Deck 5: Access Control

Question 1

In military security, the term multilevel security means multifactor security.

Answer 1

False

Question 2

Which of the following should be forbidden in secure areas?

A) Cameras
B) USB flash drives
C) Both A and B
D) Neither A nor B

Answer 2

C

Question 3

Placing sensitive equipment in secure areas to minimize potential threats and damage is called siting.

Answer 3

True

Question 4

In ________ the department has discretion over giving access to individuals, within policy standards set by higher authorities.

A) policy-based access control
B) mandatory access control
C) discretionary access control
D) delegated access control

Question 5

Compared to access control based on individual accounts, RBAC is ________.

A) less prone to error
B) more expensive
C) Both A and B
D) Neither A nor B

Question 6

________ can be used to supply power during long power outages.

A) Uninterruptable power supplies
B) Electrical generators
C) Both A and B
D) Neither A nor B

Question 7

________ is the process of collecting information about the activities of each individual in log files for immediate and later analysis.

A) Authorizations
B) Authentication
C) Accuracy
D) Auditing

Question 8

________ is the process of assessing the identity of each individual claiming to have permission to use a resource.

A) Authorizations
B) Authentication
C) Accuracy
D) Auditing

Question 9

In the military, departments do not have the ability to alter access control rules set by higher authorities in ________.

A) policy-based access control
B) mandatory access control
C) discretionary access control
D) multilevel access control

Question 10

Which of the following is not one of the AAA controls?

A) Authentication
B) Auditing
C) Accuracy
D) Authorizations

Question 11

Which of the following is not one of the rules for working in secure areas?

A) Unsupervised work in secure areas should be avoided.
B) When no one is in a secure area, it should be locked and verified periodically.
C) No one should be allowed to work in secure areas for more than four hours in a row.
D) Electronic devices that can record or copy mass amounts of information should be forbidden in secure areas.

Question 12

Which of the following is one of the four bases for authentication credentials?

A) What you know
B) What you have
C) Both A and B
D) Neither A nor B

Question 13

On loading docks, outgoing shipments should be separated from incoming shipments ________.

A) to ensure the segregation of duties
B) to avoid confusion
C) to reduce the risk of theft
D) All of the above

Question 14

Two-factor authentication can be defeated if ________.

A) the user's computer is compromised
B) the attacker uses a man-in-the-middle attack
C) Both A and B
D) Neither A nor B

Question 15

In CobiT, entry must be ________.

A) justified
B) logged
C) Both A and B
D) Neither A nor B

Question 16

If a laptop needs to be taken off premises, ________.

A) it should first be logged out.
B) it should be logged in when returned
C) all sensitive information should be removed
D) All of the above

Question 17

________ is the process of assessing the identity of each individual claiming to have permission to use a resource.

A) Authorizations
B) Authentication
C) Both A and B
D) Neither A nor B

Question 18

Authentication is the process of collecting information about the activities of each individual in log files for immediate and later analysis.

Question 19

In military security, SBU documents are unclassified.

Question 20

All unattended exits should be locked to bar exit.

Question 21

A ________ is a small device with a display that has a number that changes frequently.

A) one-time-password token
B) USB token
C) magnetic stripe card
D) None of the above

Question 22

A ________ card is an access card that has a built-in microprocessor and memory.

A) magnetic stripe
B) smart
C) Both A and B
D) Neither A nor B

Question 23

Password cracking is usually done over the network by trying many passwords to log into an account.

Question 24

The book recommends that passwords be at least ________ characters long.

A) 6
B) 8
C) 20
D) 100

Question 25

According to the book, r%Dv$ is a strong password.

Question 26

Long passwords that use several types of keyboard characters are called ________ passwords.

A) complex
B) reusable
C) dictionary
D) one-time

Question 27

A ________ card stores authentication data.

A) magnetic stripe
B) smart
C) Both A and B
D) Neither A nor B

Question 28

Most users who have access to servers use reusable passwords for authentication.

Question 29

Buildings should be set back from streets and protected with rolling hill landscaping to reduce threats from ________.

A) wireless eavesdropping
B) industrial espionage
C) casual observation
D) terrorism

Question 30

Which of the following is true?

A) Human password resets are dangerous.
B) Automated password resets are dangerous.
C) Both A and B
D) Neither A nor B

Question 31

Passwords should be changed frequently.

Question 32

In high-risk environments, password reset risks are reduced by requiring the user's physical presence.

Question 33

Passwords offer reasonable security at reasonable cost and will likely continue to increase in importance in the future.

Question 34

It is illegal to go through a company's trash bins even if the trash bins are outside the corporation.

Question 35

Users should select very long and complex passwords and use the same password at all sites for auditability.

Question 36

________ is a social engineering trick where an intruder may follow an authorized user through a door that the authorized user opens with an access device.

A) Shoulder surfing
B) Shadowing
C) Trailing
D) Piggybacking

Question 37

It is very important for testers to get permission before running a password cracking program on their company's computers to check for weak passwords even if such testing is in their job definitions.

Question 38

PCs should require login screens with complex passwords.

Question 39

A ________ is a small device that plugs into a standard computer port to identify the owner.

A) one-time-password token
B) USB token
C) magnetic stripe card
D) smart card

Question 40

A magnetic stripe card is an access card that has a built-in microprocessor and memory.

Question 41

Which is more likely to generate a false acceptance?

A) Verification
B) Identification
C) Both verification and identification are equally likely to generate a false acceptance.
D) None of the above

Question 42

In biometric, a match occurs when a ________ meets the decision criteria.

A) set of key features
B) match index
C) Both A and B
D) Neither A nor B

Question 43

________ can be much shorter than ________.

A) PINs, passwords
B) Passwords, PINs
C) There is no general length difference between passwords and PINs.
D) None of the above

Question 44

During enrollment, the scanner sends ________ to the authentication system.

A) scan data
B) key features
C) Both A and B
D) Neither A nor B

Question 45

A false rejection occurs when a person is improperly matched to a template.

Question 46

The template is based on ________ generated during the enrollment scan.

A) scan data
B) key features
C) Both A and B
D) Neither A nor B

Question 47

For watch lists of criminals, a false ________ means that an innocent person is identified as a criminal.

A) acceptance
B) rejection
C) Both A and B
D) Neither A nor B

Question 48

Verification is the process where the verifier determines the identity of the supplicant.

Question 49

Verification requires more matches against templates than does identification.

Question 50

________ is a form of identification that identifies a person as being a member of a group.

A) RBAC
B) Watch list matching
C) Group ID matching
D) Group acceptance

Question 51

A ________ does not require a special reader to be added to a PC for access control.

A) USB token
B) magnetic stripe card
C) smart card
D) All of the above

Question 52

The verifier itself determines the identity of the supplicant in ________.

A) verification
B) identification
C) Both A and B
D) Neither A nor B

Question 53

Identification requires more matches against templates than does verification.

Question 54

For computer access, a false ________ means that a legitimate user is denied access to a resource.

A) rejection
B) acceptance
C) Both A and B
D) Neither A nor B

Question 55

When an attacker deliberately attempts to fool the system, this is called ________.

A) deception
B) a false acceptance
C) a false rejection
D) All of the above.

Question 56

The major promise of biometrics is to replace reusable passwords.

Question 57

Identification is the process where the verifier determines whether the supplicant is a particular person that the supplicant claims who he or she is.

Question 58

A false acceptance occurs when a person is improperly matched to a template.

Question 59

From a security viewpoint, a false acceptance is always worse than a false rejection.

Question 60

For watch lists of criminals, a false acceptance is worse than a false rejection from a security viewpoint.

Question 61

Because fingerprint scanning is often deceived, it should never be used as a security measure.

Question 62

The ________ authentication problem is that unless individuals are carefully vetted before being allowed in a system, imposters can simply enroll through social engineering.

A) core
B) prime
C) final
D) human

Question 63

The principle of ________ states that each person should only get the permissions that he or she absolutely needs to do his or her job.

A) appropriate authorizations
B) least permissions
C) minimization
D) All of the above.

Question 64

Fingerprint scanning, which is often deceived, may be acceptable for entry into a non-sensitive supplies cabinet.

Question 65

Fingerprint recognition should be used as a security measure for access to ________.

A) a non-essential supply cabinet
B) a notebook containing sensitive information
C) Both A and B
D) Neither A nor B

Question 66

A private key/public key pair is usually created by the ________.

A) client
B) PKI server
C) Both A and B
D) Neither A nor B

Question 67

Hand geometry recognition is used heavily for ________.

A) PC access
B) watch list access
C) door access
D) server access

Question 68

CAs distribute public keys ________.

A) in digital certificates
B) only in ways using encryption for confidentiality
C) Both A and B
D) Neither A nor B

Question 69

A firm can be its own certificate authority for internal users.

Question 70

Iris scanning usually is done surreptitiously.

Question 71

The most widely used form of biometrics is ________.

A) retinal scanning
B) iris scanning
C) fingerprint scanning
D) face recognition

Question 72

Biometric authentication is the strongest form of authentication.

Question 73

In the context of PKI, ________ is the process of accepting public keys and providing new digital certificates to the users.

A) provisioning
B) reflection
C) coordination
D) certification

Question 74

The strongest form of authentication is ________.

A) biometrics
B) cryptographic authentication
C) reusable passwords
D) smart cards

Question 75

Iris recognition technology is ________ and ________.

A) expensive, has low FARs
B) expensive, has high FARs
C) inexpensive, has low FARs
D) inexpensive, has high FARs

Question 76

Authorizations are also called ________.

A) permissions
B) verifications
C) Both A and B
D) Neither A nor B

Question 77

Giving a user permissions to use a certain resource is ________.

A) authentication
B) authorization
C) Both A and B
D) Neither A nor B

Question 78

Which of the following statements accurately describes iris recognition?

A) Iris recognition has high FARs.
B) Iris recognition technology is expensive.
C) Iris recognition scans the eye with lasers.
D) All of the above

Question 79

Fingerprint recognition is easily deceived.

Question 80

Which of the following statements accurately describes fingerprint recognition?

A) Fingerprint recognition scanners are very expensive.
B) Fingerprint recognition is easily deceived.
C) Fingerprint recognition is rarely used.
D) All of the above