CIST 1601 Chapter 6 Review

Audit trails produced by auditing activities are which type of security control?

• Preventative

• Directive

• Deterrent

• Detective

Answer explanation

Audit trails are a type of detective security control. Detective controls are implemented to identify and respond to security incidents after they have occurred. Audit trails are records of events and activities that can be used to track and analyze security-related events in a system or network. They provide a historical record of activities, which can be crucial for investigating security incidents, monitoring compliance, and identifying potential security issues.

Which access control model is based on assigning attributes to objects and using Boolean logic to grant access based on the attributes of the subject?

• Attribute-Based Access Control (ABAC)

• Mandatory Access Control (MAC)

• Role-Based Access Control (RBAC)

• Rule-Based Access Control

Answer explanation

The access control model that is based on assigning attributes to objects and using Boolean logic to grant access based on the attributes of the subject is known as the Attribute-Based Access Control (ABAC) model.

Which of the following is used for identification?

• username

• password

• PIN

• cognitive question

Answer explanation

The element used for identification among the options provided is the "Username." The username is a unique identifier associated with a user account and is typically used during the authentication process to uniquely identify the user. Usernames are often combined with other authentication factors, such as passwords or PINs, to verify the user's identity.

You are concerned that the accountant in your organization might have the chance to modify financial information and steal from the company. You want to periodically have another person take over all accounting responsibilities to catch any irregularities. Which security principle are you implementing by periodically shifting accounting responsibilities?

• Job rotation

• Need to Know

• Principle of least privilege

• Explicit deny

• Separation of duties

Answer explanation

Job rotation is a practice where employees are periodically moved or rotated through different positions or tasks within an organization. This helps in reducing the risk of fraud or errors by ensuring that no single individual has prolonged access or control over sensitive functions.

An access control list (ACL) contains a list of users and allowed permissions. What is it called if the ACL automatically prevents access to anyone who is not on the list?

• 
  Implicit deny

• Explicit deny

• Implicit allow

• Explicit allow

Answer explanation

If an Access Control List (ACL) automatically prevents access to anyone who is not on the list, it is referred to as "Implicit deny." Implicit deny is a default rule in many access control systems that denies access by default unless there is an explicit rule granting access.

Which of the following principles is implemented in a mandatory access control model to determine object access by classification level?

• separation of duties

• clearance

• need to know

• ownership

• principle of least privilege

Answer explanation

The "Need to Know" principle ensures that individuals are granted access to information or resources based on their specific job responsibilities and the necessity to perform their duties. In a mandatory access control model, access decisions are often based on security clearances and the classification level of information.

You assign access permissions so that users can only access the resources required to accomplish their specific work tasks. Which security principle are you complying with?

• job rotation

• principle of least privilege

• cross-training

• need to know

Answer explanation

The Principle of least privilege is a security concept that advocates providing individuals with the minimum level of access or permissions necessary to perform their job functions and tasks. By adhering to this principle, you reduce the potential for unauthorized access and limit the impact of security incidents or breaches.

1. Which of the following is an example of rule-based access control?

• 1. Router access control lists that allow or deny traffic based on the characteristics of an IP packet.

• 1. A subject with a government clearance that allows access to government classification labels of

     Confidential, Secret, and Top Secret.

• 1. A member of the accounting team that is given access to the accounting department documents.

• 1. A computer file owner who grants access to the file by adding other users to an access control list.

Answer explanation

Rule-based access control involves defining access control rules that specify conditions under which access is allowed or denied. In the case of router access control lists (ACLs), rules are defined based on the characteristics of IP packets, such as source and destination IP addresses, protocols, and port numbers.

Which of the following is the term for the process of validating a subject's identity?

• authentication

• identification

• authorization

• auditing

Answer explanation

Authentication is the process of verifying the claimed identity of an individual, system, or entity. It involves presenting credentials (such as usernames, passwords, or other factors) to a system or application to prove that the entity is who it claims to be. Successful authentication provides access to the system or resources, while failed authentication denies access.

You want to make sure that any reimbursement checks issued by your company cannot be issued by a single person. Which security principle should you implement to accomplish this goal?

• separation of duties

• mandatory vacations

• job rotation

• least privilege

• implicit deny

Answer explanation

The Separation of Duties principle involves dividing tasks and responsibilities among multiple individuals to reduce the risk of fraud, errors, or misuse of authority. In the context of issuing reimbursement checks, you might implement a system where multiple individuals are involved in the process, such as one person preparing the check, another authorizing it, and possibly a third person handling the distribution. This way, no single person has complete control over the entire process, enhancing accountability and security.