d.Itrecordsfailedattemptstoaccessrestricteddata.
152.a.Someapplicationsuseaccesscontrol(typicallyenforcedbytheoperatingsystem)torestrictaccesstocertaintypesofinformationorapplicationfunctions.
Thiscanbehelpfultodeterminewhataparticularapplicationusercouldhavedone.Someapplicationsrecordinformationrelatedtoaccesscontrol,suchasfailed
attemptstoperformsensitiveactionsoraccessrestricteddata.
153.Whatoccursinamaninthemiddle(MitM)attackonanelectronicauthenticationprotocol?
1.Anattackerposesastheverifiertotheclaimant.
2.Anattackerposesastheclaimanttotheverifier.
3.AnattackerposesastheCAtoRA.
4.AnattackerposesastheRAtoCA.
a.1only
b.3only
c.4only
d.1and2
153.b.Inamaninthemiddle(MitM)attackonanauthenticationprotocol,theattackerinterposeshimselfbetweentheclaimantandverifier,posingastheverifierto
the claimant, and as the claimant to the verifier. The attacker thereby learns the value of the authentication token. Registration authority (RA) and certification
authority(CA)hasnorolesintheMitMattack.
154.Whichofthefollowingisnotapreventivemeasureagainstnetworkintrusionattacks?
a.Firewalls
b.Auditing
c.Systemconfiguration
d.Intrusiondetectionsystem
154.b.Auditingisadetectionactivity,notapreventivemeasure.Examplesofpreventivemeasurestomitigatetherisksofnetworkintrusionattacksincludefirewalls,
systemconfiguration,andintrusiondetectionsystem.
155.Smartcardauthenticationisanexampleofwhichofthefollowing?
a.Proofbyknowledge
b.Proofbyproperty
c.Proofbypossession
d.Proofofconcept
155.c.Smartcardsarecreditcardsizeplasticcardsthathostanembeddedcomputerchipcontaininganoperatingsystem,programs,anddata.Smartcardauthentication
isperhapsthebestknownexampleofproofbypossession(e.g.,key,card,ortoken).Passwordsareanexampleofproofbyknowledge.Fingerprintsareanexampleof
proofbyproperty.Proofofconceptdealswithtestingaproductpriortobuildinganactualproduct.
156.Fortokenthreatsinelectronicauthentication,countermeasuresusedforwhichoneofthefollowingthreatsaredifferentfromtheother
threethreats?
a.Onlineguessing
b.Eavesdropping
c.Phishingandpharming
d.Socialengineering
156.a.Inelectronicauthentication,acountermeasureagainstthetokenthreatofonlineguessingusestokensthatgeneratehighentropyauthenticators.Common
countermeasuresagainstthethreatslistedintheotherthreechoicesarethesameandtheydonotusehighentropyauthenticators.Thesecommoncountermeasures
include(i)useoftokenswithdynamicauthenticatorswhereknowledgeofoneauthenticatordoesnotassistinderivingasubsequentauthenticatorand(ii)useof
tokensthatgenerateauthenticatorsbasedonatokeninputvalue.
157.Whichofthefollowingisacomponentthatprovidesasecurityserviceforasmartcardapplicationusedinamobiledeviceauthentication?
a.Challengeresponseprotocol
b.Serviceprovider
c.Resourcemanager
d.Driverforthesmartcardreader
157.a. The underlying mechanism used to authenticate users via smart cards relies on a challengeresponse protocol between the device and the smart card. For
example, a personal digital assistant (PDA) challenges the smart card for an appropriate and correct response that can be used to verify that the card is the one
originallyenrolledbythePDAdeviceowner.Thechallengeresponseprotocolprovidesasecurityservice.Thethreemainsoftwarecomponentsthatsupportasmart
cardapplicationincludetheserviceprovider,aresourcemanager,andadriverforthesmartcardreader.
158.Whichofthefollowingisnotasophisticatedtechnicalattackagainstsmartcards?
a.Reverseengineering
b.Faultinjection
c.Signalleakage
d.Impersonating
158.d.Foruserauthentication,thefundamentalthreatisanattackerimpersonatingauserandgainingcontrolofthedeviceanditscontents.Ofallthefourchoices,
impersonating is a nonsophisticated technical attack. Smart cards are designed to resist tampering and monitoring of the card, including sophisticated technical
attacksthatinvolvereverseengineering,faultinjection,andsignalleakage.
159.Whichofthefollowingisanexampleofnonpolledauthentication?
a.Smartcard
b.Password
c.Memorytoken
d.Communicationssignal
159.b.Nonpolledauthenticationisdiscreteaftertheverdictisdetermined,itisinviolateuntilthenextauthenticationattempt.Examplesofnonpolledauthentication
include password, fingerprint, and voice verification. Polled authentication is continuous the presence or absence of some token or signal determines the
authenticationstatus.Examplesofpolledauthenticationincludesmartcard,memorytoken,andcommunicationssignal,wherebytheabsenceofthedeviceorsignal
triggersanonauthenticatedcondition.
160.Whichofthefollowingdoesnotcomplementintrusiondetectionsystems(IDS)?
a.Honeypots
b.Inferencecells
c.Paddedcells
d.Vulnerabilityassessmenttools
160.b.Honeypotsystems,paddedcellsystems,andvulnerabilityassessmenttoolscomplementIDStoenhanceanorganization'sabilitytodetectintrusion.Inference
cellsdonotcomplementIDS.Ahoneypotsystemisahostcomputerthatisdesignedtocollectdataonsuspiciousactivityandhasnoauthorizedusersotherthan
security administrators and attackers. Inference cells lead to an inference attack when a user or intruder is able to deduce privileged information from known
information.Inpaddedcellsystems,anattackerisseamlesslytransferredtoaspecialpaddedcellhost.Vulnerabilityassessmenttoolsdeterminewhenanetworkor
hostisvulnerabletoknownattacks.
161.Sniffingprecedeswhichofthefollowing?
a.Phishingandpharming
b.Spoofingandhijacking
c.Snoopingandscanning
d.Crackingandscamming
161.b.Sniffingisobservingandmonitoringpacketspassingbyonthenetworktrafficusingpacketsniffers.Sniffingprecedeseitherspoofingorhijacking.Spoofing,
inpart,isusingvarioustechniquestosubvertIPbasedaccesscontrolbymasqueradingasanothersystembyusingtheirIPaddress.Spoofingisanattempttogain
accesstoasystembyposingasanauthorizeduser.OtherexamplesofspoofingincludespoofingpacketstohidetheoriginofattackinaDoS,spoofingemailheaders
tohidespam,andspoofingphonenumberstofoolcallerID.Spoofingissynonymouswithimpersonating,masquerading,ormimicking,andisnotsynonymouswith
sniffing.Hijackingisanattackthatoccursduringanauthenticatedsessionwithadatabaseorsystem.
Snooping,scanning,andsniffingareallactionssearchingforrequiredandvaluableinformation.Theyinvolvelookingaroundforvulnerabilitiesandplanningto
attack.Thesearepreparatoryactionspriortolaunchingseriouspenetrationattacks.
Phishingistrickingindividualsintodisclosingsensitivepersonalinformationthroughdeceptivecomputerbasedmeans.Phishingattacksusesocialengineeringand
technicalsubterfugetostealconsumers'personalidentitydataandfinancialaccountcredentials.ItinvolvesInternetfraudsterswhosendspamorpopupmessagesto
lurepersonalinformation(e.g.,creditcardnumbers,bankaccountinformation,socialsecuritynumber,passwords,orothersensitiveinformation)fromunsuspecting
victims.Pharmingismisdirectinguserstofraudulentwebsitesorproxyservers,typicallythroughDNShijackingorpoisoning.
Crackingisbreakingforpasswordsandbypassingsoftwarecontrolsinanelectronicauthenticationsystemsuchasuserregistration.Scammingisimpersonatinga
legitimatebusinessusingtheInternet.Thebuyershouldcheckoutthesellerbeforebuyinggoodsorservices.Thesellershouldgiveoutaphysicaladdresswitha
workingtelephonenumber.
162.Passwordsandpersonalidentificationnumbers(PINs)areexamplesofwhichofthefollowing?
a.Proceduralaccesscontrols
b.Physicalaccesscontrols
c.Logicalaccesscontrols
d.Administrativeaccesscontrols
162.c.Logical,physical,andadministrativecontrolsareexamplesofaccesscontrolmechanisms.Passwords,PINs,andencryptionareexamplesoflogicalaccess
controls.
163.Whichofthefollowingstatementsisnottrueabouthoneypots'logs?
a.Honeypotsaredeceptivemeasures.
b.Honeypotscollectdataonindications.
c.Honeypotsarehoststhathavenoauthorizedusers.
d.Honeypotsareasupplementtoproperlysecuringnetworks,systems,andapplications.
163.b.Honeypotsaredeceptivemeasurescollectingbetterdataonprecursors,notonindications.Aprecursorisasignthatanincidentmayoccurinthefuture.An
indicationisasignthatanincidentmayhaveoccurredormaybeoccurringnow.
Honeypotsarehoststhathavenoauthorizedusersotherthanthehoneypotadministratorsbecausetheyservenobusinessfunctionallactivitydirectedatthemis
consideredsuspicious.Attackersscanandattackhoneypots,givingadministratorsdataonnewtrendsandattack/attackertools,particularlymaliciouscode.However,
honeypotsareasupplementto,notareplacementfor,properlysecuringnetworks,systems,andapplications.
164.Eachuserisgrantedthelowestclearanceneededtoperformauthorizedtasks.Whichofthefollowingprinciplesisthis?
a.Theprincipleofleastprivilege
b.Theprincipleofseparationofduties
c.Theprincipleofsystemclearance
d.Theprincipleofsystemaccreditation
164.a.Theprincipleofleastprivilegerequiresthateachsubject(user)inasystembegrantedthemostrestrictivesetofprivileges(orlowestclearances)neededto
performauthorizedtasks.Theapplicationofthisprinciplelimitsthedamagethatcanresultfromaccident,error,and/orunauthorizeduse.Theprincipleofseparation
ofdutiesstatesthatnosinglepersoncanhavecompletecontroloverabusinesstransactionortask.
Theprincipleofsystemclearancestatesthatusers'accessrightsshouldbebasedontheirjobclearancestatus(i.e.,sensitiveornonsensitive).Theprincipleofsystem
accreditationstatesthatallsystemsshouldbeapprovedbymanagementpriortomakingthemoperational.
165.Whichofthefollowingintrusiondetectionandpreventionsystem(IDPS)methodologyisappropriateforanalyzingbothnetworkbasedand
hostbasedactivity?
a.Signaturebaseddetection
b.Misusedetection
c.Anomalybaseddetection
d.Statefulprotocolanalysis
165.d.IDPStechnologiesusemanymethodologiestodetectincidents.Theprimaryclassesofdetectionmethodologiesincludesignaturebased,anomalybased,and
statefulprotocolanalysis,wherethelatteristheonlyonethatanalyzesbothnetworkbasedandhostbasedactivity.
Signaturebaseddetectionistheprocessofcomparingsignaturesagainstobservedeventstoidentifypossibleincidents.Asignatureisapatternthatcorrespondstoa
knownthreat.Itissometimesincorrectlyreferredtoasmisusedetectionorstatefulprotocolanalysis.Misusedetectionreferstoattacksfromwithintheorganizations.
Anomalybaseddetectionistheprocessofcomparingdefinitionsofwhatactivityisconsiderednormalagainstobservedeventstoidentifysignificantdeviationsand
abnormalbehavior.
Statefulprotocolanalysis(alsoknownasdeeppacketinspection)istheprocessofcomparingpredeterminedprofilesofgenerallyaccepteddefinitionsofbenign
protocolactivityforeachprotocolstateagainstobservedeventstoidentifydeviations.Thestatefulprotocolisappropriateforanalyzingbothnetworkbasedand
hostbasedactivity,whereasdeeppacketinspectionisappropriatefornetworkbasedactivityonly.OnenetworkbasedIDPScanlistenonanetworksegmentor
switchandcanmonitorthenetworktrafficaffectingmultiplehoststhatareconnectedtothenetworksegment.OnehostbasedIDPSoperatesoninformationcollected
fromwithinanindividualcomputersystemanddetermineswhichprocessesanduseraccountsareinvolvedinaparticularattack.
166.TheClarkWilsonsecuritymodelfocusesonwhichofthefollowing?
a.Confidentiality
b.Integrity
c.Availability
d.Accountability
166.b.TheClarkWilsonsecuritymodelisanapproachthatprovidesdataintegrityforcommoncommercialactivities.Itisaspecificmodeladdressingintegrity,
whichisoneoffivesecurityobjectives.Thefiveobjectivesare:confidentiality,integrity,availability,accountability,andassurance.
167.TheBibasecuritymodelfocusesonwhichofthefollowing?
a.Confidentiality
b.Integrity
c.Availability
d.Accountability
167.b.TheBibasecuritymodelisanintegritymodelinwhichnosubjectmaydependonalesstrustedobject,includinganothersubject.Itisaspecificmodel
addressingonlyoneofthesecurityobjectivessuchasconfidentiality,integrity,availability,andaccountability.
168.TheTakeGrantsecuritymodelfocusesonwhichofthefollowing?
a.Confidentiality
b.Accountability
c.Availability
d.Accessrights
168.d.TheTakeGrantsecuritymodelusesadirectedgraphtospecifytherightsthatasubjectcantransfertoanobjectorthatasubjectcantakefromanothersubject.
Itdoesnotaddressthesecurityobjectivessuchasconfidentiality,integrity,availability,andaccountability.Accessrightsareapartofaccesscontrolmodels.
169.Whichofthefollowingisbasedonprecomputedpasswordhashes?
a.Bruteforceattack
b.Dictionaryattack
c.Rainbowattack
d.Hybridattack
169.c.Rainbowattacksareaformofapasswordcrackingtechniquethatemploysrainbowtables,whicharelookuptablesthatcontainprecomputedpasswordhashes.
Thesetablesenableanattackertoattempttocrackapasswordwithminimaltimeonthevictimsystemandwithoutconstantlyhavingtoregeneratehashesifthe
attackerattemptstocrackmultipleaccounts.Theotherthreechoicesarenotbasedonprecomputedpasswordhashesalthough,theyareallrelatedtopasswords.
Abruteforceattackisaformofaguessingattackinwhichtheattackerusesallpossiblecombinationsofcharactersfromagivencharactersetandforpasswordsupto
agivenlength.
Adictionaryattackisaformofaguessingattackinwhichtheattackerattemptstoguessapasswordusingalistofpossiblepasswordsthatisnotexhaustive.
Ahybridattackisaformofaguessingattackinwhichtheattackerusesadictionarythatcontainspossiblepasswordsandthenusesvariationsthroughbruteforce
methodsoftheoriginalpasswordsinthedictionarytocreatenewpotentialpasswords.
170.Forintrusiondetectionandpreventionsystemcapabilities,anomalybaseddetectionuseswhichofthefollowing?
1.Blacklists
2.Whitelists
3.Threshold
4.Programcodeviewing
a.1and2
b.1,2,and3
c.3only
d.1,2,3,and4
170.c. Anomalybased detection is the process of comparing definitions of what activity is considered normal against observed events to identify significant
deviations.Thresholdsaremostoftenusedforanomalybaseddetection.Athresholdisavaluethatsetsthelimitbetweennormalandabnormalbehavior.
Ananomalybaseddetectiondoesnotuseblacklists,whitelists,andprogramcodeviewing.Ablacklistisalistofdiscreteentities,suchashostsorapplicationsthat
havebeenpreviouslydeterminedtobeassociatedwithmaliciousactivity.Awhitelistisalistofdiscreteentities,suchashostsorapplicationsknowntobebenign.
Programcodeviewingandeditingfeaturesareestablishedtoseethedetectionrelatedprogrammingcodeintheintrusiondetectionandpreventionsystem(IDPS).
171.Whichofthefollowingsecuritymodelsaddressesseparationofdutiesconcept?
a.Bibamodel
b.ClarkWilsonmodel
c.BellLaPadulamodel
d.Sutherlandmodel
171.b.TheClarkandWilsonsecuritymodeladdressestheseparationofdutiesconceptalongwithwellformedtransactions.Separationofdutiesattemptstoensure
theexternalconsistencyofdataobjects.Italsoaddressesthespecificintegritygoalofpreventingauthorizedusersfrommakingimpropermodifications.Theother
threemodelsdonotaddresstheseparationofdutiesconcept.
172.Fromacomputersecurityviewpoint,theChineseWallpolicyisrelatedtowhichofthefollowing?
a.Aggregationproblem
b.Dataclassificationproblem
c.Accesscontrolproblem
d.Inferenceproblem
172.c.AspresentedbyBrewerandNash,theChineseWallpolicyisamandatoryaccesscontrolpolicyforstockmarketanalysts.Accordingtothepolicy,amarket
analystmaydobusinesswithanycompany.However,everytimetheanalystreceivessensitiveinsideinformationfromanewcompany,thepolicypreventshim
fromdoingbusinesswithanyothercompanyinthesameindustrybecausethatwouldinvolvehiminaconflictofinterestsituation.Inotherwords,collaboration
withonecompanyplacestheChineseWallbetweenhimandallothercompaniesinthesameindustry.
TheChineseWallpolicydoesnotmeetthedefinitionofanaggregationproblemthereisnonotionofsomeinformationbeingsensitivewiththeaggregatebeing
moresensitive.TheChineseWallpolicyisanaccesscontrolpolicyinwhichtheaccesscontrolruleisnotbasedjustonthesensitivityoftheinformation,butis
basedontheinformationalreadyaccessed.Itisneitheraninferencenoradataclassificationproblem.
173.Whichofthefollowingsecuritymodelspromotessecurityclearancesandsensitivityclassifications?
a.Bibamodel
b.ClarkWilsonmodel
c.BellLaPadulamodel
d.Sutherlandmodel
173.c.InaBellLaPadulamodel,theclearance/classificationschemeisexpressedintermsofalattice.Todeterminewhetheraspecificaccessmodelisallowed,the
clearanceofasubjectiscomparedtotheclassificationoftheobject,andadeterminationismadeastowhetherthesubjectisauthorizedforthespecificaccessmode.
Theotherthreemodelsdonotdealwithsecurityclearancesandsensitivityclassifications.
174.Whichofthefollowingsolutionstolocalaccountpasswordmanagementproblemcouldanattackerexploit?
a.Usemultifactorauthenticationtoaccessthedatabase.
b.Useahashbasedlocalpasswordandastandardpassword.
c.Userandomlygeneratedpasswords.
d.Useacentralpassworddatabase.
174.b.Alocalpasswordcouldbebasedonacryptographichashofthemediaaccesscontroladdressandastandardpassword.However,ifanattackerrecoversone
localpassword,theattackercouldeasilydetermineotherlocalpasswords.Anattackercouldnotexploittheotherthreechoicesbecausetheyaresecure.Otherpositive
solutionsincludedisablingbuiltinaccounts,storingthepasswordsinthedatabaseinanencryptedform,andgeneratingpasswordsbasedonamachinenameora
mediaaccesscontroladdress.
175.Whichofthefollowingstatementsistrueaboutintrusiondetectionsystems(IDS)andfirewalls?
a.FirewallsareasubstitutionforanIDS.
b.FirewallsareanalternativetoanIDS.
c.FirewallsareacomplementtoanIDS.
d.FirewallsareareplacementforanIDS.
175.c.AnIDSshouldbeusedasacomplementtoafirewall,notasubstituteforit.Together,theyprovideasynergisticeffect.
176.TheBellLaPadulaModelforacomputersecuritypolicydealswithwhichofthefollowing?
a.$property
b.@property
c.Star(*)property
d.#property
176.c.Starproperty(*property)isaBellLaPadulasecurityruleenablingasubjectwriteaccesstoanobjectonlyifthesecurityleveloftheobjectdominatesthe
securitylevelofthesubject.
177.Whichofthefollowingcannotpreventshouldersurfing?
a.Promotingeducationandawareness
b.Preventingpasswordguessing
c.Installingencryptiontechniques
d.Askingpeoplenottowatchwhileapasswordistyped
177.c.Thekeythinginshouldersurfingistomakesurethatnoonewatchestheuserwhilehispasswordistyped.Encryptiondoesnothelpherebecauseitisapplied
afterapasswordisentered,notbefore.Propereducationandawarenessandusingdifficulttoguesspasswordscaneliminatethisproblem.
178.WhatdoestheBellLaPadula'sstar.property(*property)mean?
a.Nowriteupisallowed.
b.Nowritedownisallowed.
c.Noreadupisallowed.
d.Noreaddownisallowed.
178.b.Thestarpropertymeansnowritedownandyestoawriteup.Asubjectcanwriteobjectsonlyatasecuritylevelthatdominatesthesubject'slevel.Thismeans,
asubjectofonehigherlabelcannotwritetoanyobjectofalowersecuritylabel.Thisisalsoknownastheconfinementproperty.Asubjectispreventedfromcopying
datafromonehigherclassificationtoalowerclassification.Inotherwords,asubjectcannotwriteanythingbelowthatsubject'slevel.
179.Whichofthefollowingsecuritymodelscoversintegrity?
a.BellLaPadulamodel
b.Bibamodel
c.Informationflowmodel
d.TakeGrantmodel
179.b.TheBibamodelisanexampleofanintegritymodel.TheBellLaPadulamodelisaformalstatetransitionmodelofacomputersecuritypolicythatdescribesa
setofaccesscontrolrules.BoththeBellLaPadulaandtheTakeGrantmodelsareapartofaccesscontrolmodels.
180.Whichofthefollowingsecuritymodelscoversconfidentiality?
a.BellLaPadulamodel
b.Bibamodel
c.Informationflowmodel
d.Takegrantmodel
180.a.TheBellLaPadulamodeladdressesconfidentialitybydescribingdifferentsecuritylevelsofsecurityclassificationsfordocuments.Theseclassificationlevels,
fromleastsensitivetomostinsensitive,includeUnclassified,Confidential,Secret,andTopSecret.
181.Whichoneofthefollowingisnotanauthenticationmechanism?
a.Whattheuserknows
b.Whattheuserhas
c.Whattheusercando
d.Whattheuseris
181.c. What the user can do is defined in access rules or user profiles, which come after a successful authentication. The other three choices are part of an
authenticationprocess.TheauthenticatorfactorknowsmeansapasswordorPIN,hasmeanskeyorcard,andismeansabiometricidentity.
182.Whichofthefollowingmodelsisusedtoprotecttheconfidentialityofclassifiedinformation?
a.BibamodelandBellLaPadulamodel
b.BellLaPadulamodelandinformationflowmodel
c.BellLaPadulamodelandClarkWilsonmodel
d.ClarkWilsonmodelandinformationflowmodel
182.b.TheBellLaPadulamodelisusedforprotectingtheconfidentialityofclassifiedinformation,basedonmultilevelsecurityclassifications.Theinformationflow
model,abasisfortheBellLaPadulamodel,ensuresthatinformationatagivensecuritylevelflowsonlytoanequalorhigherlevel.Eachobjecthasanassociated
securitylevel.Anobject'slevelindicatesthesecuritylevelofthedataitcontains.Thesetwomodelsensuretheconfidentialityofclassifiedinformation.
TheBibamodelissimilartotheBellLaPadulamodelbutprotectstheintegrityofinformationinsteadofitsconfidentiality.TheClarkWilsonmodelisalessformal
modelaimedatensuringtheintegrityofinformation,notconfidentiality.Thismodelimplementstraditionalaccountingcontrolsincludingsegregationofduties,
auditing,andwellformedtransactionssuchasdoubleentrybookkeeping.BoththeBibaandClarkWilsonmodelsareexamplesofintegritymodels.
183.Whichofthefollowingisthemostimportantpartofintrusiondetectionandcontainment?
a.Prevent
b.Detect
c.Respond
d.Report
183.c.Itisessentialtodetectinsecuresituationstorespondinatimelymanner.Also,itisoflittleusetodetectasecuritybreachifnoeffectiveresponsecanbe
initiated.Nosetofpreventionmeasuresisperfect.Reportingisthelaststepintheintrusiondetectionandcontainmentprocess.
184.Whichofthefollowingistheheartofintrusiondetectionsystems?
a.Mutationengine
b.Processingengine
c.Statemachine
d.Virtualmachine
184.b.Theprocessingengineistheheartoftheintrusiondetectionsystem(IDS).Itconsistsoftheinstructions(language)forsortinginformationforrelevance,
identifyingkeyintrusionevidence,miningdatabasesforattacksignatures,anddecisionmakingaboutthresholdsforalertsandinitiationofresponseactivities.
Forexample,amutationengineisusedtoobfuscateavirus,polymorphicornot,toaidtheproliferationofthesaidvirus.Astatemachineisthebasisforallcomputer
systemsbecauseitisamodelofcomputationsinvolvinginputs,outputs,states,andstatetransitionfunctions.Avirtualmachineissoftwarethatenablesasinglehost
computertorunusingoneormoreguestoperatingsystems.
185.Fromanaccesscontroldecisionviewpoint,failuresduetoflawsinexclusionbasedsystemstendtodowhichofthefollowing?
a.Authorizepermissibleactions
b.Failsafewithpermissiondenied
c.Unauthorizeprohibitedactions
d.Grantunauthorizedpermissions
185.d.Whenfailuresoccurduetoflawsinexclusionbasedsystems,theytendtograntunauthorizedpermissions.Thetwotypesofaccesscontroldecisionsare
permissionbasedandexclusionbased.
186.Whichofthefollowingisamajorissuewithimplementationofintrusiondetectionsystems?
a.Falsenegativenotification
b.Falsepositivenotification
c.Truenegativenotification
d.Truepositivenotification
186.b.Oneofthebiggestsingleissueswithintrusiondetectionsystem(IDS)implementationisthehandlingoffalsepositivenotification.AnanomalybasedIDS
producesalargenumberoffalsealarms(falsepositives)duetotheunpredictablenatureofusersandnetworks.Automatedsystemsarepronetomistakes,andhuman
differentiationofpossibleattacksisresourceintensive.
187.Whichofthefollowingprovidesstrongauthenticationforcentralizedauthenticationserverswhenusedwithfirewalls?
a.UserIDs
b.Passwords
c.Tokens
d.Accountnumbers
187.c.Forbasicauthentication,userIDs,passwords,andaccountnumbersareusedforinternalauthentication.CentralizedauthenticationserverssuchasRADIUSand
TACACS/TACACS+canbeintegratedwithtokenbasedauthenticationtoenhancefirewalladministrationsecurity.
188.Howisauthorizationdifferentfromauthentication?
a.Authorizationcomesafterauthentication.
b.Authorizationandauthenticationarethesame.
c.Authorizationisverifyingtheidentityofauser.
d.Authorizationcomesbeforeauthentication.
188.a. Authorization comes after authentication because a user is granted access to a program (authorization) after he is fully authenticated. Authorization is
permissiontodosomethingwithinformationinacomputer.Authorizationandauthenticationarenotthesame,wheretheformerisverifyingtheuser'spermission
andthelatterisverifyingtheidentityofauser.
189.WhichofthefollowingisrequiredtothwartattacksagainstaKerberossecurityserver?
a.Initialauthentication
b.Preauthentication
c.Postauthentication
d.Reauthentication
189.b.ThesimplestformofinitialauthenticationusesauserIDandpassword,whichoccursontheclient.Theserverhasnoknowledgeofwhethertheauthentication
wassuccessful.Theproblemwiththisapproachisthatanyonecanmakearequesttotheserverassertinganyidentity,allowinganattackertocollectrepliesfromthe
serverandsuccessfullylaunchingarealattackonthosereplies.
Inpreauthentication,theusersendssomeproofofhisidentitytotheserveraspartoftheinitialauthenticationprocess.Theclientmustauthenticatepriortothe
serverissuingacredential(ticket)totheclient.Theproofofidentityusedinpreauthenticationcanbeasmartcardortoken,whichcanbeintegratedintotheKerberos
initialauthenticationprocess.Here,postauthenticationandreauthenticationprocessesdonotapplybecauseitistoolatetobeofanyuse.
190.Whichofthefollowingstatementsisnottrueaboutdiscretionaryaccesscontrol?
a.Accessisbasedontheauthorizationgrantedtotheuser.
b.Itusesaccesscontrollists.
c.Itusesgrantorrevokeaccesstoobjects.
d.Usersandownersaredifferent.
190.d. Discretionary access control (DAC) permits the granting and revoking of access control privileges to be left to the discretion of individual users. A
discretionaryaccesscontrolmechanismenablesuserstograntorrevokeaccesstoanyoftheobjectsunderthecontrol.Assuch,usersaresaidtobetheownersofthe
objectsundertheircontrol.Itusesaccesscontrollists.
191.Whichofthefollowingdoesnotproviderobustauthentication?
a.Kerberos
b.Secureremoteprocedurecalls
c.Reusablepasswords
d.Digitalcertificates
191.c.Robustauthenticationmeansstrongauthenticationthatshouldberequiredforaccessinginternalcomputersystems.Robustauthenticationisprovidedby
Kerberos,onetimepasswords,challengeresponseexchanges,digitalcertificates,andsecureremoteprocedurecalls(SecureRPC).Reusablepasswordsprovideweak
authentication.
192.WhichofthefollowingstatementsisnottrueaboutKerberosprotocol?
a.Kerberosusesanasymmetrickeycryptography.
b.Kerberosusesatrustedthirdparty.
c.Kerberosisacredentialbasedauthenticationsystem.
d.Kerberosusesasymmetrickeycryptography.
192.a.Kerberosusessymmetrickeycryptographyandatrustedthirdparty.KerberosusersauthenticatewithoneanotherusingKerberoscredentialsissuedbya
trustedthirdparty.ThebitsizeofKerberosisthesameasthatofDES,whichis56bitsbecauseKerberosusesasymmetrickeyalgorithmsimilartoDES.
193.Whichofthefollowingauthenticationtypesismosteffective?
a.Staticauthentication
b.Robustauthentication
c.Intermittentauthentication
d.Continuousauthentication
193.d.Continuousauthenticationprotectsagainstimpostors(activeattacks)byapplyingadigitalsignaturealgorithmtoeverybitofdatasentfromtheclaimantto
theverifier.Also,continuousauthenticationpreventssessionhijackingandprovidesintegrity.
Static authentication uses reusable passwords, which can be compromised by replay attacks. Robust authentication includes onetime passwords and digital
signatures,whichcanbecompromisedbysessionhijacking.Intermittentauthenticationisnotusefulbecauseofgapsinuserverification.
194.Formajorfunctionsofintrusiondetectionandpreventionsystemtechnologies,whichofthefollowingstatementsaretrue?
1.Itisnotpossibletoeliminateallfalsepositivesandfalsenegatives.
2.Reducingfalsepositivesincreasesfalsenegativesandviceversa.
3.Decreasingfalsenegativesisalwayspreferred.
4.Moreanalysisisneededtodifferentiatefalsepositivesfromfalsenegatives.
a.1only
b.2only
c.3only
d.1,2,3,and4
194.d.Intrusiondetectionandpreventionsystem(IDPS)technologiescannotprovidecompletelyaccuratedetectionatalltimes.Allfouritemsaretruestatements.
WhenanIDPSincorrectlyidentifiesbenignactivityasbeingmalicious,afalsepositivehasoccurred.WhenanIDPSfailstoidentifymaliciousactivity,afalse
negativehasoccurred.
195.Whichofthefollowingauthenticationtechniquesisimpossibletoforge?
a.Whattheuserknows
b.Whattheuserhas
c.Whattheuseris
d.Wheretheuseris
195.d. Passwords and PINs are often vulnerable to guessing, interception, or brute force attack. Devices such as access tokens and cryptocards can be stolen.
Biometricscanbevulnerabletointerceptionandreplayattacks.Alocationcannotbedifferentthanwhatitis.Thetechniquesusedintheotherthreechoicesarenot
foolproof.However,wheretheuserisbasedonageodeticlocationisfoolproofbecauseitcannotbespoofedorhijacked.
Geodeticlocation,ascalculatedfromalocationsignature,addsafourthandnewdimensiontouserauthenticationandaccesscontrolmechanisms.Thesignatureis
derivedfromtheuser'slocation.Itcanbeusedtodeterminewhetherauserisattemptingtologinfromanapprovedlocation.Ifunauthorizedactivityisdetectedfrom
anauthorizedlocation,itcanfacilitatefindingtheuserresponsibleforthatactivity.
196.Howdoesarulebasedaccesscontrolmechanismwork?
a.Itisbasedonfilteringrules.
b.Itisbasedonidentityrules.
c.Itisbasedonaccessrules.
d.Itisbasedonbusinessrules.
196.c.Arulebasedaccesscontrolmechanismisbasedonspecificrulesrelatingtothenatureofthesubjectandobject.Thesespecificrulesareembeddedinaccess
rules.Filteringrulesarespecifiedinfirewalls.Bothidentityandbusinessrulesareinapplicablehere.
197.Whichofthefollowingisanexampleofasystemintegritytoolusedinthetechnicalsecuritycontrolcategory?
a.Auditing
b.Restoretosecurestate
c.Proofofwholeness
d.Intrusiondetectiontool
197.c.Theproofofwholenesscontrolisasystemintegritytoolthatanalyzessystemintegrityandirregularitiesandidentifiesexposuresandpotentialthreats.The
proofofwholenessprincipledetectsviolationsofsecuritypolicies.
Auditingisadetectivecontrol,whichenablesmonitoringandtrackingofsystemabnormalities.Restoretosecurestateisarecoverycontrolthatenablesasystemto
returntoastatethatisknowntobesecure,afterasecuritybreachoccurs.Intrusiondetectiontoolsdetectsecuritybreaches.
198.Individualaccountabilitydoesnotincludewhichofthefollowing?
a.Uniqueidentifiers
b.Accessrules
c.Audittrails
d.Policiesandprocedures
198.d.AbasictenetofITsecurityisthatindividualsmustbeaccountablefortheiractions.Ifthisisnotfollowedandenforced,itisnotpossibletosuccessfully
prosecutethosewhointentionallydamageordisruptsystemsortotrainthosewhoseactionshaveunintendedadverseeffects.
Theconceptofindividualaccountabilitydrivestheneedformanysecuritysafeguards,suchasunique(user)identifiers,audittrails,andaccessauthorizationrules.
Policiesandproceduresindicatewhattoaccomplishandhowtoaccomplishobjectives.Bythemselves,theydonotexactindividualaccountability.
199.Fromanaccesscontrolviewpoint,whichofthefollowingiscomputedfromapassphrase?
a.Accesspassword
b.Personalpassword
c.Validpassword
d.Virtualpassword
199.d. A virtual password is a password computed from a passphrase that meets the requirements of password storage (e.g., 56 bits for DES). A passphrase is a
sequenceofcharacters,longerthantheacceptablelengthofaregularpassword,whichistransformedbyapasswordsystemintoavirtualpasswordofacceptable
length.
Anaccesspasswordisapasswordusedtoauthorizeaccesstodataandisdistributedtoallthosewhoareauthorizedtohavesimilaraccesstothatdata.Apersonal
passwordisapasswordknownbyonlyonepersonandisusedtoauthenticatethatperson'sidentity.Avalidpasswordisapersonalpasswordthatauthenticatesthe
identityofanindividualwhenpresentedtoapasswordsystem.Itisalsoanaccesspasswordthatenablestherequestedaccesswhenpresentedtoapasswordsystem.
200.Whichofthefollowingisanincompatiblefunctionforadatabaseadministrator?
a.Dataadministration
b.Informationsystemsadministration
c.Systemssecurity
d.Informationsystemsplanning
200.c.Thedatabaseadministrator(DBA)functionisconcernedwithshorttermdevelopmentanduseofdatabases,andisresponsibleforthedataofoneorseveral
specificdatabases.TheDBAfunctionshouldbeseparatefromthesystems'securityfunctionduetopossibleconflictofinterestformanipulationofaccessprivileges
andrulesforpersonalgain.TheDBAfunctioncanbemixedwithdataadministration,informationsystemsadministration,orinformationsystemsplanningbecause
thereisnoharmtotheorganization.
201.Kerberosuseswhichofthefollowingtoprotectagainstreplayattacks?
a.Cards
b.Timestamps
c.Tokens
d.Keys
201.b.Areplayattackreferstotherecordingandretransmissionofmessagepacketsinthenetwork.Althoughareplayattackisfrequentlyundetected,butitcanbe
preventedbyusingpackettimestamping.Kerberosusesthetimestampsbutnotcards,tokens,andkeys.
202.Whichofthefollowinguseridentificationandauthenticationtechniquesdependonreferenceprofilesortemplates?
a.Memorytokens
b.Smartcards
c.Cryptography
d.Biometricsystems
202.d.Biometricsystemsrequirethecreationandstorageofprofilesortemplatesofindividualswantingsystemaccess.Thisincludesphysiologicalattributessuchas
fingerprints,handgeometry,orretinapatterns,orbehavioralattributessuchasvoicepatternsandhandwrittensignatures.
MemorytokensandsmartcardsinvolvethecreationanddistributionofatokendevicewithaPIN,anddatathattellthecomputerhowtorecognizevalidtokensor
PINs.Cryptographyrequiresthegeneration,distribution,storage,entry,use,distribution,andarchivingofcryptographickeys.
203.Whensecurityproductscannotprovidesufficientprotectionthroughencryption,systemadministratorsshouldconsiderusingwhichof
thefollowingtoprotectintrusiondetectionandpreventionsystemmanagementcommunications?
1.Physicallyseparatednetwork
2.Logicallyseparatednetwork
3.Virtualprivatenetwork
4.Encryptedtunneling
a.1and4
b.2and3
c.3and4
d.1,2,3,and4
203.c. System administrators should ensure that all intrusion detection and prevention system (IDPS) management communications are protected either through
physicalseparation(managementnetwork)orlogicalseparation(virtualnetwork)orthroughencryptionusingtransportlayersecurity(TLS).However,forsecurity
products that do not provide sufficient protection through encryption, administrators should consider using a virtual private network (VPN) or other encrypted
tunnelingmethodtoprotectthenetworktraffic.
204.Whatistheobjectiveofseparationofduties?
a.Noonepersonhascompletecontroloveratransactionoranactivity.
b.Employeesfromdifferentdepartmentsdonotworktogetherwell.
c.Controlsareavailabletoprotectallsupplies.
d.Controlsareinplacetooperateallequipment.
204.a.Theobjectiveistolimitwhatpeoplecando,especiallyinconflictsituationsorincompatiblefunctions,insuchawaythatnoonepersonhascompletecontrol
overatransactionoranactivityfromstarttofinish.Thegoalistolimitthepossibilityofhidingirregularitiesorfraud.Theotherthreechoicesarenotrelatedto
separationofduties.
205.Whatnamesdoesanaccesscontrolmatrixplace?
a.Usersineachrowandthenamesofobjectsineachcolumn
b.Programsineachrowandthenamesofusersineachcolumn
c.Usersineachcolumnandthenamesofdevicesineachrow
d.Subjectsineachcolumnandthenamesofprocessesineachrow
205.a. Discretionary access control is a process to identify users and objects. An access control matrix can be used to implement a discretionary access control
mechanismwhereitplacesthenamesofusers(subject)ineachrowandthenamesofobjectsineachcolumnofamatrix.Asubjectisanactiveentity,generallyinthe
formofaperson,process,ordevicethatcausesinformationtoflowamongobjectsorchangesthesystem'sstate.Anobjectisapassiveentitythatcontainsorreceives
information.Accesstoanobjectpotentiallyimpliesaccesstotheinformationitcontains.Examplesofobjectsincluderecords,programs,pages,files,anddirectories.
Anaccesscontrolmatrixdescribesanassociationofobjectsandsubjectsforauthenticationofaccessrights.
206.WhichsituationisKerberosnotusedin?
a.Managingdistributedaccessrights
b.Managingencryptionkeys
c.Managingcentralizedaccessrights
d.Managingaccesspermissions
206.a.Kerberosisaprivatekeyauthenticationsystemthatusesacentraldatabasetokeepacopyofallusers'privatekeys.Theentiresystemcanbecompromiseddue
tothecentraldatabase.Kerberosisusedtomanagecentralizedaccessrights,encryptionkeys,andaccesspermissions.
207.Whichofthefollowingsecuritycontrolmechanismsissimplesttoadminister?
a.Discretionaryaccesscontrol
c.Accesscontrollist
d.Logicalaccesscontrol
207.b.Mandatoryaccesscontrolsarethesimplesttousebecausetheycanbeusedtograntbroadaccesstolargesetsoffilesandtobroadcategoriesofinformation.
Discretionaryaccesscontrolsarenotsimpletouseduetotheirfinerlevelofgranularityintheaccesscontrolprocess.Boththeaccesscontrollistandlogicalaccess
controlrequireasignificantamountofadministrativeworkbecausetheyarebasedonthedetailsofeachindividualuser.
208.Whatimplementationisanexampleofanaccesscontrolpolicyforabankteller?
a.Rolebasedpolicy
b.Identitybasedpolicy
c.Userdirectedpolicy
d.Rulebasedpolicy
208.a.Withrolebasedaccesscontrol,accessdecisionsarebasedontherolesthatindividualusershaveaspartofanorganization.Userstakeonassignedroles(such
asdoctor,nurse,bankteller,andmanager).Accessrightsaregroupedbyrolename,andtheuseofresourcesisrestrictedtoindividualsauthorizedtoassumethe
associatedrole.Theuseofrolestocontrolaccesscanbeaneffectivemeansfordevelopingandenforcingenterprisespecificsecuritypoliciesandforstreamliningthe
securitymanagementprocess.
Identitybasedanduserdirectedpoliciesareincorrectbecausetheyareexamplesofdiscretionaryaccesscontrol.Identitybasedaccesscontrolisbasedonlyonthe
identityofthesubjectandobject.Inuserdirectedaccesscontrols,asubjectcanaltertheaccessrightswithcertainrestrictions.Rulebasedpolicyisincorrectbecause
itisanexampleofamandatorytypeofaccesscontrolandisbasedonspecificrulesrelatingtothenatureofthesubjectandobject.
209.Whichofthefollowingaccessmechanismscreatesapotentialsecurityproblem?
a.Locationbasedaccessmechanism
b.IPaddressbasedaccessmechanism
c.Tokenbasedaccessmechanism
d.Webbasedaccessmechanism
209.b.IPaddressbasedaccessmechanismsuseInternetProtocol(IP)sourceaddresses,whicharenotsecureandsubjecttoIPaddressspoofingattacks.TheIPaddress
dealswithidentificationonly,notauthentication.
Locationbasedaccessmechanismisincorrectbecauseitdealswithaphysicaladdress,notIPaddress.Tokenbasedaccessmechanismisincorrectbecauseituses
tokensasameansofidentificationandauthentication.Webbasedaccessmechanismisincorrectbecauseitusessecureprotocolstoaccomplishauthentication.The
otherthreechoicesaccomplishbothidentificationandauthenticationanddonotcreateasecurityproblemasdoestheIPaddressbasedaccessmechanism.
210.Rankthefollowingauthenticationmechanismsprovidingmosttoleastprotectionagainstreplayattacks?
a.Passwordonly,passwordandPIN,challengeresponse,andonetimepassword
b.PasswordandPIN,challengeresponse,onetimepassword,andpasswordonly
c.Challengeresponse,onetimepassword,passwordandPIN,andpasswordonly
d.Challengeresponse,passwordandPIN,onetimepassword,andpasswordonly
210.c.Achallengeresponseprotocolisbasedoncryptographyandworksbyhavingthecomputergenerateachallenge,suchasarandomstringofnumbers.Thesmart
tokenthengeneratesaresponsebasedonthechallenge.Thisissentbacktothecomputer,whichauthenticatestheuserbasedontheresponse.Smarttokensthatuse
eitherchallengeresponseprotocolsordynamicpasswordgenerationcancreateonetimepasswordsthatchangeperiodically(e.g.,everyminute).
Ifthecorrectvalueisprovided,theloginispermitted,andtheuserisgrantedaccesstothecomputersystem.Electronicmonitoringisnotaproblemwithonetime
passwordsbecauseeachtimetheuserisauthenticatedtothecomputer,adifferentpasswordisused.Ahackercouldlearntheonetimepasswordthroughelectronic
monitoring,butitwouldbeofnovalue.
Passwordsandpersonalidentificationnumbers(PINs)haveweaknessessuchasdisclosingandguessing.PasswordscombinedwithPINsarebetterthanpasswords
only.BothpasswordsandPINsaresubjecttoelectronicmonitoring.Simpleencryptionofapasswordthatwillbeusedagaindoesnotsolvethemonitoringproblem
becauseencryptingthesamepasswordcreatesthesameciphertexttheciphertextbecomesthepassword.
211. Somesecurityauthoritiesbelievethatreauthenticationofeverytransactionprovidesstrongersecurityprocedures.Whichofthefollowing
securitymechanismsisleastefficientandleasteffectiveforreauthentication?
a.Recurringpasswords
b.Nonrecurringpasswords
c.Memorytokens
d.Smarttokens
211.a. Recurring passwords are static passwords with reuse and are considered to be a relatively weak security mechanism. Users tend to use easily guessed
passwords.Otherweaknessesincludespoofingusers,usersstealingpasswordsthroughobservingkeystrokes,anduserssharingpasswords.Theunauthorizeduseof
passwordsbyoutsiders(hackers)orinsidersisaprimaryconcernandisconsideredtheleastefficientandleasteffectivesecuritymechanismforreauthentication.
Nonrecurringpasswordsareincorrectbecausetheyprovideastrongformofreauthentication.Examplesincludeachallengeresponseprotocoloradynamicpassword
generatorwhereauniquevalueisgeneratedforeachsession.Thesevaluesarenotrepeatedandaregoodforthatsessiononly.
Tokenscanhelpinreauthenticatingauserortransaction.Memorytokensstorebutdonotprocessinformation.Smarttokensexpandthefunctionalityofamemory
tokenbyincorporatingoneormoreintegratedcircuitsintothetokenitself.Inotherwords,smarttokensstoreandprocessinformation.Exceptforpasswords,allthe
othermethodslistedinthequestionareexamplesofadvancedauthenticationmethodsthatcanbeappliedtoreauthentication.
212.WhichofthefollowinglistsapairofcompatiblefunctionswithintheITorganization?
a.Computeroperationsandapplicationsprogramming
b.Systemsprogramminganddatasecurityadministration
c.Qualityassuranceanddatasecurityadministration
d.Productionjobschedulingandcomputeroperations
212.c.Separationofdutiesisthefirstlineofdefenseagainsttheprevention,detection,andcorrectionoferrors,omissions,andirregularities.Theobjectiveisto
ensurethatnoonepersonhascompletecontroloveratransactionthroughoutitsinitiation,authorization,recording,processing,andreporting.Ifthetotalriskis
acceptable,thentwodifferentjobscanbecombined.Iftheriskisunacceptable,thetwojobsshouldnotbecombined.Bothqualityassuranceanddatasecurityarestaff
functionsandwouldnothandlethedaytodayoperationstasks.
Theotherthreechoicesareincorrectbecausetheyareexamplesofincompatiblefunctions.Therationaleistominimizesuchfunctionsthatarenotconducivetogood
internalcontrolstructure.Forexample,ifacomputeroperatorisalsoresponsibleforproductionjobscheduling,hecouldsubmitunauthorizedproductionjobs.
213.Asecuritylabel,oraccesscontrolmechanism,issupportedbywhichofthefollowingaccesscontrolpolicies?
a.Rolebasedpolicy
c.Userdirectedpolicy
d.Mandatoryaccesscontrolpolicy
213.d.Mandatoryaccesscontrolisatypeofaccesscontrolthatcannotbemademorepermissivebysubjects.Theyarebasedoninformationsensitivitysuchas
securitylabelsforclearanceanddataclassification.Rulebasedandadministrativelydirectedpoliciesareexamplesofmandatoryaccesscontrolpolicy.
Rolebasedpolicyisanexampleofnondiscretionaryaccesscontrols.Accesscontroldecisionsarebasedontherolesindividualusersaretakinginanorganization.
Thisincludesthespecificationofduties,responsibilities,obligations,andqualifications(e.g.,atellerorloanofficerassociatedwithabankingsystem).
Bothidentitybasedanduserdirectedpoliciesareexamplesofdiscretionaryaccesscontrol.Itisatypeofaccesscontrolthatpermitssubjectstospecifytheaccess
controlswithcertainlimitations.Identitybasedaccesscontrolisbasedonlyontheidentityofthesubjectandobject.Userdirectedcontrolisatypeofaccesscontrol
inwhichsubjectscanaltertheaccessrightswithcertainrestrictions.
214.Theprincipleofleastprivilegereferstothesecurityobjectiveofgrantingusersonlythoseaccessestheyneedtoperformtheirjobduties.
Whichofthefollowingactionsisinconsistentwiththeprincipleofleastprivilege?
a.Authorizationcreep
b.Reauthorizationwhenemployeeschangepositions
c.Usershavelittleaccesstosystems
d.Usershavesignificantaccesstosystems
214.a. Authorization creep occurs when employees continue to maintain access rights for previously held positions within an organization. This practice is
inconsistentwiththeprincipleofleastprivilege.
Alltheotherthreechoicesareincorrectbecausetheyareconsistentwiththeprincipleofleastprivilege.Reauthorizationcaneliminateauthorizationcreep,anditdoes
notmatterhowmanyusershaveaccesstothesystemorhowmuchaccesstothesystemaslongastheiraccessisbasedonneedtoknowconcept.
Permanentchangesarenecessarywhenemployeeschangepositionswithinanorganization.Inthiscase,theprocessofgrantingaccountauthorizationsoccursagain.
Atthistime,however,itisalsoimportantthataccessauthorizationsofthepriorpositionberemoved.Manyinstancesofauthorizationcreephaveoccurredwith
employees continuing to maintain access rights for previously held positions within an organization. This practice is inconsistent with the principle of least
privilege,anditissecurityvulnerability.
215.Accountabilityisimportanttoimplementingsecuritypolicies.Whichofthefollowingisleasteffectiveinexactingaccountabilityfrom
systemusers?
a.Auditingrequirements
b.PasswordanduserIDrequirements
c.Identificationcontrols
d.Authenticationcontrols
215.b.Accountabilitymeansholdingindividualusersresponsiblefortheiractions.DuetoseveralproblemswithpasswordsanduserIDs,theyareconsideredtobe
theleasteffectiveinexactingaccountability.Theseproblemsincludeeasytoguesspasswords,easytospoofusersforpasswords,easytostealpasswords,andeasyto
sharepasswords.Themosteffectivecontrolsforexactingaccountabilityincludeapolicy,authorizationscheme,identificationandauthenticationcontrols,access
controls,audittrails,andauditing.
216.Whichofthefollowingstatementisnottrueinelectronicauthentication?
a.Theregistrationauthorityandthecredentialserviceprovidermaybethesameentity
b.Theverifierandtherelyingpartymaybethesameentity
c.Theverifier,credentialserviceprovider,andtherelyingpartymaybeseparateentities
d.Theverifierandtherelyingpartymaybeseparateentities
216.a.Therelationshipbetweentheregistrationauthority(RA)andthecredentialserviceprovider(CSP)isacomplexonewithongoingrelationship.Inthesimplest
andperhapsthemostcommoncase,theRAandCSPareseparatefunctionsofthesameentity.However,anRAmightbepartofacompanyororganizationthat
registerssubscriberswithanindependentCSP,orseveraldifferentCSPs.ThereforeaCSPmaybeanintegralpartofRA,oritmayhaverelationshipswithmultiple
independentRAs,andanRAmayhaverelationshipswithdifferentCSPsaswell.
Thestatementsintheotherthreechoicesaretrue.Thepartytobeauthenticatediscalledaclaimant(subscriber)andthepartyverifyingthatidentityiscalledaverifier.
Whenasubscriberneedstoauthenticatetoperformatransaction,hebecomesaclaimanttoaverifier.Arelyingpartyreliesonresultsofanonlineauthenticationto
establishtheidentityorattributeofasubscriberforthepurposeofsometransaction.Relyingpartiesuseasubscriber'sauthenticatedidentityandotherfactorsto
makeaccesscontrolorauthorizationdecisions.Theverifierandtherelyingpartymaybethesameentity,ortheymaybeseparateentities.Insomecasestheverifier
does not need to directly communicate with the CSP to complete the authentication activity (e.g., the use of digital certificates), which represents a logical link
betweenthetwoentitiesratherthanaphysicallink.Insomeimplementations,theverifier,theCSPfunctions,andtherelyingpartymaybedistributedandseparated.
217.Locationbasedauthenticationtechniquesfortransportationfirmscanbeeffectivelyusedtoprovidewhichofthefollowing?
a.Staticauthentication
b.Intermittentauthentication
c.Continuousauthentication
d.Robustauthentication
217.c.Transportationfirmscanuselocationbasedauthenticationtechniquescontinuously,astherearenotimeandresourcelimits.Itdoesnotrequireanysecret
informationtoprotectateitherthehostoruserend.Continuousauthenticationisbetterthanrobustauthentication,wherethelattercanbeintermittent.
218.Systemadministratorsposeathreattocomputersecurityduetotheiraccessrightsandprivileges.Whichofthefollowingstatementsis
trueforanorganizationwithoneadministrator?
a.Masqueradingbyasystemadministratorcanbeprevented.
b.Asystemadministrator'saccesstothesystemcanbelimited.
c.Actionsbythesystemadministratorcanbedetected.
d.Asystemadministratorcannotcompromisesystemintegrity.
218.c.Authenticationdataneedstobestoredsecurely,anditsvalueliesinthedata'sconfidentiality,integrity,andavailability.Ifconfidentialityiscompromised,
someonemayusetheinformationtomasqueradeasalegitimateuser.Ifsystemadministratorscanreadtheauthenticationfile,theycanmasqueradeasanotheruser.
Manysystemsuseencryptiontohidetheauthenticationdatafromthesystemadministrators.
Masqueradingbysystemadministratorscannotbeentirelyprevented.Ifintegrityiscompromised,authenticationdatacanbeadded,orthesystemcanbedisrupted.If
availabilityiscompromised,thesystemcannotauthenticateusers,andtheusersmaynotbeabletowork.Becauseauditcontrolswouldbeoutofthecontrolofthe
administrator,controlscanbesetupsothatimproperactionsbythesystemadministratorscanbedetectedinauditrecords.Duetotheirbroaderresponsibilities,the
systemadministrators'accesstothesystemcannotbelimited.Systemadministratorscancompromiseasystem'sintegrityagaintheiractionscanbedetectedinaudit
records.
Itmakesabigdifferencewhetheranorganizationhasoneormorethanonesystemadministratorforseparationofdutiesorforleastprivilegeprincipletowork.
Withseveralsystemadministrators,asystemadministratoraccountcouldbesetupforonepersontohavethecapabilitytoaddaccounts.Anotheradministratorcould
havetheauthoritytodeletethem.Whenthereisonlyonesystemadministratoremployed,breakingupthedutiesisnotpossible.
219.Logicalaccesscontrolsprovideatechnicalmeansofcontrollingaccesstocomputersystems.Whichofthefollowingisnotabenefitof
logicalaccesscontrols?
a.Integrity
b.Availability
c.Reliability
d.Confidentiality
219.c.Computerbasedaccesscontrolsarecalledlogicalaccesscontrols.Thesecontrolscanprescribenotonlywhoorwhatistohaveaccesstoaspecificsystem
resourcebutalsothetypeofaccesspermitted,usuallyinsoftware.Reliabilityismoreofahardwareissue.
Logicalaccesscontrolscanhelpprotect(i)operatingsystemsandothersystemssoftwarefromunauthorizedmodificationormanipulation(andtherebyhelpensure
the system's integrity and availability) (ii) the integrity and availability of information by restricting the number of users and processes with access and (iii)
confidentialinformationfrombeingdisclosedtounauthorizedindividuals.
220.Whichofthefollowinginternalaccesscontrolmethodsoffersastrongformofaccesscontrolandisasignificantdeterrenttoitsuse?
a.Securitylabels
b.Passwords
c.Accesscontrollists
d.Encryption
220.a.Securitylabelsareastrongformofaccesscontrol.Unlikeaccesscontrollists,labelscannotordinarilybechanged.Becauselabelsarepermanentlylinkedto
specificinformation,datacannotbedisclosedbyausercopyinginformationandchangingtheaccesstothatfilesothattheinformationismoreaccessiblethanthe
originalownerintended.Securitylabelsarewellsuitedforconsistentlyanduniformlyenforcingaccessrestrictions,althoughtheiradministrationandinflexibility
canbeasignificantdeterrenttotheiruse.
Passwordsareaweakformofaccesscontrol,althoughtheyareeasytouseandadminister.Althoughencryptionisastrongformofaccesscontrol,itisnotadeterrent
toitsusewhencomparedtolabels.Inreality,thecomplexityanddifficultyofencryptioncanbeadeterrenttoitsuse.
221.Itisvitalthataccesscontrolsprotectingacomputersystemworktogether.Whichofthefollowingtypesofaccesscontrolsshouldbemost
specific?
a.Physical
b.Applicationsystem
c.Operatingsystem
d.Communicationsystem
221.b. At a minimum, four basic types of access controls should be considered: physical, operating system, communications, and application. In general, access
controlswithinanapplicationarethemostspecific.However,forapplicationaccesscontrolstobefullyeffective,theyneedtobesupportedbyoperatingsystemand
communications system access controls. Otherwise, access can be made to application resources without going through the application. Operating system,
communication,andapplicationaccesscontrolsneedtobesupportedbyphysicalaccesscontrolssuchasphysicalsecurityandcontingencyplanning.
222.Whichofthefollowingtypesoflogicalaccesscontrolmechanismsdoesnotrelyonphysicalaccesscontrols?
a.Encryptioncontrols
b.Applicationsystemaccesscontrols
c.Operatingsystemaccesscontrols
d.Utilityprograms
222.a.MostsystemscanbecompromisedifsomeonecanphysicallyaccesstheCPUmachineormajorcomponentsby,forexample,restartingthesystemwithdifferent
software.Logicalaccesscontrolsare,therefore,dependentonphysicalaccesscontrols(withtheexceptionofencryption,whichcandependsolelyonthestrengthof
thealgorithmandthesecrecyofthekey).
Applicationsystems,operatingsystems,andutilityprogramsareheavilydependentonlogicalaccesscontrolstoprotectagainstunauthorizeduse.
223.Asystemmechanismandaudittrailsassistbusinessmanagerstoholdindividualusersaccountablefortheiractions.Toutilizetheseaudit
trails,whichofthefollowingcontrolsisaprerequisiteforthemechanismtobeeffective?
a.Physical
b.Environmental
c.Management
d.Logicalaccess
223.d.Byadvisingusersthattheyarepersonallyaccountablefortheiractions,whicharetrackedbyanaudittrailthatlogsuseractivities,managerscanhelppromote
properuserbehavior.Usersarelesslikelytoattempttocircumventsecuritypolicyiftheyknowthattheiractionswillberecordedinanauditlog.Audittrailsworkin
concertwithlogicalaccesscontrols,whichrestrictuseofsystemresources.Becauselogicalaccesscontrolsareenforcedthroughsoftware,audittrailsareusedto
maintainanindividual'saccountability.Theotherthreechoicescollectsomedataintheformofanaudittrail,andtheiruseislimitedduetothelimitationofuseful
datacollected.
224.WhichofthefollowingisthebestplacetoputtheKerberosprotocol?
a.Applicationlayer
b.Transportlayer
c.Networklayer
d.Alllayersofthenetwork
224.d.PlacingtheKerberosprotocolbelowtheapplicationlayerandatalllayersofthenetworkprovidesgreatestsecurityprotectionwithouttheneedtomodify
applications.
225.Aninherentriskisassociatedwithlogicalaccessthatisdifficulttopreventormitigatebutcanbeidentifiedviaareviewofaudittrails.
Whichofthefollowingtypesofaccessisthisriskmostassociatedwith?
a.Properlyusedauthorizedaccess
b.Misusedauthorizedaccess
c.Unsuccessfulunauthorizedaccess
d.Successfulunauthorizedaccess
225.b.Properlyauthorizedaccess,aswellasmisusedauthorizedaccess,canuseaudittrailanalysisbutmoresoofthelatterduetoitshighrisk.Althoughuserscannot
bepreventedfromusingresourcestowhichtheyhavelegitimateaccessauthorization,audittrailanalysisisusedtoexaminetheiractions.Similarly,unauthorized
accessattempts,whethersuccessfulornot,canbedetectedthroughtheanalysisofaudittrails.
226.Manycomputersystemsprovidemaintenanceaccountsfordiagnosticandsupportservices.Whichofthefollowingsecuritytechniquesis
leastpreferredtoensurereducedvulnerabilitywhenusingtheseaccounts?
a.Callbackconfirmation
b.Encryptionofcommunications
c.Smarttokens
d.PasswordanduserID
226.d.Manycomputersystemsprovidemaintenanceaccounts.Thesespecialloginaccountsarenormallypreconfiguredatthefactorywithpreset,widelyknownweak
passwords.Itiscriticaltochangethesepasswordsorotherwisedisabletheaccountsuntiltheyareneeded.Iftheaccountistobeusedremotely,authenticationofthe
maintenanceprovidercanbeperformedusingcallbackconfirmation.Thishelpsensurethatremotediagnosticactivitiesactuallyoriginatefromanestablishedphone
number at the vendor's site. Other techniques can also help, including encryption and decryption of diagnostic communications, strong identification and
authenticationtechniques,suchassmarttokens,andremotedisconnectverification.
227.Belowisalistofpairs,whicharerelatedtooneanother.Whichpairofitemsrepresentstheintegralrelianceonthefirstitemtoenforcethe
second?
a.Theseparationofdutiesprinciple,theleastprivilegeprinciple
b.Theparitycheck,thelimitcheck
c.Thesinglekeysystem,theRivestShamirAdelman(RSA)algorithm
d.Thetwokeysystem,theDataEncryptionStandard(DES)algorithm
227.a.Theseparationofdutiesprincipleisrelatedtotheleastprivilegeprinciplethatis,usersandprocessesinasystemshouldhavetheleastnumberofprivileges
and for the minimal period of time necessary to perform their assigned tasks. The authority and capacity to perform certain functions should be separated and
delegatedtodifferentindividuals.Thisprincipleisoftenappliedtosplittheauthoritytowriteandapprovemonetarytransactionsbetweentwopeople.Itcanalsobe
appliedtoseparatetheauthoritytoadduserstoasystemandothersystemadministratordutiesfromtheauthoritytoassignpasswords,conductaudits,andperform
othersecurityadministratorduties.
Thereisnorelationbetweentheparitycheck,whichishardwarebased,andthelimitcheck,whichisasoftwarebasedapplication.Theparitycheckisacheckthat
testswhetherthenumberofones(1s)orzeros(0s)inanarrayofbinarydigitsisoddoreven.Oddparityisstandardforsynchronoustransmissionandevenparityfor
asynchronous transmission. In the limit check, a program tests the specified data fields against defined high or low value limits for acceptability before further
processing.TheRSAalgorithmisincorrectbecauseitusestwokeys:privateandpublic.TheDESisincorrectbecauseitusesonlyonekeyforbothencryptionand
decryption(secretorprivatekey).
228.Whichofthefollowingisthemosteffectivemethodforpasswordcreation?
a.Usingpasswordgenerators
b.Usingpasswordadvisors
c.Assigningpasswordstousers
d.Implementinguserselectedpasswords
228.b.Passwordadvisorsarecomputerprogramsthatexamineuserchoicesforpasswordsandinformtheusersifthepasswordsareweak.Passwordsproducedby
passwordgeneratorsaredifficulttoremember,whereasuserselectedpasswordsareeasytoguess.Userswritethepassworddownonapaperwhenitisassignedto
them.
229.Whichoneofthefollowingitemsisamorereliableauthenticationdevicethantheothers?
a.Fixedcallbacksystem
b.Variablecallbacksystem
c.Fixedandvariablecallbacksystem
d.Smartcardsystem
229.d.Authenticationisprovidingassuranceabouttheidentityofasubjectorobjectforexample,ensuringthataparticularuseriswhoheclaimstobe.Asmartcard
systemusescryptographicbasedsmarttokensthatoffergreatflexibilityandcansolvemanyauthenticationproblemssuchasforgeryandmasquerading.Asmart
tokentypicallyrequiresausertoprovidesomethingtheuserknows(i.e.,aPINorpassword),whichprovidesastrongercontrolthanthesmarttokenalone.Smart
cardsdonotrequireacallbackbecausethecodesusedinthesmartcardchangefrequently,whichcannotberepeated.
Callbacksystemsareusedtoauthenticateaperson.Afixedcallbacksystemcallsbacktoaknowntelephoneassociatedwithaknownplace.However,thecalled
personmaynotbeknown,anditisaproblemwithmasquerading.Itisnotonlyinsecurebutalsoinflexiblebecauseitistiedtoaspecificplace.Itisnotapplicableif
the caller moves around. A variable callback system is more flexible than the fixed one but requires greater maintenance of the variable telephone numbers and
locations.Thesephonenumberscanberecordedordecodedbyahacker.
230.Whatdoesanexampleofadrawbackofsmartcardsinclude?
a.Ameansofaccesscontrol
b.Ameansofstoringuserdata
c.Ameansofgainingunauthorizedaccess
d.Ameansofaccesscontrolanddatastorage
230.c.Becausevaluabledataisstoredonasmartcard,thecardisuselessiflost,damaged,orforgotten.Anunauthorizedpersoncangainaccesstoacomputersystem
intheabsenceofotherstrongcontrols.Asmartcardisacreditcardsizeddevicecontainingoneormoreintegratedcircuitchips,whichperformsthefunctionsofa
microprocessor,memory,andaninput/outputinterface.
Smartcardscanbeused(i)asameansofaccesscontrol,(ii)asamediumforstoringandcarryingtheappropriatedata,and(iii)acombinationof(1)and(2).
231.Whichofthefollowingisamoresimpleandbasiclogincontrol?
a.Validatingusernameandpassword
b.Monitoringunsuccessfullogins
c.Sendingalertstothesystemoperators
d.Disablingaccountswhenabreakinoccurs
231.a.Logincontrolsspecifytheconditionsusersmustmeetforgainingaccesstoacomputersystem.Inmostsimpleandbasiccases,accesswillbepermittedonly
whenbothausernameandpasswordareprovided.Morecomplexsystemsgrantordenyaccessbasedonthetypeofcomputerloginthatis,local,dialup,remote,
network,batch,orsubprocess.Thesecuritysystemcanrestrictaccessbasedonthetypeoftheterminal,ortheremotecomputer'saccesswillbegrantedonlywhenthe
userorprogramislocatedatadesignatedterminalorremotesystem.Also,accesscanbedefinedbythetimeofdayandthedayoftheweek.Asafurtherprecaution,the
morecomplexandsophisticatedsystemsmonitorunsuccessfullogins,sendmessagesoralertstothesystemoperator,anddisableaccountswhenabreakinoccurs.
232.Therearetradeoffsamongcontrols.Asecuritypolicywouldbemostusefulinwhichofthefollowingareas?
1.Systemgeneratedpasswordsversususergeneratedpasswords
2.Accessversusconfidentiality
3.Technicalcontrolsversusproceduralcontrols
4.Manualcontrolsversusautomatedcontrols
a.1and2
b.3and4
c.2and3
d.2and4
232.c.Asecuritypolicyistheframeworkwithinwhichanorganizationestablishesneededlevelsofinformationsecuritytoachievethedesiredconfidentialitygoals.
Apolicyisastatementofinformationvalues,protectionresponsibilities,andorganizationalcommitmentforacomputersystem.Itisasetoflaws,rules,andpractices
thatregulatehowanorganizationmanages,protects,anddistributessensitiveinformation.
Therearetradeoffsamongcontrolssuchastechnicalcontrolsandproceduralcontrols.Iftechnicalcontrolsarenotavailable,proceduralcontrolsmightbeuseduntila
technicalsolutionisfound.Nevertheless,technicalcontrolsareuselesswithoutproceduralcontrolsandarobustsecuritypolicy.
Similarly,thereisatradeoffbetweenaccessandconfidentialitythatis,asystemmeetingstandardsforaccessallowsauthorizedusersaccesstoinformationresources
onanongoingbasis.Theemphasisgiventoconfidentiality,integrity,andaccessdependsonthenatureoftheapplication.Anindividualsystemmaysacrificethe
levelofonerequirementtoobtainagreaterdegreeofanother.Forexample,toallowforincreasedlevelsofavailabilityofinformation,standardsforconfidentiality
maybelowered.Thus,thespecificrequirementsandcontrolsforinformationsecuritycanvary.
Passwordsandcontrolsalsoinvolvetradeoffs,butatalowerlevel.Passwordsrequiredecidingbetweensystemgeneratedpasswords,whichcanoffermoresecurity
thanusergeneratedpasswordsbecausesystemgeneratedpasswordsarerandomlygeneratedpseudowordsnotfoundinthedictionary.However,systemgenerated
passwordsarehardertoremember,forcinguserstowritethemdown,thusdefeatingthepurpose.Controlsrequireselectingbetweenamanualandautomatedcontrolor
selectingacombinationofmanualandautomatedcontrols.Onecontrolcanworkasacompensatingcontrolfortheother.
233.Ensuringdataandprogramintegrityisimportant.Whichofthefollowingcontrolsbestappliestheseparationofdutiesprincipleinan
automatedcomputeroperationsenvironment?
a.Fileplacementcontrols
b.Datafilenamingconventions
c.Programlibrarycontrols
d.Programandjobnamingconventions
233.c.Programlibrarycontrolsenableonlyassignedprogramstoruninproductionandeliminatetheproblemoftestprogramsaccidentallyenteringtheproduction
environment.Theyalsoseparateproductionandtestingdatatoensurethatnotestdataareusedinnormalproduction.Thispracticeisbasedontheseparationof
dutiesprinciple.
Fileplacementcontrolsensurethatfilesresideontheproperdirectaccessstoragedevicesothatdatasetsdonotgotoawrongdevicebyaccident.Datafile,program,
andjobnamingconventionsimplementtheseparationofdutiesprinciplebyuniquelyidentifyingeachproductionandtestdatafilenames,programnames,job
names,andterminalusage.
234.Whichofthefollowingpairsofhighlevelsystemservicesprovidecontrolledaccesstonetworks?
a.Accesscontrollistsandaccessprivileges
b.Identificationandauthentication
c.Certificationandaccreditation
d.Accreditationandassurance
234.b. Controlling access to the network is provided by the network's identification and authentication services, which go together. This service is pivotal in
providingcontrolledaccesstotheresourcesandservicesofferedbythenetworkandinverifyingthatthemechanismsprovideproperprotection.Identificationisthe
processthatenablesrecognitionofanentitybyacomputersystem,generallybytheuseofuniquemachinereadableusernames.Authenticationistheverificationof
theentity'sidentification.Thatiswhenthehost,towhomtheentitymustprovehisidentity,trusts(throughanauthenticationprocess)thattheentityiswhohe
claimstobe.Thethreattothenetworkthattheidentificationandauthenticationservicemustprotectagainstisimpersonation.
Accesscontrollist(ACL)andaccessprivilegesdonotprovidecontrolledaccesstonetworksbecauseACLisalistofthesubjectsthatarepermittedtoaccessan
objectandtheaccessrights(privileges)ofeachsubject.Thisservicecomesafterinitialidentificationandauthenticationservice.
Certificationandaccreditationservicesdonotprovidecontrolledaccesstonetworksbecausecertificationistheadministrativeactofapprovingacomputersystemfor
useinaparticularapplication.Accreditationisthemanagement'sformalacceptanceoftheadequacyofacomputersystem'ssecurity.Certificationandaccreditationare
similarinconcept.Thisservicecomesafterinitialidentificationandauthenticationservice.
Accreditationandassuranceservicesdonotprovidecontrolledaccesstonetworksbecauseaccreditationisthemanagement'sformalacceptanceoftheadequacyofa
computersystem'ssecurity.Assuranceisconfidencethatacomputersystemdesignmeetsitsrequirements.Again,thisservicecomesafterinitialidentificationand
authenticationservice.
235.Whichofthefollowingisnotsubjectedtoimpersonationattacks?
a.Packetreplay
b.Forgery
c.Relay
d.Interception
235.a.Packetreplayisoneofthemostcommonsecuritythreatstonetworksystems,similartoimpersonationandeavesdroppingintermsofdamage,butdissimilarin
termsoffunctions.Packetreplayreferstotherecordingandretransmissionofmessagepacketsinthenetwork.Itisasignificantthreatforprogramsthatrequire
authenticationsequences because an intruder could replay legitimate authentication sequence messages to gain access to a system. Packet replay is frequently
undetectablebutcanbepreventedbyusingpackettimestampingandpacketsequencecounting.
Forgeryisincorrectbecauseitisoneofthewaysanimpersonationattackisachieved.Forgeryisattemptingtoguessorotherwisefabricatetheevidencethatthe
impersonatorknowsorpossesses.
Relayisincorrectbecauseitisoneofthewaysanimpersonationattackisachieved.Relayiswhereonecaneavesdropuponanother'sauthenticationexchangeand
learnenoughtoimpersonateauser.
Interceptionisincorrectbecauseitisoneofthewaysanimpersonationattackisachieved.Interceptioniswhereonecanslipinbetweenthecommunicationsand
hijackthecommunicationschannel.
236.Whichofthefollowingsecurityfeaturesisnotsupportedbytheprincipleofleastprivilege?
a.Allornothingprivileges
b.Thegranularityofprivilege
c.Thetimeboundingofprivilege
d.Privilegeinheritance
236.a.Thepurposeofaprivilegemechanismistoprovideameansofgrantingspecificusersorprocessestheabilitytoperformsecurityrelevantactionsforalimited
timeandunderarestrictivesetofconditions,whilestillpermittingtasksproperlyauthorizedbythesystemadministrator.Thisistheunderlyingthemebehindthe
securityprincipleofleastprivilege.Itdoesnotimplyanallornothingprivilege.
Thegranularityofprivilegeisincorrectbecauseitisoneofthesecurityfeaturessupportedbytheprincipleofleastprivilege.Aprivilegemechanismthatsupports
granularityofprivilegecanenableaprocesstooverrideonlythosesecurityrelevantfunctionsneededtoperformthetask.Forexample,abackupprogramneedsto
overrideonlyreadrestrictions,notthewriteorexecuterestrictiononfiles.
Thetimeboundingofprivilegeisincorrectbecauseitisoneofthesecurityfeaturessupportedbytheprincipleofleastprivilege.Thetimeboundingofprivilegeis
relatedinthatprivilegesrequiredbyanapplicationoraprocesscanbeenabledanddisabledastheapplicationorprocessneedsthem.
Privilegeinheritanceisincorrectbecauseitisoneofthesecurityfeaturessupportedbytheprincipleofleastprivilege.Privilegeinheritanceenablesaprocessimageto
requestthatall,some,ornoneofitsprivilegesgetpassedontothenextprocessimage.Forexample,applicationprogramsthatexecuteotherutilityprogramsneednot
passonanyprivilegesiftheutilityprogramdoesnotrequirethem.
237.Authenticationisaprotectionagainstfraudulenttransactions.Authenticationprocessdoesnotassumewhichofthefollowing?
a.Validityofmessagelocationbeingsent
b.Validityoftheworkstationsthatsentthemessage
c.Integrityofthemessagethatistransmitted
d.Validityofthemessageoriginator
237.c.Authenticationassuresthatthedatareceivedcomesfromthesupposedorigin.Itisnotextendedtoincludetheintegrityofthedataormessagestransmitted.
However, authentication is a protection against fraudulent transactions by establishing the validity of messages sent, validity of the workstations that sent the
message,andthevalidityofthemessageoriginators.Invalidmessagescancomefromavalidorigin,andauthenticationcannotpreventit.
238.Passwordsareusedasabasicmechanismtoidentifyandauthenticateasystemuser.Whichofthefollowingpasswordrelatedfactors
cannotbetestedwithautomatedvulnerabilitytestingtools?
a.Passwordlength
b.Passwordlifetime
c.Passwordsecrecy
d.Passwordstorage
238.c.Noautomatedvulnerabilitytestingtoolcanensurethatsystemusershavenotdisclosedtheirpasswordsthussecrecycannotbeguaranteed.
Passwordlengthcanbetestedtoensurethatshortpasswordsarenotselected.Passwordlifetimecanbetestedtoensurethattheyhavealimitedlifetime.Passwords
shouldbechangedregularlyorwhenevertheymayhavebeencompromised.Passwordstoragecanbetestedtoensurethattheyareprotectedtopreventdisclosureor
unauthorizedmodification.
239.UseofloginIDsandpasswordsisthemostcommonlyusedmechanismforwhichofthefollowing?
a.Providingdynamicverificationofauser
b.Providingstaticverificationofauser
c.Providingastronguserauthentication
d.Batchandonlinecomputersystemsalike
239.b.Bydefinition,astaticverificationtakesplaceonlyonceatthestartofeachloginsession.Passwordsmayormaynotbereusable.
Dynamicverificationofausertakesplacewhenapersontypesonakeyboardandleavesanelectronicsignatureintheformofkeystrokelatenciesintheelapsedtime
betweenkeystrokes.Forwellknown,regulartypestrings,thissignaturecanbequiteconsistent.Hereishowadynamicverificationmechanismworks:Whena
personwantstoaccessacomputerresource,heisrequiredtoidentifyhimselfbytypinghisname.Thelatencyvectorofthekeystrokesofthisnameiscomparedwith
thereferencesignaturestoredinthecomputer.Ifthisclaimant'slatencyvectorandthereferencesignaturearestatisticallysimilar,theuserisgrantedaccesstothe
system.Theuserisaskedtotypehisnameanumberoftimestoprovideavectorofmeanlatenciestobeusedasareference.Thiscanbeviewedasanelectronic
signatureoftheuser.
Passwordsdonotprovideastronguserauthentication.Iftheydid,therewouldnotbeahackerproblemtoday.Passwordsprovidetheweakestuserauthenticationdue
totheirsharingandguessablenature.OnlyonlinesystemsrequireauserIDandpasswordfromauserduetotheirinteractivenature.Onlybatchjobsandfilesrequire
auserIDandpasswordwhensubmittingajobormodifyingafile.Batchsystemsarenotinteractive.
240.Whichofthefollowingpasswordselectionprocedureswouldbethemostdifficulttoremember?
a.Reverseorrearrangethecharactersintheuser'sbirthday
b.Reverseorrearrangethecharactersintheuser'sannualsalary
c.Reverseorrearrangethecharactersintheuser'sspouse'sname
d.Userandomlygeneratedcharacters
240.d.Passwordselectionisadifficulttasktobalancebetweenpasswordeffectivenessanditsremembrancebytheuser.Theselectedpasswordshouldbesimpleto
rememberforoneselfanddifficultforotherstoknow.Itisnoadvantagetohaveascientificallygeneratedpasswordiftheusercannotrememberit.Usingrandomly
generatedcharactersasapasswordisnotonlydifficulttorememberbutalsoeasytopublicize.Userswillbetemptedtowritethemdowninaconspicuousplaceifthe
passwordisdifficulttoremember.
Theapproachesintheotherthreechoiceswouldberelativelyeasytorememberduetotheuserfamiliaritywiththepasswordorigin.Asimpleprocedureistousewell
knownpersonalinformationthatisrearranged.
241.Howdoesarolebasedaccesscontrolmechanismwork?
a.Basedonjobenlargementconcept
b.Basedonjobdutiesconcept
c.Basedonjobenrichmentconcept
d.Basedonjobrotationconcept
241.b.Userstakeonassignedrolessuchasdoctor,nurse,teller,andmanager.Withrolebasedaccesscontrolmechanism,accessdecisionsarebasedontherolesthat
individualusershaveaspartofanorganization,thatis,jobduties.Jobenlargementmeansaddingwidthtoajobjobenrichmentmeansaddingdepthtoajobandjob
rotationmakesapersonwellrounded.
242.Whatdothecountermeasuresagainstarainbowattackresultingfromapasswordcrackingthreatinclude?
a.Onetimepasswordandonewayhash
b.Keyspaceandpassphrase
c.Saltingandstretching
d.Entropyanduseraccountlockout
242.c.Saltingistheinclusionofarandomvalueinthepasswordhashingprocessthatgreatlydecreasesthelikelihoodofidenticalpasswordsreturningthesamehash.
Iftwouserschoosethesamepassword,saltingcanmakeithighlyunlikelythattheirhashesarethesame.Largersaltseffectivelymaketheuseofrainbowtables
infeasible.Stretchinginvolveshashingeachpasswordanditssaltthousandsoftimes.Thismakesthecreationoftherainbowtablescorrespondinglymoretime
consuming,whilehavinglittleeffectontheamountofeffortneededbytheorganization'ssystemstoverifypasswordauthenticationattempts.
Keyspaceisthelargenumberofpossiblekeyvalues(keys)createdbytheencryptionalgorithmtousewhentransformingthemessage.Passphraseisasequenceof
characterstransformedbyapasswordsystemintoavirtualpassword.Entropyisameasureoftheamountofuncertaintythatanattackerfacestodeterminethevalueof
asecret.
243.Passwordscanbestoredsafelyinwhichofthefollowingplaces?
a.Initializationfile
b.Scriptfile
c.Passwordfile
d.Batchfile
243.c.Passwordsshouldnotbeincludedininitializationfiles,scriptfiles,orbatchfilesduetopossiblecompromise.Instead,theyshouldbestoredinapassword
file,preferablyencrypted.
244.Whichofthefollowingisnotacommonmethodusedtogainunauthorizedaccesstocomputersystems?
a.Passwordsharing
b.Passwordguessing
c.Passwordcapturing
d.Passwordspoofing
244.d.Passwordspoofingiswhereintruderstricksystemsecurityintopermittingnormallydisallowednetworkconnections.Thegainedpasswordsallowthemto
cracksecurityortostealvaluableinformation.Forexample,thevastmajorityofInternettrafficisunencryptedandthereforeeasilyreadable.Consequently,email,
passwords,andfiletransferscanbeobtainedusingreadilyavailablesoftware.Passwordspoofingisnotthatcommon.
Theotherthreechoicesareincorrectbecausetheyarethemostcommonlyusedmethodstogainunauthorizedaccesstocomputersystems.Passwordsharingallowsan
unauthorizedusertohavethesystemaccessandprivilegesofalegitimateuser,withthelegitimateuser'sknowledgeandacceptance.Passwordguessingoccurswhen
easytouseoreasytoremembercodesareusedandwhenotherusersknowaboutthem(e.g.,hobbies,sports,favoritestars,andsocialevents).Passwordcapturingisa
processinwhichalegitimateuserunknowinglyrevealstheuser'sloginIDandpassword.ThismaybedonethroughtheuseofaTrojanhorseprogramthatappearsto
theuserasalegitimateloginprogramhowever,theTrojanhorseprogramisdesignedtocapturepasswords.
245.WhataretheBellLaPadulaaccesscontrolmodelandmandatoryaccesscontrolpolicyexamplesof?
a.Identitybasedaccesscontrols(IBAC)
b.Attributebasedaccesscontrols(ABAC)
c.Rolebasedaccesscontrols(RBAC)
d.Rulebasedaccesscontrols(RuBAC)
245.d.Therulebasedaccesscontrol(RuBAC)isbasedonspecificrulesrelatingtothenatureofthesubjectandobject.ARuBACdecisionrequiresauthorization
informationandrestrictioninformationtocomparebeforeanyaccessisgranted.BothBellLaPadulaaccesscontrolmodelandmandatoryaccesscontrolpolicydeals
withrules.Theotherthreechoicesdonotdealwithrules.
246.Whichofthefollowingsecuritysolutionsforaccesscontrolissimpletouseandeasytoadminister?
a.Passwords
b.Cryptographictokens
c.Hardwarekeys
d.Encrypteddatafiles
246.c.Hardwarekeysaredevicesthatdonotrequireacomplicatedprocessofadministeringuserrightsandaccessprivileges.Theyaresimplekeys,similartodoor
keysthatcanbepluggedintothepersonalcomputerbeforeapersoncansuccessfullylogontoaccesscontrolleddatafilesandprograms.Eachusergetsasetofkeys
forhispersonaluse.Hardwarekeysaresimpletouseandeasytoadminister.
Passwordsisanincorrectanswerbecausetheydorequiresomeamountofsecurityadministrativeworksuchassettinguptheaccountandhelpinguserswhenthey
forgetpasswords.Passwordsaresimpletousebuthardtoadminister.
Cryptographictokensisanincorrectanswerbecausetheydorequiresomeamountofsecurityadministrativework.Tokensneedtobeassigned,programmed,tracked,
anddisposedof.
Encrypteddatafilesisanincorrectanswerbecausetheydorequiresomeamountofsecurityadministrativework.Encryptionkeysneedtobeassignedtotheowners
forencryptionanddecryptionpurposes.
247.Cryptographicauthenticationsystemsmustspecifyhowthecryptographicalgorithmswillbeused.Whichofthefollowingauthentication
systemswouldreducetheriskofimpersonationinanenvironmentofnetworkedcomputersystems?
a.Kerberosbasedauthenticationsystem
b.Passwordbasedauthenticationsystem
c.Memorytokenbasedauthenticationsystem
d.Smarttokenbasedauthenticationsystem
247.a.TheprimarygoalofKerberosistopreventsystemusersfromclaimingtheidentityofotherusersinadistributedcomputingenvironment.TheKerberos
authentication system is based on secret key cryptography. The Kerberos protocol provides strong authentication of users and host computer systems. Further,
Kerberosusesatrustedthirdpartytomanagethecryptographickeyingrelationships,whicharecriticaltotheauthenticationprocess.Systemusershaveasignificant
degreeofcontrolovertheworkstationsusedtoaccessnetworkservices,andtheseworkstationsmustthereforebeconsiderednottrusted.
Kerberoswasdevelopedtoprovidedistributednetworkauthenticationservicesinvolvingclient/serversystems.Aprimarythreatinthistypeofclient/serversystem
isthepossibilitythatoneuserclaimstheidentityofanotheruser(impersonation),therebygainingaccesstosystemserviceswithouttheproperauthorization.To
protectagainstthisthreat,Kerberosprovidesatrustedthirdpartyaccessibletonetworkentities,whichsupportstheservicesrequiredforauthenticationbetween
theseentities.ThistrustedthirdpartyisknownastheKerberoskeydistributionserver,whichsharessecretcryptographickeyswitheachclientandserverwithina
particularrealm.TheKerberosauthenticationmodelisbaseduponthepresentationofcryptographicticketstoprovetheidentityofclientsrequestingservicesfroma
hostsystemorserver.
Theotherthreechoicesareincorrectbecausetheycannotreducetheriskofimpersonation.Forexample:(i)passwordscanbeshared,guessed,orcapturedand(ii)
memorytokensandsmarttokenscanbelostorstolen.Also,thesethreechoicesdonotuseatrustedthirdpartytostrengthencontrolsasKerberosdoes.
248.WhatdotheweaknessesofKerberosinclude?
1.Subjecttodictionaryattacks.
2.Workswithexistingsecuritysystemssoftware.
3.Interceptingandanalyzingnetworktrafficisdifficult.
4.Everynetworkapplicationmustbemodified.
a.1and2
b.2and3
c.1and4
d.3and4
248.c. Kerberos is an authentication system with encryption mechanisms that make network traffic secure. Weaknesses of Kerberos include (i) it is subject to
dictionaryattackswherepasswordscanbestolenbyanattackerand(ii)itrequiresmodificationofallnetworkapplicationsourcecode,whichisaproblemwith
vendordevelopedapplicationswithnosourcecodeprovidedtousers.Kerberosstrengthsincludethatitcanbeaddedtoanexistingsecuritysystemandthatitmakes
interceptingandanalyzingnetworktrafficdifficult.ThisisduetotheuseofencryptioninKerberos.
249.Lesscommonwaystoinitiateimpersonationattacksonthenetworkincludetheuseofwhichofthefollowing?
a.Firewallsandaccountnames
b.Passwordsandaccountnames
c.Biometricchecksandphysicalkeys
d.Passwordsanddigitalcertificates
249.c.Impersonationattacksinvolvingtheuseofphysicalkeysandbiometricchecksarelesslikelyduetotheneedforthenetworkattackertobephysicallynearthe
biometricequipment.Passwordsandaccountnamesareincorrectbecausetheyarethemostcommonwaytoinitiateimpersonationattacksonthenetwork.Afirewall
isamechanismtoprotectITcomputingsitesagainstInternetborneattacks.Mostdigitalcertificatesarepasswordprotectedandhaveanencryptedfilethatcontains
identificationinformationaboutitsholder.
250.WhichofthefollowingsecurityservicescanKerberosbestprovide?
a.Authentication
b.Confidentiality
c.Integrity
d.Availability
250.a. Kerberos is a de facto standard for an authentication protocol, providing a robust authentication method. Kerberos was developed to enable network
applicationstosecurelyidentifytheirpeersandcanbeusedforlocal/remotelogins,remoteexecution,filetransfer,transparentfileaccess(i.e.,accessofremotefileson
the network as though they were local) and for client/server requests. The Kerberos system includes a Kerberos server, applications which use Kerberos
authentication,andlibrariesforuseindevelopingapplicationswhichuseKerberosauthentication.Inadditiontosecureremoteprocedurecall(SecureRPC),Kerberos
preventsimpersonationinanetworkenvironmentandonlyprovidesauthenticationservices.Otherservicessuchasconfidentiality,integrity,andavailabilitymustbe
providedbyothermeans.WithKerberosandsecureRPC,passwordsarenottransmittedoverthenetworkinplaintext.
InKerberostwoitemsneedtoproveauthentication.Thefirstistheticketandthesecondistheauthenticator.Theticketconsistsoftherequestedservername,the
clientname,theaddressoftheclient,thetimetheticketwasissued,thelifetimeoftheticket,thesessionkeytobeusedbetweentheclientandtheserver,andsome
otherfields.Theticketisencryptedusingtheserver'ssecretkeyandthuscannotbecorrectlydecryptedbytheuser.Iftheservercanproperlydecrypttheticketwhen
theclientpresentsitandiftheclientpresentstheauthenticatorencryptedusingthesessionkeycontainedintheticket,theservercanhaveconfidenceintheuser's
identity.Theauthenticatorcontainstheclientname,address,currenttime,andsomeotherfields.Theauthenticatorisencryptedbytheclientusingthesessionkey
sharedwiththeserver.Theauthenticatorprovidesatimevalidationforthecredential.Ifauserpossessesboththepropercredentialandtheauthenticatorencrypted
withthecorrectsessionkeyandpresentstheseitemswithinthelifetimeoftheticket,thentheuser'sidentitycanbeauthenticated.
Confidentialityisincorrectbecauseitensuresthatdataisdisclosedtoonlyauthorizedsubjects.Integrityisincorrectbecauseitisthepropertythatanobjectis
changedonlyinaspecifiedandauthorizedmanner.Availabilityisincorrectbecauseitisthepropertythatagivenresourcewillbeusableduringagiventimeperiod.
251.Whatisthemajoradvantageofasinglesignon?
a.Itreducesmanagementwork.
b.Itisaconveniencefortheenduser.
c.Itauthenticatesauseronce.
d.Itprovidesacentralizedadministration.
251.b.Underasinglesignon(SSO),ausercanauthenticateoncetogainaccesstomultipleapplicationsthathavebeenpreviouslydefinedinthesecuritysystem.The
SSOsystemisconvenientfortheenduserinthatitprovidesfewerareastomanagewhencomparedtomultiplesignonsystems,butSSOisrisky.Manypointsof
failureexistinmultiplesignonsystemsastheyareinconvenientfortheenduserbecauseofmanyareastomanage.
252.Kerberoscanpreventwhichoneofthefollowingattacks?
a.Tunnelingattack
b.Playbackattack
c.Destructiveattack
d.Processattack
252.b.Inaplayback(replay)attack,messagesreceivedfromsomethingorfromsomewherearereplayedbacktoit.Itisalsocalledareflectionattack.Kerberosputsthe
timeofdayintherequesttopreventaneavesdropperfrominterceptingtherequestforserviceandretransmittingitfromthesamehostatalatertime.
Atunnelingattackattemptstoexploitaweaknessinasystemthatexistsatalevelofabstractionlowerthanthatusedbythedevelopertodesignthesystem.For
example,anattackermightdiscoverawaytomodifythemicrocodeofaprocessorusedwhenencryptingsomedata,ratherthanattemptingtobreakthesystem's
encryptionalgorithm.
Destructiveattacksdamageinformationinafashionthatdeniesservice.Theseattackscanbepreventedbyrestrictingaccesstocriticaldatafilesandprotectingthem
fromunauthorizedusers.
Inprocessattacks,oneusermakesacomputerunusableforothersthatusethecomputeratthesametime.Theseattacksareapplicabletosharedcomputers.
253.Fromanaccesscontrolpointofview,whichofthefollowingareexamplesofhistorybasedaccesscontrolpolicies?
2.Workflowpolicy
4.ChineseWallpolicy
a.1and2
b.1and3
c.2and4
d.3and4
253.c.Historybasedaccesscontrolpoliciesaredefinedintermsofsubjectsandeventswheretheeventsofthesystemarespecifiedastheobjectaccessoperations
associatedwithactivityataparticularsecuritylevel.Thisassumesthatthesecuritypolicyisdefinedintermsofthesequenceofeventsovertime,andthatthesecurity
policydecideswhicheventsofthesystemarepermittedtoensurethatinformationdoesnotflowinanunauthorizedmanner.Historybasedaccesscontrolpoliciesare
notbasedonstandardaccesscontrolmechanismbutbasedonpracticalapplications.Inthehistorybasedaccesscontrolpolicies,previousaccesseventsareusedas
oneofthedecisionfactorsforthenextaccessauthorization.TheworkflowandtheChineseWallpoliciesareexamplesofhistorybasedaccesscontrolpolicies.
254.Whichofthefollowingismostcommonlyusedintheimplementationofanaccesscontrolmatrix?
c.Accesscontrollist
254.c.Theaccesscontrollist(ACL)isthemostusefulandflexibletypeofimplementationofanaccesscontrolmatrix.TheACLpermitsanygivenusertobeallowed
ordisallowedaccesstoanyobject.ThecolumnsofanACLshowalistofusersattachedtoprotectedobjects.Onecanassociateaccessrightsforindividualsand
resourcesdirectlywitheachobject.Theotherthreechoicesrequireextensiveadministrativeworkandareusefulbutnotthatflexible.
255.WhatisKerberos?
a.Accessorientedprotectionsystem
b.Ticketorientedprotectionsystem
c.Listorientedprotectionsystem
d.Lockandkeyorientedprotectionsystem
255.b.Kerberoswasdevelopedtoenablenetworkapplicationstosecurelyidentifytheirpeers.Itusesaticket,whichidentifiestheclient,andanauthenticatorthat
servestovalidatetheuseofthatticketandpreventanintruderfromreplayingthesametickettotheserverinafuturesession.Aticketisvalidonlyforagiventime
interval.Whentheintervalends,theticketexpires,andanylaterauthenticationexchangesrequireanewticket.
An accessoriented protection system can be based on hardware or software or a combination of both to prevent and detect unauthorized access and to permit
authorizedaccess.Inlistorientedprotectionsystems,eachprotectedobjecthasalistofallsubjectsauthorizedtoaccessit.Alockandkeyorientedprotectionsystem
involves matching a key or password with a specific access requirement. The other three choices do not provide a strong authentication protection, as does the
Kerberos.
256.Forintrusiondetectionandpreventionsystemcapabilitiesusinganomalybaseddetection,administratorsshouldcheckwhichofthe
followingtodeterminewhethertheyneedtobeadjustedtocompensateforchangesinthesystemandchangesinthreats?
a.Whitelists
b.Thresholds
c.Programcodeviewing
d.Blacklists
256.b.Administratorsshouldchecktheintrusiondetectionandpreventionsystem(IDPS)thresholdsandalertsettingstodeterminewhethertheyneedtobeadjusted
periodicallytocompensateforchangesinthesystemenvironmentandchangesinthreats.Theotherthreechoicesareincorrectbecausetheanomalybaseddetection
doesnotusewhitelists,blacklists,andprogramcodeviewing.
257.Intrusiondetectionsystemscannotdowhichofthefollowing?
a.Reportalterationstodatafiles
b.Traceuseractivity
c.Compensateforweakauthentication
d.Interpretsystemlogs
257.c. An intrusion detection system (IDS) cannot act as a silver bullet, compensating for weak identification and authentication mechanisms, weaknesses in
networkprotocols,orlackofasecuritypolicy.IDScandotheotherthreechoices,suchasrecognizingandreportingalterationstodatafiles,tracinguseractivityfrom
thepointofentrytothepointofexitorimpact,andinterpretingthemassofinformationcontainedinoperatingsystemlogsandaudittraillogs.
258.Intrusiondetectionsystemscandowhichofthefollowing?
a.Analyzeallthetrafficonabusynetwork
b.Dealwithproblemsinvolvingpacketlevelattacks
c.Recognizeaknowntypeofattack
d.Dealwithhighspeedasynchronoustransfermodenetworks
258.c.Intrusiondetectionsystems(IDS)canrecognizewhenaknowntypeofattackisperpetratedonasystem.However,IDScannotdothefollowing:(i)analyzeall
thetrafficonabusynetwork,(ii)compensateforreceivingfaultyinformationfromsystemsources,(iii)alwaysdealwithproblemsinvolvingpacketlevelattacks
(e.g., an intruder using fabricated packets that elude detection to launch an attack or multiple packets to jam the IDS itself), and (iv) deal with highspeed
asynchronoustransfermodenetworksthatusepacketfragmentationtooptimizebandwidth.
259.Whatisthemostriskypartoftheprimarynatureofaccesscontrol?
a.Configuredormisconfigured
b.Enabledordisabled
c.Privilegedorunprivileged
d.Encryptedordecrypted
259.b.Accesscontrolsoftwarecanbeenabledordisabled,meaningsecurityfunctioncanbeturnedonoroff.Whendisabled,theloggingfunctiondoesnotwork.The
otherthreechoicesaresomewhatriskybutnotasmuchasenabledordisabled.
260.Intrusiondetectionreferstotheprocessofidentifyingattemptstopenetrateacomputersystemandgainunauthorizedaccess.Whichofthe
followingassistsinintrusiondetection?
a.Auditrecords
b.Accesscontrollists
c.Securityclearances
d.Hostbasedauthentication
260.a.Ifauditrecordsshowingtrailshavebeendesignedandimplementedtorecordappropriateinformation,theycanassistinintrusiondetection.Usually,audit
recordscontainpertinentdata(e.g.,date,time,statusofanaction,userIDs,andeventID),whichcanhelpinintrusiondetection.
Accesscontrollistsrefertoaregisterofuserswhohavebeengivenpermissiontouseaparticularsystemresourceandthetypesofaccesstheyhavebeenpermitted.
Securityclearancesareassociatedwithasubject(e.g.,personandprogram)toaccessanobject(e.g.,files,libraries,directories,anddevices).Hostbasedauthentication
grantsaccessbasedupontheidentityofthehostoriginatingtherequest,insteadoftheidentityoftheusermakingtherequest.Theotherthreechoiceshaveno
facilitiestorecordaccessactivityandthereforecannotassistinintrusiondetection.
261.Whichofthefollowingisthetechniqueusedinanomalydetectioninintrusiondetectionsystemswhereuserandsystembehaviorsare
expressedintermsofcounts?
a.Parametricstatistics
b.Thresholddetectionmeasures
c.Rulebasedmeasures
d.Nonparametricstatistics
261.b.Anomalydetectorsidentifyabnormal,unusualbehavior(anomalies)onahostornetwork.Inthresholddetectionmeasures,certainattributesofuserandsystem
behaviorareexpressedintermsofcounts,withsomelevelestablishedaspermissible.Suchbehaviorattributescanincludethenumberoffilesaccessedbyauserina
givenperiodoftime.
Statisticalmeasuresincludeparametricandnonparametric.Inparametricmeasuresthedistributionoftheprofiledattributesisassumedtofitaparticularpattern.Inthe
nonparametricmeasuresthedistributionoftheprofiledattributesislearnedfromasetofhistoricaldatavalues,observedovertime.
Rulebasedmeasuresaresimilartononparametricstatisticalmeasuresinthatobserveddatadefinesacceptableusagepatternsbutdiffersinthatthosepatternsare
specifiedasrules,notnumericquantities.
262.Whichofthefollowingisbesttoreplacetheuseofpersonalidentificationnumbers(PINs)intheworldofautomatedtellermachines
(ATMs)?
a.Irisdetectiontechnology
b.Voicetechnology
c.Handtechnology
d.Fingerprinttechnology
262.a.AnATMcustomercanstandwithinthreefeetofacamerathatautomaticallylocatesandscanstheirisintheeye.Thescannedbarcodeisthencomparedagainst
previously stored code in the bank's file. Irisdetection technology is far superior for accuracy compared to the accuracy of voice, face, hand, and fingerprint
identificationsystems.IristechnologydoesnotrequireaPIN.
263.Whichofthefollowingistrueaboutbiometrics?
a.Leastexpensiveandleastsecure
b.Mostexpensiveandleastsecure
c.Mostexpensiveandmostsecure
d.Leastexpensiveandmostsecure
263.c.Biometricstendstobethemostexpensiveandmostsecure.Ingeneral,passwordsaretheleastexpensiveauthenticationtechniqueandgenerallytheleast
secure.Memorytokensarelessexpensivethansmarttokensbuthavelessfunctionality.Smarttokenswithahumaninterfacedonotrequirereadingequipmentbutare
moreconvenienttouse.
264.Whichofthefollowingispreferableforenvironmentsathighriskofidentityspoofing?
a.Digitalsignature
b.Onetimepasswords
c.Digitalcertificate
d.Mutualauthentication
264.d.Ifaonewaymethodisusedtoauthenticatetheinitiator(typicallyaroadwarrior)totheresponder(typicallyanIPsecgateway),adigitalsignatureisusedto
authenticatetherespondertotheinitiator.Onewayauthentication,suchasonetimepasswordsordigitalcertificatesontokensiswellsuitedforroadwarriorusage,
whereasmutualauthenticationispreferableforenvironmentsathighriskofidentityspoofing,suchaswirelessnetworks.
265.Whichofthefollowingisnotasubstituteforloggingoutoftheinformationsystem?
a.Previouslogonnotification
b.Concurrentsessioncontrol
c.Sessionlock
d.Sessiontermination
265.c.Bothusersandthesystemcaninitiatesessionlockmechanisms.However,asessionlockisnotasubstituteforloggingoutoftheinformationsystembecause
itisdoneattheendoftheworkday.Previouslogonnotificationoccursatthetimeoflogin.Concurrentsessioncontroldealswitheitherallowingornotallowing
multiple sessions at the same time. Session termination can occur when there is a disconnection of the telecommunications link or other network operational
problems.
266.Whichofthefollowingviolatesauser'sprivacy?
a.Freeware
b.Firmware
c.Spyware
d.Crippleware
266.c.Spywareismalicioussoftware(i.e.,malware)intendedtoviolateauser'sprivacybecauseitisinvadingmanycomputersystemstomonitorpersonalactivities
andtoconductfinancialfraud.
Freewareisincorrectbecauseitissoftwaremadeavailabletothepublicatnocost,buttheauthorretainsthecopyrightandcanplacerestrictionsonhowtheprogram
isused.Somefreewarecanbeharmlesswhereasothersareharmful.Notallfreewareviolatesauser'sprivacy.
Firmwareisincorrectbecauseitissoftwarethatispermanentlystoredinahardwaredevice,whichenablesreadingbutnotwritingormodifying.Themostcommon
deviceforfirmwareisreadonlymemory(ROM).
Cripplewareisincorrectbecauseitenablestrial(limited)versionsofvendorproductsthatoperateonlyforalimitedperiodoftime.Cripplewaredoesnotviolatea
user'sprivacy.
267.Networkbasedintrusionpreventionsystems(IPS)aretypicallydeployed:
a.Inline
b.Outline
c.Online
d.Offline
267.a.NetworkbasedIPSperformspacketsniffingandanalyzesnetworktraffictoidentifyandstopsuspiciousactivity.Theyaretypicallydeployedinline,which
meansthatthesoftwareactslikeanetworkfirewall.Itreceivespackets,analyzesthem,anddecideswhethertheyshouldbepermitted,andallowsacceptablepacketsto
passthrough.Theydetectsomeattacksonnetworksbeforetheyreachtheirintendedtargets.Theotherthreechoicesarenotrelevanthere.
268.Identitythievescangetpersonalinformationthroughwhichofthefollowingmeans?
1.Dumpsterdiving
2.Skimming
3.Phishing
4.Pretexting
a.1only
b.3only
c.1and3
d.1,2,3,and4
268.d.Identitythievesgetpersonalinformationbystealingrecordsorinformationwhiletheyareonthejob,bribinganemployeewhohasaccesstotheserecords,
hackingelectronicrecords,andconninginformationoutofemployees.Sourcesofpersonalinformationincludethefollowing:Dumpsterdiving,whichincludes
rummagingthroughpersonaltrash,abusiness'trash,orpublictrashdumps.
Skimming includes stealing credit card or debit card numbers by capturing the information in a data storage device. Phishing and pretexting deal with stealing
informationthroughemailorphonebyposingaslegitimatecompaniesandclaimingthatyouhaveaproblemwithyouraccount.Thispracticeisknownasphishing
onlineorpretexting(socialengineering)byphonerespectively.
269.Whichofthefollowingapplicationrelatedauthenticationtypesisrisky?
a.Externalauthentication
b.Proprietaryauthentication
c.Passthroughauthentication
d.Host/userauthentication
269.c. Passthrough authentication refers to passing operating system credentials (e.g., username and password) unencrypted from the operating system to the
applicationsystem.Thisisriskyduetounencryptedcredentials.Notethatpassthroughauthenticationscanbeencryptedorunencrypted.
Externalauthenticationisincorrectbecauseitusesadirectoryserver,whichisnotrisky.Proprietaryauthenticationisincorrectbecauseusernameandpasswordsare
partoftheapplication,nottheoperatingsystem.Thisislessrisky.Host/userauthenticationisincorrectbecauseitisperformedwithinacontrolledenvironment(e.g.,
managedworkstationsandserverswithinanorganization).Someapplicationsmayrelyonpreviousauthenticationperformedbytheoperatingsystem.Thisisless
risky.
270.Inferenceattacksarebasedonwhichofthefollowing?
a.Hardwareandsoftware
b.Firmwareandfreeware
c.Dataandinformation
d.Middlewareandcourseware
270.c.Aninferenceattackiswhereauseroranintrudercandeduceinformationtowhichhehadnoprivilegefrominformationtowhichhehasprivilege.
271.Outofbandattacksagainstelectronicauthenticationprotocolsincludewhichofthefollowing?
1.Passwordguessingattack
2.Replayattack
3.Verifierimpersonationattack
4.Maninthemiddleattack
a.1only
b.3only
c.1and2
d.3and4
271.d.Inanoutofbandattack,theattackisagainstanauthenticationprotocolrunwheretheattackerassumestheroleofasubscriberwithagenuineverifieror
relyingparty.Theattackerobtainssecretandsensitiveinformationsuchaspasswordsandaccountnumbersandamountswhenasubscribermanuallyenterstheminto
aonetimepassworddeviceorconfirmationcodesenttotheverifierorrelyingparty.
In an outofband attack, the attacker alters the authentication protocol channel through session hijacking, verifier impersonation, or maninthemiddle (MitM)
attacks.Inaverifierimpersonationattack,theattackerimpersonatestheverifierandinducestheclaimanttorevealhissecrettoken.TheMitMattackisanattackonthe
authenticationprotocolruninwhichtheattackerpositionshimselfinbetweentheclaimantandverifiersothathecaninterceptandalterdatatravelingbetweenthem.
Inapasswordguessingattack,animpostorattemptstoguessapasswordinrepeatedlogontrialsandsucceedswhenhecanlogontoasystem.Inareplayattack,an
attackerrecordsandreplayssomepartofapreviousgoodprotocolruntotheverifier.Bothpasswordguessingandreplayattacksareexamplesofinbandattacks.Inan
inband attack, the attack is against an authentication protocol where the attacker assumes the role of a claimant with a genuine verifier or actively alters the
authenticationchannel.Thegoaloftheattackistogainauthenticatedaccessorlearnauthenticationsecrets.
272.Whichofthefollowinginformationsecuritycontrolfamiliesrequiresacrosscuttingapproach?
a.Accesscontrol
b.Auditandaccountability
c.Awarenessandtraining
d.Configurationmanagement
272.a. Access control requires a crosscutting approach because it is related to access control, incident response, audit and accountability, and configuration
managementcontrolfamilies(areas).Crosscuttingmeansacontrolinoneareaaffectsthecontrolsinotherrelatedareas.Theotherthreechoicesrequireacontrol
specificapproach.
273.Confidentialitycontrolsincludewhichofthefollowing?
a.Cryptography
b.Passwords
c.Tokens
d.Biometrics
273.a.Cryptography,whichisapartoftechnicalcontrol,ensurestheconfidentialitygoal.Theotherthreechoicesarepartofuseridentificationandauthentication
controls,whicharealsoapartoftechnicalcontrol.
274.Whichofthefollowingisnotanexampleofauthorizationandaccesscontrols?
a.Logicalaccesscontrols
b.Rolebasedaccesscontrols
c.Reconstructionoftransactions
d.Systemprivileges
274.c.Reconstructionoftransactionsisapartofaudittrailmechanisms.Theotherthreechoicesareapartofauthorizationandaccesscontrols.
275.Whichofthefollowingisnotanexampleofaccesscontrolpolicy?
a.Performancebasedpolicy
c.Rolebasedpolicy
d.Rulebasedpolicy
275.a.Performancebasedpolicyisusedtoevaluateanemployee'sperformanceannuallyorothertimes.Theotherthreechoicesareexamplesofanaccesscontrol
policywheretheycontrolaccessbetweenusersandobjectsintheinformationsystem.
276.Fromsecurityandsafetyviewpoints,whichofthefollowingdoesnotsupportthestaticseparationofdutyconstraints?
a.Mutuallyexclusiveroles
b.Reducedchancesofcollusion
c.Conflictofinterestintasks
d.Implicitconstraints
276.d.Itisdifficulttomeetthesecurityandsafetyrequirementswithflexibleaccesscontrolpoliciesexpressedinimplicitconstraintssuchasrolebasedaccess
control(RBAC)andrulebasedaccesscontrol(RuBAC).Staticseparationofdutyconstraintsrequirethattworolesofanindividualmustbemutuallyexclusive,
constraintsmustreducethechancesofcollusion,andconstraintsmustminimizetheconflictofinterestintaskassignmentstoemployees.
277.Whichofthefollowingarecompatiblewitheachotherinthepairinperformingsimilarfunctionsininformationsecurity?
a.SSOandRSO
b.DESandDNS
c.ARPandPPP
d.SLIPandSKIP
277.b.Asinglesignon(SSO)technologyallowsausertoauthenticateonceandthenaccessalltheresourcestheuserisauthorizedtouse.Areducedsignon(RSO)
technologyallowsausertoauthenticateonceandthenaccessmany,butnotall,oftheresourcestheuserisauthorizedtouse.Hence,SSOandRSOperformsimilar
functions.
Theotherthreechoicesdonotperformsimilarfunctions.Dataencryptionstandard(DES)isasymmetriccipherencryptionalgorithm.Domainnamesystem(DNS)
providesanInternettranslationservicethatresolvesdomainnamestoInternetProtocol(IP)addressesandviceversa.Addressresolutionprotocol(ARP)isusedto
obtainanode'sphysicaladdress.Pointtopointprotocol(PPP)isadatalinkframingprotocolusedtoframedatapacketsonpointtopointlines.SeriallineInternet
protocol(SLIP)carriesInternetProtocol(IP)overanasynchronousserialcommunicationline.PPPreplacedSLIP.SimplekeymanagementforInternetprotocol(SKIP)
isdesignedtoworkwiththeIPsecandoperatesatthenetworklayeroftheTCP/IPprotocol,andworksverywellwithsessionlessdatagramprotocols.
278.Howisidentificationdifferentfromauthentication?
a.Identificationcomesafterauthentication.
b.Identificationrequiresapassword,andauthenticationrequiresauserID.
c.Identificationandauthenticationarethesame.
d.Identificationcomesbeforeauthentication.
278.d. Identification is the process used to recognize an entity such as a user, program, process, or device. It is performed first, and authentication is done next.
Identificationandauthenticationarenotthesame.IdentificationrequiresauserID,andauthenticationrequiresapassword.
279.Accountabilityisnotrelatedtowhichofthefollowinginformationsecurityobjectives?
a.Identification
b.Availability
c.Authentication
d.Auditing
279.b. Accountability is typically accomplished by identifying and authenticating system users and subsequently tracing their actions through audit trails (i.e.,
auditing).
280.Whichofthefollowingstatementsistrueaboutmandatoryaccesscontrol?
a.Itdoesnotusesensitivitylevels.
b.Itusestags.
c.Itdoesnotusesecuritylabels.
d.Itreducessystemperformance.
280.d.Mandatoryaccesscontrolisexpensiveandcausessystemoverhead,resultinginreducedsystemperformanceofthedatabase.Mandatoryaccesscontroluses
sensitivitylevelsandsecuritylabels.Discretionaryaccesscontrolsusetags.
281.Whatcontrolisreferredtowhenanauditorreviewsaccesscontrolsandlogs?
a.Directivecontrol
b.Preventivecontrol
c.Correctivecontrol
d.Detectivecontrol
281.d.Thepurposeofauditorsreviewingaccesscontrolsandlogsistofindoutwhetheremployeesfollowsecuritypoliciesandaccessrules,andtodetectany
violationsandanomalies.Theauditreporthelpsmanagementtoimproveaccesscontrols.
282.Logicalaccesscontrolsareatechnicalmeansofimplementingsecuritypolicydecisions.Itrequiresbalancingtheoftencompeting
interests.Whichofthefollowingtradeoffsshouldreceivethehighestinterest?
a.Userfriendliness
b.Securityprinciples
c.Operationalrequirements
d.Technicalconstraints
282.a.Amanagementofficialresponsibleforaparticularapplicationsystem,subsystem,orgroupofsystemsdevelopsthesecuritypolicy.Thedevelopmentofan
accesscontrolpolicymaynotbeaneasyendeavor.Userfriendlinessshouldreceivethehighestinterestbecausethesystemisdesignedforusers,andthesystemusage
isdeterminedbywhetherthesystemisuserfriendly.Theotherthreechoiceshaveacompetinginterestinasecuritypolicy,buttheyarenotasimportantastheuser
friendlinessissue.Anexampleofasecurityprincipleisleastprivilege.
283.Whichofthefollowingtypesofpasswordsiscounterproductive?
a.Systemgeneratedpasswords
b.Encryptedpasswords
c.Nonreusablepasswords
d.Timebasedpasswords
283.a.Apasswordgeneratingprogramcanproducepasswordsinarandomfashion,ratherthanrelyingonuserselectedones.Systemgeneratedpasswordsareusually
hardtoremember,forcinguserstowritethemdown.Thisdefeatsthewholepurposeofstrongerpasswords.
Encryptedpasswordsprotectfromunauthorizedviewingorusing.Theencryptedpasswordfileiskeptsecurewithaccesspermissiongiventosecurityadministration
formaintenanceortothepasswordssystemitself.Thisapproachisproductiveinkeepingthepasswordssecureandsecret.
Nonreusablepasswordsareusedonlyonce.Aseriesofpasswordsaregeneratedbyacryptographicsecurealgorithmandgiventotheuserforuseatthetimeoflogin.
Eachpasswordexpiresafteritsinitialuseandisnotrepeatedorstoredanywhere.Thisapproachisproductiveinkeepingthepasswordssecureandsecret.
Intimebasedpasswords,thepasswordchangeseveryminuteorso.Asmartcarddisplayssomenumbersthatareafunctionofthecurrenttimeandtheuser'ssecret
key.Togetaccess,theusermustenteranumberbasedonhisownkeyandthecurrenttime.Eachpasswordisauniqueoneandthereforeneednotbewrittendownor
guessed.Thisapproachisproductiveandeffectiveinkeepingthepasswordssecureandsecret.
284.Whichofthefollowingissuesiscloselyrelatedtologicalaccesscontrols?
a.Employeeissues
b.Hardwareissues
c.Operatingsystemssoftwareissues
d.Applicationsoftwareissues
284.a.Thelargestriskexposureremainswithemployees.Personnelsecuritymeasuresareaimedathiringhonest,competent,andcapableemployees.Jobrequirements
needtobeprogrammedintothelogicalaccesscontrolsoftware.Policyisalsocloselylinkedtopersonnelissues.Adeterrenteffectarisesamongemployeeswhenthey
areawarethattheirmisconduct(intentionalorunintentional)maybedetected.Selectingtherighttypeandaccesslevelforemployees,informingwhichemployees
needaccessaccountsandwhattypeandlevelofaccesstheyrequire,andinformingchangestoaccessrequirementsarealsoimportant.Accountsandaccessesshould
notbegrantedormaintainedforemployeeswhoshouldnothavetheminthefirstplace.Theotherthreechoicesaredistantlyrelatedtologicalaccesscontrolswhen
comparedtoemployeeissues.
285.Whichofthefollowingpasswordmethodsarebasedonfactoropinion?
a.Staticpasswords
b.Dynamicpasswords
c.Cognitivepasswords
d.Conventionalpasswords
285.c.Cognitivepasswordsusefactbasedandopinionbasedcognitivedataasabasisforuserauthentication.Itusesinteractivesoftwareroutinesthatcanhandle
initialuserenrollmentandsubsequentcueresponseexchangesforsystemaccess.Cognitivepasswordsarebasedonaperson'slifetimeexperiencesandeventswhere
onlythatperson,orhisfamily,knowsaboutthem.Examplesincludetheperson'sfavoritehighschoolteachers'names,colors,flowers,foods,andplaces.Cognitive
passwordproceduresdonotdependonthepeoplememoryoftenassociatedwiththeconventionalpassworddilemma.However,implementationofacognitive
passwordmechanismcouldcostmoneyandtakemoretimetoauthenticateauser.Cognitivepasswordsareeasiertorecallanddifficultforotherstoguess.
Conventional(static)passwordsaredifficulttorememberwhetherusercreatedorsystemgeneratedandareeasytoguessbyothers.Dynamicpasswordschangeeach
time a user signs on to the computer. Even in the dynamic password environment, a user needs to remember an initial code for the computer to recognize him.
Conventionalpasswordsarereusablewhereasdynamiconesarenot.Conventionalpasswordsrelyonmemory.
286.Whichofthesecuritycodesisthelongest,therebymakingitdifficulttoguess?
a.Passphrases
b.Passwords
c.Lockwords
d.Passcodes
286.a.Passphraseshavethevirtueoflength(e.g.,upto80characters),makingthembothdifficulttoguessandburdensometodiscoverbyanexhaustivetrialand
errorattackonasystem.Thenumberofcharactersusedintheotherthreechoicesissmaller(e.g.,fourtoeightcharacters)thanpassphrases.Allfoursecuritycodesare
useridentificationmechanisms.
Passwords are uniquely associated with a single user. Lockwords are systemgenerated terminal passwords shared among users. Passcodes are a combination of
passwordandIDcard.
287.Anomalydetectionapproachesusedinintrusiondetectionsystems(IDS)requirewhichofthefollowing?
a.Toolsets
b.Skillsets
c.Trainingsets
d.Datasets
287.c. Anomaly detection approaches often require extensive training sets of system event records to characterize normal behavior patterns. Skill sets are also
importantfortheITsecurityanalyst.Toolsetsanddatasetsarenotrelevantherebecausethetoolsetsmaycontainsoftwareorhardware,andthedatasetsmaycontain
datafilesanddatabases.
288.Whatisamarkingassignedtoacomputingresourcecalled?
a.Securitytag
b.Securitylabel
c.Securitylevel
d.Securityattribute
288.b.Asecuritylabelisamarkingboundtoaresource(whichmaybeadataunit)thatnamesordesignatesthesecurityattributesofthatresource.Asecuritytagisan
informationunitcontainingarepresentationofcertainsecurityrelatedinformation(e.g.,arestrictiveattributebitmap).
Asecuritylevelisahierarchicalindicatorofthedegreeofsensitivitytoacertainthreat.Itimplies,accordingtothesecuritypolicyenforced,aspecificlevelof
protection.Asecurityattributeisasecurityrelatedqualityofanobject.Securityattributesmayberepresentedashierarchicallevels,bitsinabitmap,ornumbers.
Compartments,caveats,andreleasemarkingsareexamplesofsecurityattributes.
289.Whichofthefollowingismostrisky?
a.Permanentaccess
b.Guestaccess
c.Temporaryaccess
d.Contractoraccess
289.c.Thegreatestproblemwithtemporaryaccessisthatoncetemporaryaccessisgiventoanemployee,itisnotrevertedbacktothepreviousstatusaftertheproject
hasbeencompleted.Thiscanbeduetoforgetfulnessonbothsidesofemployeeandemployerorthelackofaformalsystemforchangenotification.Therecanbea
formalsystemofchangenotificationforpermanentaccess,andguestorcontractoraccessesareremovedaftertheprojecthasbeencompleted.
290.Whichofthefollowingdealswithaccesscontrolbygroup?
c.Accesscontrollist
290.a.Discretionaryaccesscontrolsdealwiththeconceptofcontrolobjectives,orcontroloverindividualaspectsofanenterprise'sprocessesorresources.Theyare
based on the identity of the users and of the objects they want to access. Discretionary access controls are implemented by one user or the network/system
administratortospecifywhatlevelsofaccessotherusersareallowedtohave.
Mandatoryaccesscontrolsareimplementedbasedontheuser'ssecurityclearanceortrustlevelandtheparticularsensitivitydesignationofeachfile.Theownerofa
fileorobjecthasnodiscretionastowhocanaccessit.
An access control list is based on which user can access what objects. Logical access controls are based on a usersupplied identification number or code and
password.Discretionaryaccesscontrolisbygroupassociationwhereasmandatoryaccesscontrolisbysensitivitylevel.
291.Whichofthefollowingprovidesafinerlevelofgranularity(i.e.,morerestrictivesecurity)intheaccesscontrolprocess?
a.Mandatoryaccesscontrol
b.Discretionaryaccesscontrol
c.Accesscontrollist
291.b.Discretionaryaccesscontroloffersafinerlevelofgranularityintheaccesscontrolprocess.Mandatoryaccesscontrolscanprovideaccesstobroadcategoriesof
information,whereasdiscretionaryaccesscontrolscanbeusedtofinetunethosebroadcontrols,overridemandatoryrestrictionsasneeded,andaccommodatespecial
circumstances.
292.Foridentitymanagement,whichofthefollowingissupportingthedeterminationofanauthenticidentity?
1.X.509authenticationframework
2.InternetEngineeringTaskForce'sPKI
3.SecureDNSinitiatives
4.Simplepublickeyinfrastructure
a.1only
b.2only
c.3only
d.1,2,3,and4
292.d.Severalinfrastructuresaredevotedtoprovidingidentitiesandthemeansofauthenticatingthoseidentities.ExamplesoftheseinfrastructuresincludetheX.509
authentication framework, the Internet Engineering Task Force's PKI (IETF's PKI), the secure domain name system (DNS) initiatives, and the simple public key
infrastructure(SPKI).
293.Whichoneofthefollowingmethodologiesortechniquesprovidesthemosteffectivestrategyforlimitingaccesstoindividualsensitive
files?
a.Accesscontrollistandbothdiscretionaryandmandatoryaccesscontrol
b.Mandatoryaccesscontrolandaccesscontrollist
c.Discretionaryaccesscontrolandaccesscontrollist
d.Physicalaccesscontroltohardwareandaccesscontrollistwithdiscretionaryaccesscontrol
293.a.Thebestcontrolforprotectingsensitivefilesisusingmandatoryaccesscontrolssupplementedbydiscretionaryaccesscontrolsandimplementedthroughthe
useofanaccesscontrollist.AcomplementarymandatoryaccesscontrolmechanismcanpreventtheTrojanhorseattackthatcanbeallowedbythediscretionaryaccess
control.Themandatoryaccesscontrolpreventsthesystemfromgivingsensitiveinformationtoanyuserwhoisnotexplicitlyauthorizedtoaccessaresource.
294.Whichofthefollowingsecuritycontrolmechanismsissimplesttoadminister?
c.Accesscontrollist
294.b.Mandatoryaccesscontrolsarethesimplesttousebecausetheycanbeusedtograntbroadaccesstolargesetsoffilesandtobroadcategoriesofinformation.
Discretionaryaccesscontrolsarenotsimpletouseduetotheirfinerlevelofgranularityintheaccesscontrolprocess.Boththeaccesscontrollistandlogicalaccess
controlrequireasignificantamountofadministrativeworkbecausetheyarebasedonthedetailsofeachindividualuser.
295.Whichofthefollowingusedatabyrowtorepresenttheaccesscontrolmatrix?
a.Capabilitiesandprofiles
b.Protectionbitsandaccesscontrollist
c.Profilesandprotectionbits
d.Capabilitiesandaccesscontrollist
295.a.Capabilitiesandprofilesareusedtorepresenttheaccesscontrolmatrixdatabyrowandconnectaccessibleobjectstotheuser.Ontheotherhand,aprotection
bitbasedsystemandaccesscontrollistrepresentsthedatabycolumn,connectingalistofuserstoanobject.
296.Theprocessofidentifyingusersandobjectsisimportanttowhichofthefollowing?
c.Accesscontrol
d.Securitycontrol
296.a.Discretionaryaccesscontrolisameansofrestrictingaccesstoobjectsbasedontheidentityofsubjectsand/orgroupstowhichtheybelong.Inamandatory
accesscontrolmechanism,theownerofafileorobjecthasnodiscretionastowhocanaccessit.Bothsecuritycontrolandaccesscontrolaretoobroadandvaguetobe
meaningfulhere.
297.Whichofthefollowingisahiddenfile?
a.Passwordagingfile
b.Passwordvalidationfile
c.Passwordreusefile
d.Shadowpasswordfile
297.d.Theshadowpasswordfileisahiddenfilethatstoresallusers'passwordsandisreadableonlybytherootuser.Thepasswordvalidationfileusestheshadow
passwordfilebeforeallowingtheusertologin.Thepasswordagingfilecontainsanexpirationdate,andthepasswordreusefilepreventsauserfromreusinga
previouslyusedpassword.Thefilesmentionedintheotherthreechoicesarenothidden.
298.Fromanaccesscontrolpointofview,whichofthefollowingareexamplesoftasktransactionsandseparationofconflictsofinterests?
2.Workflowpolicy
4.ChineseWallpolicy
a.1and2
b.1and3
c.2and4
d.3and4
298.c.Workflowpolicyisaprocessthatoperatesonrulesandprocedures.Aworkflowisspecifiedasasetoftasksandasetofdependenciesamongthetasks,andthe
sequencing of these tasks is important (i.e., task transactions). The various tasks in a workflow are usually carried out by several users in accordance with
organizationalrulesrepresentedbytheworkflowpolicy.TheChineseWallpolicyaddressesconflictofinterestissues,withtheobjectiveofpreventingillicitflows
ofinformationthatcanresultinconflictsofinterest.TheChineseWallpolicyissimpleandeasytodescribebutdifficulttoimplement.Bothroleandrulebased
accesscontrolcancreateconflictofinterestsituationsbecauseofincompatibilitybetweenemployeerolesandmanagementrules.
299.Foridentitymanagement,whichofthefollowingqualifiesascontinuouslyauthenticated?
a.UniqueID
b.SignedX.509certificate
c.Passwordwithaccesscontrollist
d.Encryption
299.d.Acommonlyusedmethodtoensurethataccesstoacommunicationssessioniscontrolledandauthenticatedcontinuouslyistheuseofencryptionmechanisms
topreventlossofcontrolofthesessionthroughsessionstealingorhijacking.Othermethodssuchassignedx.509certificatesandpasswordfilesassociatedwith
accesscontrollists(ACLs)canbindentitiestouniqueIDs.Althoughtheseothermethodsaregood,theydonotpreventthelossofcontrolofthesession.
300.Whatisacontroltopreventanunauthorizeduserfromstartinganalternativeoperatingsystem?
a.Shadowpassword
b.Encryptionpassword
c.Poweronpassword
d.Networkpassword
300.c.Acomputersystemcanbeprotectedthroughapoweronpassword,whichpreventsanunauthorizeduserfromstartinganalternativeoperatingsystem.The
otherthreetypesofpasswordsmentioneddonothavethepreventivenature,asdoesthepoweronpassword.
301.Theconceptofleastprivilegeisbasedonwhichofthefollowing?
a.Riskassessment
b.Informationflowenforcement
c.Accessenforcement
d.Accountmanagement
301.a.Anorganizationpracticestheconceptofleastprivilegeforspecificjobdutiesandinformationsystems,includingspecificresponsibilities,networkports,
protocols, and services in accordance with risk assessments. These practices are necessary to adequately mitigate risk to organizations' operations, assets, and
individuals.Theotherthreechoicesarespecificcomponentsofaccesscontrols.
302.Whichofthefollowingistheprimarytechniqueusedbycommerciallyavailableintrusiondetectionandpreventionsystems(IDPS)to
analyzeeventstodetectattacks?
a.SignaturebasedIDPS
b.AnomalybasedIDPS
c.BehaviorbasedIDPS
d.StatisticalbasedIDPS
302.a.Therearetwoprimaryapproachestoanalyzingeventstodetectattacks:signaturedetectionandanomalydetection.Signaturedetectionistheprimarytechnique
usedbymostcommercialsystemshowever,anomalydetectionisthesubjectofmuchresearchandisusedinalimitedformbyanumberofintrusiondetectionand
preventionsystems(IDPS).BehaviorandstatisticalbasedIDPSarepartofanomalybasedIDPS.
303.Forelectronicauthentication,whichofthefollowingisanexampleofapassiveattack?
a.Eavesdropping
b.Maninthemiddle
c.Impersonation
d.Sessionhijacking
303.a.Apassiveattackisanattackagainstanauthenticationprotocolwheretheattackerinterceptsdatatravelingalongthenetworkbetweentheclaimantandverifier
butdoesnotalterthedata.Eavesdroppingisanexampleofapassiveattack.
Amaninthemiddle(MitM)attackisincorrectbecauseitisanactiveattackontheauthenticationprotocolruninwhichtheattackerpositionshimselfbetweenthe
claimantandverifiersothathecaninterceptandalterdatatravelingbetweenthem.
Impersonationisincorrectbecauseitisanattempttogainaccesstoacomputersystembyposingasanauthorizeduser.Itisthesameasmasquerading,spoofing,and
mimicking.
Sessionhijackingisincorrectbecauseitisanattackthatoccursduringanauthenticationsessionwithinadatabaseorsystem.Theattackerdisablesauser'sdesktop
system,interceptsresponsesfromtheapplication,andrespondsinwaysthatprobethesession.Maninthemiddle,impersonation,andsessionhijackingareexamples
ofactiveattacks.NotethatMitMattackscanbepassiveoractivedependingontheintentoftheattackerbecausetherearemildMitMorstrongMitMattacks.
304.Whichofthefollowingcomplementarystrategiestomitigatetokenthreatsraisethethresholdforsuccessfulattacks?
a.Physicalsecuritymechanisms
b.Multiplesecurityfactors
c.Complexpasswords
d.Systemandnetworksecuritycontrols
304.b.Tokenthreatsincludemasquerading,offlineattacks,andguessingpasswords.Multiplefactorsraisethethresholdforsuccessfulattacks.Ifanattackerneedsto
stealthecryptographictokenandguessapassword,theworkfactormaybetoohigh.
Physicalsecuritymechanismsareincorrectbecausetheymaybeemployedtoprotectastolentokenfromduplication.Physicalsecuritymechanismscanprovide
tamperevidence,detection,andresponse.
Complexpasswordsareincorrectbecausetheymayreducethelikelihoodofasuccessfulguessingattack.Byrequiringtheuseoflongpasswordsthatdonotappearin
commondictionaries,attackersmaybeforcedtotryeverypossiblepassword.
Systemandnetworksecuritycontrolsareincorrectbecausetheymaybeemployedtopreventanattackerfromgainingaccesstoasystemorinstallingmalicious
software(malware).
305.Whichofthefollowingisthecorrectdescriptionofrolesbetweenaregistrationauthority(RA)andacredentialserviceprovider(CSP)
involvedinidentityproofing?
a.TheRAmaybeapartoftheCSP.
b.TheRAmaybeaseparateentity.
c.TheRAmaybeatrustedrelationship.
d.TheRAmaybeanindependententity.
305.c.TheRAmaybeapartoftheCSP,oritmaybeaseparateandindependententityhoweveratrustedrelationshipalwaysexistsbetweentheRAandCSP.Either
theRAorCSPmustmaintainrecordsoftheregistration.TheRAandCSPmayprovideservicesonbehalfofanorganizationormayprovideservicestothepublic.
306.Whatisspoofing?
a.Activeattack
b.Passiveattack
c.Surveillanceattack
d.Exhaustiveattack
306.a.Spoofingisatamperingactivityandisanactiveattack.Sniffingisasurveillanceactivityandisapassiveattack.Anexhaustiveattack(i.e.,bruteforceattack)
consistsofdiscoveringsecretdatabytryingallpossibilitiesandcheckingforcorrectness.Forafourdigitpassword,youmightstartwith0000andmoveto0001and
0002until9999.
307.Whichofthefollowingisanexampleofinfrastructurethreatsrelatedtotheregistrationprocessrequiredinidentityproofing?
a.Separationofduties
b.Recordkeeping
c.Impersonation
d.Independentaudits
307.c.Therearetwogeneralcategoriesofthreatstotheregistrationprocess:impersonationandeithercompromiseormalfeasanceoftheinfrastructure(RAsand
CSPs).Infrastructurethreatsareaddressedbynormalcomputersecuritycontrolssuchasseparationofduties,recordkeeping,andindependentaudits.
308.Inelectronicauthentication,whichofthefollowingisnottrustworthy?
a.Claimants
b.Registrationauthorities
c.Credentialsservicesproviders
d.Verifiers
308.a. Registration authorities (RAs), credential service providers (CSPs), verifiers, and relying parties are ordinarily trustworthy in the sense of being correctly
implemented and not deliberately malicious. However, claimants or their systems may not be trustworthy or else their identity claims could simply be trusted.
Moreover,whereasRAs,CSPs,andverifiersarenormallytrustworthy,theyarenotinvulnerableandcouldbecomecorrupted.Therefore,protocolsthatexposelong
termauthenticationsecretsmorethanareabsolutelyrequired,eventotrustedentities,shouldbeavoided.
309.Anorganizationisexperiencingexcessiveturnoverofemployees.Whichofthefollowingisthebestaccesscontrolpolicyunderthese
situations?
309.c.Employeescancomeandgo,buttheirrolesdonotchange,suchasadoctorornurseinahospital.Withrolebasedaccesscontrol,accessdecisionsarebasedon
therolesthatindividualusershaveaspartofanorganization.Employeenamesmaychangebuttherolesdoesnot.Thisaccesscontrolisthebestfororganizations
experiencingexcessiveemployeeturnover.
Rulebased access control and mandatory access control are the same because they are based on specific rules relating to the nature of the subject and object.
Discretionaryaccesscontrolisameanstorestrictaccesstoobjectsbasedontheidentityofsubjectsand/orgroupstowhichtheybelong.
310.Theprincipleofleastprivilegesupportswhichofthefollowing?
a.Allornothingprivileges
b.Superuserprivileges
c.Appropriateprivileges
d.Creepingprivileges
310.c.Theprincipleofleastprivilegereferstograntingusersonlythoseaccessesrequiredtoperformtheirduties.Onlytheconceptofappropriateprivilegeis
supportedbytheprincipleofleastprivilege.
311. Whatispasswordmanagementanexampleof?
a.Directivecontrol
b.Preventivecontrol
c.Detectivecontrol
d.Correctivecontrol
311.b.Passwordmanagementisanexampleofpreventivecontrolsinthatpasswordsdeterunauthorizedusersfromaccessingasystemunlesstheyknowthepassword
throughsomeothermeans.
312.Whichoneofthefollowingaccesscontrolpolicyusesanaccesscontrolmatrixforitsimplementation?
a.Discretionaryaccesscontrol(DAC)
d.Accesscontrollists(ACLs)
312.a.Adiscretionaryaccesscontrol(DAC)modelusesaccesscontrolmatrixwhereitplacesthenameofusers(subjects)ineachrowandthenamesofobjects(files
orprograms)ineachcolumnofamatrix.Theotherthreechoicesdonotuseanaccesscontrolmatrix.
313.Accesscontrolmechanismsincludewhichofthefollowing?
a.Directive,preventive,anddetectivecontrols
b.Corrective,recovery,andpreventivecontrols
c.Logical,physical,andadministrativecontrols
d.Management,operational,andtechnicalcontrols
313.c. Access control mechanisms include logical (passwords and encryption), physical (keys and tokens), and administrative (forms and procedures) controls.
Directive,preventive,detective,corrective,andrecoverycontrolsarecontrolsbyaction.Management,operational,andtechnicalcontrolsarecontrolsbynature.
314.Whichoneofthefollowingaccesscontrolpolicyusessecuritylabels?
314.b.Securitylabelsandinterfacesareusedtodetermineaccessbasedonthemandatoryaccesscontrol(MAC)policy.Asecuritylabelisthemeansusedtoassociate
asetofsecurityattributeswithaspecificinformationobjectaspartofthedatastructureforthatobject.Labelscouldbedesignatedasproprietarydataorpublicdata.
Theotherthreechoicesdonotusesecuritylabels.
315.Intrusiondetectionandpreventionsystemsserveaswhichofthefollowing?
a.Barriermechanism
b.Monitoringmechanism
c.Accountabilitymechanism
d.Penetrationmechanism
315.b.Intrusiondetectionandpreventionsystems(IDPS)serveasmonitoringmechanisms,watchingactivities,andmakingdecisionsaboutwhethertheobserved
eventsaresuspicious.IDPScanspotattackerscircumventingfirewallsandreportthemtosystemadministrators,whocantakestepstopreventdamage.Firewalls
serveasbarriermechanisms,barringentrytosomekindsofnetworktrafficandallowingothers,basedonafirewallpolicy.
316.Whichofthefollowingcancoexistinprovidingstrongaccesscontrolmechanisms?
a.Kerberosauthenticationandsinglesignonsystem
b.Kerberosauthenticationanddigitalsignaturesystem
c.Kerberosauthenticationandasymmetrickeysystem
d.Kerberosauthenticationanddigitalcertificatesystem
316.a. When Kerberos authentication is combined with single signon systems, it requires establishment of and operating the privilege servers. Kerberos uses
symmetrickeycryptography,andtheotherthreechoicesareexamplesofasymmetrickeycryptography.
317.Usesofhoneypotsandpaddedcellshavewhichofthefollowing?
a.Socialimplications
b.Legalimplications
c.Technicalimplications
d.Psychologicalimplications
317.b.Thelegalimplicationsofusinghoneypotandpaddedcellsystemsarenotwelldefined.Itisimportanttoseekguidancefromlegalcounselbeforedecidingto
useeitherofthesesystems.
318.Fromsecurityandsafetyviewpoints,safetyenforcementistiedtowhichofthefollowing?
a.Jobrotation
b.Jobdescription
c.Jobenlargement
d.Jobenrichment
318.b.Safetyisfundamentaltoensuringthatthemostbasicofaccesscontrolpoliciescanbeenforced.Thisenforcementistiedtothejobdescriptionofanindividual
employeethroughaccessauthorizations(e.g.,permissionsandprivileges).Jobdescriptionlistsjobtasks,duties,roles,andresponsibilitiesexpectedofanemployee,
includingsafetyandsecurityrequirements.
Theotherthreechoicesdonotprovidesafetyenforcements.Jobrotationmakesanemployeewellroundedbecauseitbroadensanemployee'sworkexperience,job
enlargementaddswidthtoajob,andjobenrichmentaddsdepthtoajob.
319.Whichofthefollowingisthecorrectsequenceofactionsinaccesscontrolmechanisms?
a.Accessprofiles,authentication,authorization,andidentification
b.Securityrules,identification,authorization,andauthentication
c.Identification,authentication,authorization,andaccountability
d.Audittrails,authorization,accountability,andidentification
319.c.Identificationcomesbeforeauthentication,andauthorizationcomesafterauthentication.Accountabilityislastwhereuseractionsarerecorded.
320.Theprincipleofleastprivilegeismostcloselylinkedtowhichofthefollowingsecurityobjectives?
a.Confidentiality
b.Integrity
c.Availability
d.Nonrepudiation
320.b.Theprincipleofleastprivilegedealswithaccesscontrolauthorizationmechanisms,andassuchtheprincipleensuresintegrityofdataandsystemsbylimiting
accesstodata/informationandinformationsystems.
321.WhichofthefollowingisamajorvulnerabilitywithKerberosmodel?
a.User
b.Server
c.Client
d.Keydistributionserver
321.d.AmajorvulnerabilitywiththeKerberosmodelisthatifthekeydistributionserverisattacked,everysecretkeyusedonthenetworkiscompromised.The
principalsinvolvedintheKerberosmodelincludetheuser,theclient,thekeydistributioncenter,theticketgrantingservice,andtheserverprovidingtherequested
services.
322.Forelectronicauthentication,identityproofinginvolveswhichofthefollowing?
a.CSP
b.RA
c.CSPandRA
d.CAandCRL
322.c.Identityproofingistheprocessbywhichacredentialserviceprovider(CSP)andaregistrationauthority(RA)validatesufficientinformationtouniquely
identifyaperson.Acertificationauthority(CA)isnotinvolvedinidentityproofing.ACAisatrustedentitythatissuesandrevokespublickeycertificates.A
certificaterevocationlist(CRL)isnotinvolvedinidentityproofing.ACRLisalistofrevokedpublickeycertificatescreatedanddigitallysignedbyaCA.
323.Alatticesecuritymodelisanexampleofwhichofthefollowingaccesscontrolpolicies?
b.NonDAC
c.Mandatoryaccesscontrol(MAC)
d.NonMAC
323.b.Alatticesecuritymodelisbasedonanondiscretionaryaccesscontrol(nonDAC)model.Alatticemodelisapartiallyorderedsetforwhicheverypairof
elements(subjectsandobjects)hasagreatestlowerboundandaleastupperbound.Thesubjecthasthegreatestlowerbound,andtheobjecthastheleastupperbound.
324.Whichofthefollowingisnotacommontypeofelectroniccredential?
a.SAMLassertions
b.X.509publickeyidentitycertificates
c.X.509attributecertificates
d.Kerberostickets
324.a.Electroniccredentialsaredigitaldocumentsusedinauthenticationthatbindanidentityoranattributetoasubscriber'stoken.Securityassertionmarkup
language(SAML)isaspecificationforencodingsecurityassertionsintheextensiblemarkuplanguage(XML).SAMLassertionshavenothingtodowithelectronic
credentialbecausetheycanbeusedbyaverifiertomakeastatementtoarelyingpartyabouttheidentityofaclaimant.
AnX.509publickeyidentitycertificateisincorrectbecausebindinganidentitytoapublickeyisacommontypeofelectroniccredential.X.509attributecertificate
isincorrectbecausebindinganidentityorapublickeywithsomeattributeisacommontypeofelectroniccredential.Kerberosticketsareincorrectbecauseencrypted
messagesbindingtheholderwithsomeattributeorprivilegeisacommontypeofelectroniccredential.
325.Registrationfraudinelectronicauthenticationcanbedeterredbymakingitmoredifficulttoaccomplishorbyincreasingthelikelihoodof
whichofthefollowing?
a.Direction
b.Prevention
c.Detection
d.Correction
325.c.Makingitmoredifficulttoaccomplishorincreasingthelikelihoodofdetectioncandeterregistrationfraud.Thegoalistomakeimpersonationmoredifficult.
326.Whichoneofthefollowingaccesscontrolpoliciestreatsusersandownersasthesame?
326.a.Adiscretionaryaccesscontrol(DAC)mechanismenablesuserstograntorrevokeaccesstoanyoftheobjectsundertheircontrol.Assuch,usersaresaidtobe
theownersoftheobjectsundertheircontrol.Usersandownersaredifferentintheotherthreechoices.
327.Forelectronicauthenticationprotocolthreats,whichofthefollowingareassumedtobephysicallyabletointerceptauthenticationprotocol
runs?
a.Eavesdroppers
b.Subscriberimpostors
c.Impostorverifiers
d.Hijackers
327.a.Eavesdroppersareassumedtobephysicallyabletointerceptauthenticationprotocolrunshowever,theprotocolmaybedesignedtorendertheintercepted
messagesunintelligible,ortoresistanalysisthatwouldallowtheeavesdroppertoobtaininformationusefultoimpersonatetheclaimant.
Subscriberimpostorsareincorrectbecausetheyneedonlynormalcommunicationsaccesstoverifiersorrelyingparties.Impostorverifiersareincorrectbecausethey
may have special network capabilities to divert, insert, or delete packets. But, in many cases, such attacks can be mounted simply by tricking subscribers with
incorrectlinksoremailsoronWebpages,orbyusingdomainnamessimilartothoseofrelyingpartiesorverifiers.Therefore,theimpostorsdonotnecessarilyneed
tohaveanyunusualnetworkcapabilities.Hijackersareincorrectbecausetheymustdivertcommunicationssessions,butthiscapabilitymaybecomparativelyeasyto
achievetodaywhenmanysubscribersusewirelessnetworkaccess.
328.Whichofthefollowingisnotcommonlydetectedandreportedbyintrusiondetectionandpreventionsystems(IDPS)?
a.Systemscanningattacks
b.Denialofserviceattacks
c.Systempenetrationattacks
d.IPaddressspoofingattacks
328.d.AnattackercansendattackpacketsusingafakesourceIPaddressbutarrangetowiretapthevictimsreplytothefakeaddress.Theattackercandothiswithout
havingaccesstothecomputeratthefakeaddress.ThismanipulationofIPaddressingiscalledIPaddressspoofing.
Asystemscanningattackoccurswhenanattackerprobesatargetnetworkorsystembysendingdifferentkindsofpackets.Denialofserviceattacksattempttoslow
orshutdowntargetednetworksystemsorservices.Systempenetrationattacksinvolvetheunauthorizedacquisitionand/oralterationofsystemprivileges,resources,
ordata.
329.Inbandattacksagainstelectronicauthenticationprotocolsincludewhichofthefollowing?
a.Passwordguessing
b.Impersonation
c.Passwordguessingandreplay
d.Impersonationandmaninthemiddle
329.c.Inaninbandattack,theattackerassumestheroleofaclaimantwithagenuineverifier.Theseincludeapasswordguessingattackandareplayattack.Ina
passwordguessingattack,animpostorattemptstoguessapasswordinrepeatedlogontrialsandsucceedswhenhecanlogontoasystem.Inareplayattack,an
attackerrecordsandreplayssomepartofapreviousgoodprotocolruntotheverifier.Intheverifierimpersonationattack,theattackerimpersonatestheverifierand
inducestheclaimanttorevealhissecrettoken.Amaninthemiddleattackisanattackontheauthenticationprotocolruninwhichtheattackerpositionshimself
betweentheclaimantandverifiersothathecaninterceptandalterdatatravelingbetweenthem.
330.Whichofthefollowingaccesscontrolpoliciesormodelsprovidesastraightforwardwayofgrantingordenyingaccessforaspecified
user?
a.Rolebasedaccesscontrol(RBAC)
b.Accesscontrollists(ACLs)
c.Mandatoryaccesscontrol(MAC)
330.b.Anaccesscontrollist(ACL)isanobjectassociatedwithafileandcontainingentriesspecifyingtheaccessthatindividualusersorgroupsofusershavetothe
file.ACLsprovideastraightforwardwaytograntordenyaccessforaspecifieduserorgroupsofusers.Otherchoicesarenotthatstraightforwardinthattheyuse
labels,tags,androles.
331.Whatisimpersonatingauserorsystemcalled?
a.Snoopingattack
b.Spoofingattack
c.Sniffingattack
d.Spammingattack
331.b.SpoofingisanunauthorizeduseoflegitimateidentificationandauthenticationdatasuchasuserIDsandpasswords.Interceptedusernamesandpasswordscan
beusedtoimpersonatetheuserontheloginorfiletransferserverhostthattheuseraccesses.
Snoopingandsniffingattacksarethesameinthatsniffingisobservingthepacket'spassingbyonthenetwork.Spammingispostingidenticalmessagestomultiple
unrelatednewsgroupsontheInternetorsendingunsolicitedemailsentindiscriminatelytomultipleusers.
332.Whichoneofthefollowingaccesscontrolpolicyormodelrequiressecurityclearancesforsubjects?
332.b.Amandatoryaccesscontrol(MAC)restrictsaccesstoobjectsbasedonthesensitivityoftheinformationcontainedintheobjectsandtheformalauthorization
(i.e.,clearance)ofsubjectstoaccessinformationofsuchsensitivity.
333.Whichofthefollowingisnotanexampleofattacksondataandinformation?
a.Hiddencode
b.Inference
c.Spoofing
d.Trafficanalysis
333.c.SpoofingisusingvarioustechniquestosubvertIPbasedaccesscontrolbymasqueradingasanothersystembyusingitsIPaddress.Attackssuchashidden
code,inference,andtrafficanalysisarebasedondataandinformation.
334.Honeypotsystemsdonotcontainwhichofthefollowing?
a.Eventtriggers
b.Sensitivemonitors
c.Sensitivedata
d.Eventloggers
334.c.Thehoneypotsystemisinstrumentedwithsensitivemonitors,eventtriggers,andeventloggersthatdetectunauthorizedaccessesandcollectinformationabout
theattacker'sactivities.Thesesystemsarefilledwithfabricateddatadesignedtoappearvaluable.
335.Intrusiondetectionandpreventionsystemslookatsecuritypolicyviolations:
a.Statically
b.Dynamically
c.Linearly
d.Nonlinearly
335.b.Intrusiondetectionandpreventionsystems(IDPS)lookforspecificsymptomsofintrusionsandsecuritypolicyviolationsdynamically.IDPSareanalogousto
security monitoring cameras. Vulnerability analysis systems take a static view of symptoms. Linearly and nonlinearly are not applicable here because they are
mathematicalconcepts.
336.Forbiometricaccuracy,whichofthefollowingdefinesthepointatwhichthefalserejectionratesandthefalseacceptanceratesareequal?
a.TypeIerror
b.TypeIIerror
c.Crossovererrorrate
d.TypeIandIIerror
336.c.Inbiometrics,crossovererrorrateisdefinedasthepointatwhichthefalserejectionratesandthefalseacceptanceratesareequal.TypeIerror,calledfalse
rejectionrate,isincorrectbecausegenuineusersarerejectedasimposters.TypeIIerror,calledfalseacceptancerate,isincorrectbecauseimpostersareacceptedas
genuineusers.
337.Whichoneofthefollowingdoesnothelpinpreventingfraud?
a.Separationofduties
b.Jobenlargement
c.Jobrotation
d.Mandatoryvacations
337.b.Separationofduties,jobrotation,andmandatoryvacationsaremanagementcontrolsthatcanhelpinpreventingfraud.Jobenlargementandjobenrichmentdo
notpreventfraudbecausetheyarenotcontrolstheirpurposeistoexpandthescopeofanemployee'sworkforabetterexperienceandpromotion.
338.AccesstriplesusedintheimplementationofClarkWilsonsecuritymodelincludewhichofthefollowing?
a.Policy,procedure,andobject
b.Class,domain,andsubject
c.Subject,program,anddata
d.Level,label,andtag
338.c.TheClarkWilsonmodelpartitionsobjectsintoprogramsanddataforeachsubjectformingasubject/program/dataaccesstriple.Thegenericmodelforthe
accesstriplesis<subject,rights,object>.

Access Control

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Access Control

Enviado por

Direitos autorais:

Formatos disponíveis

11/12/2016 techbus.safaribooksonline.com/print?

a.Applicant RegistrationAuthority Subscriber Claimant

b.RegistrationAuthority Applicant Claimant Subscriber

c.Subscriber Applicant RegistrationAuthority Claimant

a.Subscriber CredentialServiceProvider RegistrationAuthority

b.Verifier Claimant RelyingParty

c.RelyingParty Claimant RegistrationAuthority

d.Verifier CredentialServiceProvider RelyingParty

a.Accesscontrol Accessmanagement Authenticationmanagement Privilegemanagement

b.Accessmanagement Accesscontrol Privilegemanagement Authenticationmanagement

c.Authenticationmanagement Privilegemanagement Accesscontrol Accessmanagement

d.Privilegemanagement Accessmanagement Accesscontrol Authenticationmanagement

a.Claimant AuthenticationProtocol Verifier

b.Claimant Authenticator Verifier

c.Verifier Claimant RelyingParty

d.Claimant Verifier RelyingParty

TheflowofauthenticationprocessinvolvingClaimant AuthenticationProtocol Verifier:Theauthenticationprocessestablishes

TheflowoftokensandcredentialsinvolvingClaimant Authenticator Verifier:Tokensgenerallyaresomethingtheclaimant

TheflowofassertionsinvolvingVerifier Claimant RelyingParty:Assertionsarestatementsfromaverifiertoarelyingpartythat

Você também pode gostar