Question 1

PAM modules cannot be stacked together to support "stacked authentication" where an application can use one or more PAM modules for authentication.

Accepted Answer

PAM modules can be stacked together to support stacked authentication, allowing an application to use multiple PAM modules for authentication.

Question 2

The JAAS framework defines the term ____ to represent the requester for a service.
A) resource
B) credential
C) subject
D) principal

Accepted Answer

The JAAS (Java Authentication and Authorization Service) framework uses the term "subject" to represent the requester for a service. A subject may be a person or a service executing on behalf of a person.

Question 3

The ____ class is used by SaslServer to determine whether or not one entity can act on behalf of another entity in the SASL environment.
A) ChoiceCallback
B) AuthorizeCallback
C) LanguageCallback
D) RealmCallback

Accepted Answer

The AuthorizeCallback class is used by SaslServer to determine whether or not one entity can act on behalf of another entity in the SASL environment. The other classes listed (ChoiceCallback, LanguageCallback, RealmCallback) are not relevant to this functionality.

Question 4

The ____ class retrieves realm information for SaslClient and SaslServer.
A) ChoiceCallback
B) RealmCallback
C) LanguageCallback
D) AuthorizeCallback

Accepted Answer

The RealmCallback class retrieves realm information for SaslClient and SaslServer. ChoiceCallback is used for presenting a list of options to the user and getting their choice, LanguageCallback is used for getting the preferred language of the user, and AuthorizeCallback is used for obtaining authorization information from the client or server.

Question 5

A good authentication technology should be platform and system dependent.

Accepted Answer

A good authentication technology should not be platform or system dependent. Its effectiveness should not be affected by the type of platform or system used. It should be able to provide secure authentication across different platforms and systems.

Question 6

The ___ class retrieves the locale used for localizing text.
A) ChoiceCallback
B) AuthorizeCallback
C) LanguageCallback
D) RealmCallback

Accepted Answer

The LanguageCallback class is used to retrieve the locale used for localizing text. ChoiceCallback, AuthorizeCallback, and RealmCallback are all unrelated to localization.

Question 7

____ authentication is usually used with lightweight directory access protocol (LDAP) and Web authentication that transmits credentials across the network as an MD5 hash or message digest.
A) Passport
B) Digest
C) Kerberos
D) NTLM

Accepted Answer

The description provided in the question matches with Digest Authentication, which is designed to prevent eavesdropping and replay attacks. It uses an MD5 hash to authenticate the client's credentials over the network.

Question 8

The ____ class represents a Java implementation of the PAM framework.
A) CallbackHandler
B) Principal
C) LoginContext
D) Subject

Accepted Answer

The LoginContext class represents a Java implementation of the PAM framework. It provides a way to authenticate and authorize a user based on their login credentials and associated privileges. The CallbackHandler interface is used to handle login callbacks in the authentication process, the Principal interface represents the identity of the user being authenticated, and the Subject class represents the security context associated with a user session.

Question 9

With ____, authorization is implemented by allowing the administrator to control which users or groups have the right to perform various administrative functions or to take any action that affects systemwide resources.
A) administrative privileges
B) permissions inheritance
C) user-based authorization
D) discretionary access to securable objects

Accepted Answer

Administrative privileges allow the administrator to control which users or groups have the right to perform various administrative functions, which includes actions that affect systemwide resources. This is different from user-based authorization, which only controls access to specific resources based on individual user permissions. Permissions inheritance and discretionary access to securable objects are related concepts but do not directly address the issue of controlling administrative privileges.

Question 10

To log all user roles and trace who, when, and what actions an entity performs, ____ is usually implemented with authentication and authorization.
A) sniffing
B) surveillance
C) auditing
D) ACL

Accepted Answer

Auditing is the process of recording actions taken by users or entities, which is essential for identifying and preventing unauthorized activities. It allows a system administrator to determine what actions users have taken in the system and who conducted them. Sniffing is a form of network eavesdropping that enables an attacker to listen to network traffic in real-time. Surveillance involves monitoring systems to detect and prevent security breaches. ACL (Access Control List) is a set of rules that specify what actions a user can take on a specific resource. While ACL is related to authorization, it does not provide a complete solution for logging user roles and actions.

Question 11

The idea of ____ is that all security contexts are linked to a user instead of an application.
A) discretionary access to securable objects
B) permissions inheritance
C) administrative privileges
D) user-based authorization

Accepted Answer

User-based authorization, also known as user-centric security, is the concept that security contexts are tied to a specific user rather than an application or system. This approach ensures that users have access to only the resources they need to perform their specific job function, reducing the risk of unauthorized access or data breaches.

Question 12

____ authentication is an industry standard documented under RFC 1510 that is used with either a password or a smart card for interactive log on.
A) Kerberos
B) NTLM
C) LDAP
D) Digest

Accepted Answer

Kerberos authentication is the industry standard documented under RFC 1510 and is widely used in enterprise environments. It uses a mutual authentication mechanism between the user and the server, and can work with either a password or a smart card for interactive log on. NTLM, LDAP, and Digest are also authentication protocols, but they are not as widely used as Kerberos.

Question 13

Java 2 provides access controls based on where the code originated from and who signed the code.

Accepted Answer

Java 2 introduced a security model that allows setting access controls based on the code's origin (where the code came from) and the signer of the code (who signed the code), enhancing the security framework by allowing more granular security policies.

Question 14

To support stacked authentication, each PAM module, using the LoginModule interface, supports the notion of two-phase authentication using the login() and ____ method.
A) commit()
B) logout()
C) submit()
D) reset()

Accepted Answer

The login() method performs the first phase of authentication and the commit() method performs the second phase. The logout() method is used to end the authentication session, the submit() method is not a method in the LoginModule interface, and the reset() method is used to reset the state of the LoginModule.

Question 15

With ____, authorization is implemented when you control permissions for new objects created in a container object by setting inheritable permissions on the container.
A) user-based authorization
B) permissions inheritance
C) discretionary access to securable objects
D) administrative privileges

Accepted Answer

Permissions inheritance allows for authorization to be implemented by controlling permissions for new objects created within a container object. This can be achieved by setting inheritable permissions on the container.

Question 16

Regarding JAAS, the term ____ is used to represent a name associated with a subject.
A) Subject
B) Resource
C) Credential
D) Principal

Accepted Answer

The term "principal" is used in JAAS to represent a name associated with a subject. A principal can represent a user, system, or any other entity that can perform actions within an application.

Question 17

Without authentication, it is impossible to assure who an entity is and whether or not to authorize any action at all.

Accepted Answer

Authentication is the process of verifying the identity of an entity, whether it is a user, computer system, device, or application. Without authentication, there is no way to determine who the entity is and whether they have the right to access certain resources or perform certain actions. This is why authentication is a fundamental security mechanism that is essential for protecting sensitive information and ensuring that only authorized users can access it.

Question 18

The Java security architecture itself has the ability to enforce authentication, or determining who runs the code, and authorization or determining what actions can be performed.

Accepted Answer

The answer of The Java security architecture itself has the...

Question 19

The ____ PAM module prompts for a username and password. It then verifies the password against the password stored in a directory service configured using Java naming and directory interface (JNDI).
A) JndiLoginModule
B) KeyStoreLoginModule
C) SolarisLoginModule
D) UnixLoginModule

Accepted Answer

The JndiLoginModule is specifically designed to verify passwords against a directory service configured using Java naming and directory interface (JNDI). The other options, such as KeyStoreLoginModule, SolarisLoginModule, and UnixLoginModule, are not specifically designed for this purpose.

Question 20

____ enables authorization to be self-managed as an object owner can set permissions on all objects she or he created.
A) User-based authorization
B) Permissions inheritance
C) Administrative privileges
D) Discretionary access to securable objects

Accepted Answer

Discretionary access to securable objects enables the object owner to set permissions on all objects they created, allowing for self-management of authorization. User-based authorization refers to granting access based on user accounts, while permissions inheritance involves inheriting permissions from parent objects. Administrative privileges refer to the level of access granted to system administrators.

Quiz 7: Authentication and Authorization With Java

PAM modules cannot be stacked together to support "stacked authentication" where an application can use one or more PAM modules for authentication.

The JAAS framework defines the term ____ to represent the requester for a service.

The ____ class is used by SaslServer to determine whether or not one entity can act on behalf of another entity in the SASL environment.

The ____ class retrieves realm information for SaslClient and SaslServer.

A good authentication technology should be platform and system dependent.

The ___ class retrieves the locale used for localizing text.

____ authentication is usually used with lightweight directory access protocol (LDAP) and Web authentication that transmits credentials across the network as an MD5 hash or message digest.

The ____ class represents a Java implementation of the PAM framework.

With ____, authorization is implemented by allowing the administrator to control which users or groups have the right to perform various administrative functions or to take any action that affects systemwide resources.

To log all user roles and trace who, when, and what actions an entity performs, ____ is usually implemented with authentication and authorization.

The idea of ____ is that all security contexts are linked to a user instead of an application.

____ authentication is an industry standard documented under RFC 1510 that is used with either a password or a smart card for interactive log on.

Java 2 provides access controls based on where the code originated from and who signed the code.

To support stacked authentication, each PAM module, using the LoginModule interface, supports the notion of two-phase authentication using the login() and ____ method.

With ____, authorization is implemented when you control permissions for new objects created in a container object by setting inheritable permissions on the container.

Regarding JAAS, the term ____ is used to represent a name associated with a subject.

Without authentication, it is impossible to assure who an entity is and whether or not to authorize any action at all.

The Java security architecture itself has the ability to enforce authentication, or determining who runs the code, and authorization or determining what actions can be performed.

The ____ PAM module prompts for a username and password. It then verifies the password against the password stored in a directory service configured using Java naming and directory interface (JNDI) .

____ enables authorization to be self-managed as an object owner can set permissions on all objects she or he created.