Question 1

A ____ is an automatic phone-dialing program that dials every phone number in a configured range and checks to see if a person, answering machine, or modem answers.

Accepted Answer

A war dialer is specifically designed to automatically dial a range of telephone numbers to find modems, fax machines, or humans, often used by hackers to find vulnerable computer systems to exploit.

Question 2

The growth and widespread use of the Internet has been coupled with the use of encryption technology to produce a solution for specific types of private communication channels: ____.

Accepted Answer

Virtual Private Networks (VPNs) use encryption to create a secure and private communication channel over the otherwise public Internet, allowing for private data to be transmitted securely.

Question 3

Which centralized authentication method uses UDP?

Accepted Answer

RADIUS uses UDP for its authentication, authorization, and accounting services. UDP is chosen for its simplicity and speed, which are suitable for the quick transactions required by RADIUS.

Question 4

Biometrics (retinal scans, fingerprints, and the like) are mainly used for ____ by large security-minded entities such as banking institutions and credit card centers for regulating access to sensitive information, but biometrics are also gaining ground in the general corporate world.

Accepted Answer

Biometrics are primarily used for authentication, which involves verifying the identity of individuals before granting them access to sensitive information or systems. This technology is widely adopted by security-conscious organizations to ensure that only authorized individuals can access certain data or areas.

Question 5

A bank's automated teller machine (ATM), which restricts authorized users to simple account queries, transfers, deposits, and withdrawals is an example of ____ access control.

Accepted Answer

Constrained user interface access control limits the options available to a user, in this case, by restricting ATM users to specific transactions like queries, transfers, deposits, and withdrawals, without allowing access to more sensitive or complex banking operations.

Question 6

A ____ is one in which the computer system enforces the controls without the input or intervention of the system or data owner.

Accepted Answer

Mandatory Access Control (MAC) is a security strategy that restricts the access rights of users and systems based solely on information security policies established by the system administrator, without the need for input or intervention from the data or system owner.

Question 7

Client authentication is similar to user authentication but with the addition of ____.

Accepted Answer

The answer of Client authentication is similar to user authentication...

Question 8

Which access control principle is most frequently associated with data classification?

Accepted Answer

The "Need to know" principle is most frequently associated with data classification because it ensures that access to information is limited to individuals who require that information to perform their job functions, aligning closely with the principles of data classification which aims to restrict access based on the sensitivity of the information.

Question 9

Which level in the U.S. military data classification scheme applies to any information or material the unauthorized disclosure of which reasonably could be expected to cause damage to the national security?

Accepted Answer

Confidential data is the correct level in the U.S. military data classification scheme for information whose unauthorized disclosure could reasonably be expected to cause damage to national security. Secret and Top Secret classifications denote higher levels of expected damage from unauthorized disclosure. Sensitive but Unclassified (SBU) does not indicate a level of expected damage to national security.

Question 10

Which access control principle restricts users to having access appropriate to the level required for their assigned duties?

Accepted Answer

The principle of least privilege restricts users to only the access necessary to perform their job functions, minimizing potential security risks.

Question 11

Which centralized authentication method is the latest and strongest version of a set of authentication protocols developed by Cisco Systems?

Accepted Answer

TACACS+ (Terminal Access Controller Access-Control System Plus) is the latest and strongest version of the authentication protocols developed by Cisco Systems. It provides more granular control over authentication and authorization processes compared to its predecessors.

Question 12

Which access control process documents the activities of the authenticated individual and systems?

Accepted Answer

The answer of Which access control process documents the activities...

Question 13

Most personal computer operating systems use the mandatory access control (MAC) model.

Accepted Answer

Most personal computer operating systems use the discretionary access control (DAC) model, where the access control is determined by the owner of the object.

Question 14

A(n) ____ is a list of authorization rights attached to an object - in other words, who can access that device or application and what can they do with it.

Accepted Answer

An Access Control List (ACL) is a list that tells what access rights each user has to a particular system object, such as a file directory or individual file. It controls who can access the object and what operations they can perform on it.

Question 15

Separation of duties reduces the chance of an individual violating information security policy and breaching the confidentiality, integrity, and availability of information.

Accepted Answer

Separation of duties ensures that no single individual has control over all aspects of any critical task, thereby reducing the risk of unauthorized actions or fraud and enhancing the security of information.

Question 16

A ____ attack is time-intensive, so they are rarely aimed at the target system in general.

Accepted Answer

A brute-force attack involves trying all possible combinations to crack passwords or encryption keys, which is time-intensive and resource-consuming, making it less likely to be used against a target system in general without a specific high-value target in mind.

Question 17

PPTP provides stronger protection than L2TP.

Accepted Answer

L2TP (Layer 2 Tunneling Protocol) often combined with IPsec, provides stronger security features than PPTP (Point-to-Point Tunneling Protocol), which relies on the less secure MS-CHAP v2 for authentication.

Question 18

In order to implement MAC, a strict user and data classification scheme is required.

Accepted Answer

Mandatory Access Control (MAC) relies on a strict classification of users and data to enforce security policies, where access permissions are determined by an administrator and cannot be changed by users.

Question 19

Which authentication method is used when you want a client to be authenticated for each session?

Accepted Answer

Session authentication is specifically designed to authenticate users for each session, ensuring that the user's identity is verified every time a new session is initiated. This method typically involves the creation of a unique session token upon login, which is then used to maintain the authenticated state throughout the session.

Question 20

Today, the widespread acceptance of IPSec with the IKE system means that proprietary protocols are used far more often.

Accepted Answer

IPSec with the IKE system is a standardized suite of protocols used for secure Internet Protocol (IP) communications, reducing the need for proprietary protocols.

Quiz 5: Network Authentication and Remote Access Using Vpn