Mod 07 Identity and Access Management (IAM)

Alexandria works at a secure installation that requires a special ID card with her picture to gain access. An officer at the gate needs to scan the ID card before allowing employees to enter the installation. One day she forgets her card. However, since the officer recognizes her, the officer lets her pass through the gate. Which of the following elements, if any, did the officer violate (not enforce)?

• Someone you know

• Something you have

• Something you exhibit

• Something you present

• The officer did not violate any of these.

Answer explanation

The officer violated 'Something you have' by allowing Alexandria to enter without her ID card, which is the required item for access. Her recognition by the officer does not substitute for the physical ID.

Viraa works at a virology lab that requires her to place her hand on a specialized "medical" device to scan certain genetic characteristics before being granted access. Which of the following is being used to prove her authenticity?

• Something you exhibit

• Something you have

• Something you are

• Someone you are

Answer explanation

The correct choice is 'Something you exhibit' because Viraa's hand scan involves biometric data, which is a physical characteristic she exhibits, proving her identity for access.

The letter I in IAM deals with which of the following items? Select two.

• Availability

• Accounting

• Authentication

• Authorization

• Identity proofing

Answer explanation

In IAM, the 'I' stands for Identity, which encompasses Authentication (verifying user identity) and Identity proofing (establishing the legitimacy of the identity). These are key components in managing access and security.

Divya logs in to her online bank account using a username and password, then proceeds to transfer money from one bank account to another. What likely safeguards has the bank implemented to secure her login credentials?

• The username and password are combined and then a hash is created.

• A digest of the current password Divya set is stored for comparison.

• The password is encrypted with a strong encryption algorithm.

• It uses the PIN as the private key to encrypt the password.

• The password is stored in plaintext in a very secure repository.

Answer explanation

The bank likely stores a digest of Divya's password for comparison, which enhances security by not keeping the actual password. This method protects her credentials against unauthorized access.

A security professional is analyzing passwords. What two observations can the analyst make regarding the following password: L0nd0nbr1dge!3

• The variety of character sets indicates the user employed a good password policy.

• It exhibits characteristics of predictable patterns found among passwords.

• It is a strong password because it contains at least eight characters.

• It is a relatively weak password.

Answer explanation

The password 'L0nd0nbr1dge!3' shows predictable patterns, such as substituting 'o' with '0' and 'i' with '1', making it weaker. Despite having a mix of characters, its predictability contributes to its overall weakness.

Attaqui, a threat actor, prefers to use password spraying for which of the following likely reasons?

• It avoids account lockouts by trying a few passwords on many accounts.

• It is faster than brute force attacks on a single account.

• It is less likely to be detected by security systems.

• It requires less technical skill than other attack methods.

Answer explanation

Attaqui uses password spraying to avoid account lockouts, as this method tests a few common passwords across many accounts, reducing the risk of triggering security measures that lock accounts after multiple failed attempts.

Which of the following describes true statements regarding the process of uncovering passwords using a high-outcome password cracker?

• The notion of high outcome is only possible when passwords are stored in plaintext.

• It applies reverse-engineering techniques to uncover passwords based on entries in digest files.

• It uses an online brute-force approach to cycle through combinations of characters to find a match.

• It compares an existing database of hashes with hashes in the stolen password file.

Answer explanation

The correct choice states that a high-outcome password cracker compares an existing database of hashes with those in a stolen password file, effectively using precomputed hash values to uncover passwords.

A threat actor is building a computer for use in brute-force attacks. Which of the following is the attacker most likely to consider highly desirable?

• A system with a hard drive with a lot of storage capacity.

• A system with multiple powerful GPUs.

• A system with multiple powerful CPUs.

• A system with a very fast internet connection.

Answer explanation

A system with multiple powerful GPUs is highly desirable for brute-force attacks because GPUs can perform many calculations simultaneously, significantly speeding up the process compared to CPUs.

Which of the following statements accurately describes the differences or similarities between a brute-force attack and a dictionary attack? Select two.

• a. Dictionary attacks are successful due to poor password policies.

• b. Brute force is an offline attack whereas a dictionary attack is an online attack.

• c. A dictionary attack compares plaintext whereas a brute-force attack compares hash values.

• d. A dictionary attack uses a much wider range of candidate digests than a dictionary attack.

• e. A dictionary attack is a variation of an offline brute-force attack.

Answer explanation

Choice a is correct as dictionary attacks exploit weak passwords. Choice e is also correct because a dictionary attack is indeed a type of offline brute-force attack, using a predefined list of potential passwords.

A calculating attacker manages to obtain the password digest from a department store. The attacker then proceeds to engage in a type of attack known as credential stuffing. How can you protect yourself against this type of attack?

• Do not use a password that contains characters or patterns similar to the username.

• Do not use a password that can be uncovered by a mask based on statistical analysis.

• Change your password at least once a month.

• Do not use the same password on multiple accounts.

Answer explanation

Using the same password across multiple accounts increases vulnerability. If one account is compromised, attackers can access others. Therefore, using unique passwords for each account is crucial to protect against credential stuffing.