CBK Domain 5 - Identity and Access Management.

Which type of access control model would we use if availability is MOST important?

• Rule-Based Access Control (RBAC)

• Role-Based Access Control (RBAC)

• Discretionary Access Control (DAC)

• Mandatory Access Control (MAC)

Looking at identity and access provisioning, identities consist of which of these?

• Objects

• Rights

• Attributes

• Entities

A disgruntled former employee is trying to break the passwords of our administrator accounts using rainbow tables.

What is he using for that?

• He uses full words often with numbers at the end.

• He has software installed on a computer that records all keystrokes.

• He has software installed on a computer that records all keystrokes.

• He uses precompiled hashes to compare the password hash to.

Which of these protocols is vendor-neutral?

• AD

• LDAP

• VTP

• EIGRP

Answer explanation

LDAP (The Lightweight Directory Access Protocol): Open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an IP network. Application layer protocol and use TCP and UDP port 389. LDAP is commonly used for central usernames and passwords storage, many different applications and services can connect to the LDAP server to validate users.

Which of these authentication protocols is no longer considered secure?

• Diameter

• Radius

• TACACS+.

• TACACS

Answer explanation

TACACS (The Terminal Access Controller Access Control System): Centralized access control system requiring users to send an ID and reusable (vulnerable) passwords for authentication, because of this it is no longer considered secure. Uses TCP/UDP port 49. TACACS has generally been replaced by TACACS+ and RADIUS.

Jane has been tasked with implementing multifactor authentication at our organization. The request from senior management is to make it secure, but also to protect employees' privacy and not inadvertently record something that could reveal private employee health information. To make passwords safer Jane implements some safeguards.

Which of these should NOT be one of them?

• Key stretching.

• No minimum password age.

• Salting

• Nonce

Answer explanation

We could use nonces, salting and key stretching as well as minimum password age. Nonce is arbitrary number that may only be used once. Salting is random data that is used as an additional input to a one-way function that hashes a password or passphrase. Key stretching – Adding 1-2 seconds to password verification. If an attacker is brute forcing password and need millions of attempts it will become an unfeasible attack. Minimum password age is used to prevent users from cycling through passwords to return to their favorite password again.

We are using DAC (Discretionary Access Control) in our organization.

What is DAC based on?

• The job role of the user.

• The discretion of the object owner.

• IF/THEN statements.

• Labels and clearance.

Answer explanation

DAC (Discretionary Access Control): Often used when Availability is most important. Access to an object is assigned at the discretion of the object owner. The owner can add, remove rights, commonly used by most OS’. Uses DACL’s (Discretionary ACL), based on user identity.

An administrator account keeps getting locked for too many logins. There is no malicious activity and the administrator is not using the account.

What is MOST LIKELY happening?

• The administrator used the wrong credentials on a system and it is using the administrator credentials and not the proper system credentials to authenticate.

• The administrator has configured a system to use his password for authentication and he has entered the right username and password.

• The password does not meet our requirements and because of that the account is being locked.

• The password has reached its maximum age and the administrator has chosen a new password.

Answer explanation

When an administrator uses their own credentials to allow systems access, the system will keep those credentials until logged out. It should not be done. If the administrator enters a wrong password, the system will keep re-authenticating, and that will eventually keep locking the account.

Jane has been tasked with implementing multifactor authentication for our organization. The request from senior management is to make it secure, but also to protect employees' privacy and not inadvertently record something that could reveal private employee health information.

What would be some good reasons to NOT use biometric authentication in Janes implementation?

• It can reveal private employee information.

• Biometrics are easily copied.

• It is wrong more often than not.

• Biometrics often change.

Answer explanation

Something you are - Type 3 Authentication (Biometrics): Can inadvertently breach our employees privacy: Some fingerprint patterns are related to chromosomal diseases. Iris patterns could reveal genetic sex, retina scans can show if a person is pregnant or diabetic. Hand vein patterns could reveal vascular diseases. Most behavioral biometrics could reveal neurological diseases, etc.

Which authentication method would use something you are expected to have?

• Type 2.

• Type 3.

• Type 0.

• Type 1.

Answer explanation

Something you have - Type 2 Authentication: ID, passport, smart card, token, cookie on PC, these are called Possession factors. The subject uses these to authenticate their identity, if they have the item, they must be who they say they are.