Looking at identity and access provisioning, identities consist of which of these?

A disgruntled former employee is trying to break the passwords of our administrator accounts using rainbow tables.

What is he using for that?

Which of these protocols is vendor-neutral?

Which of these authentication protocols is no longer considered secure?

Jane has been tasked with implementing multifactor authentication at our organization. The request from senior management is to make it secure, but also to protect employees' privacy and not inadvertently record something that could reveal private employee health information. To make passwords safer Jane implements some safeguards.

Which of these should NOT be one of them?

We are using DAC (Discretionary Access Control) in our organization.

What is DAC based on?

An administrator account keeps getting locked for too many logins. There is no malicious activity and the administrator is not using the account.

What is MOST LIKELY happening?

Jane has been tasked with implementing multifactor authentication for our organization. The request from senior management is to make it secure, but also to protect employees' privacy and not inadvertently record something that could reveal private employee health information.

What would be some good reasons to NOT use biometric authentication in Janes implementation?

Which authentication method would use something you are expected to have?

We are thinking about implementing biometrics throughout our organization. Which of these could be reasons we should consider as reason to NOT implement biometrics?

(Select all that apply).

A HMAC-based one-time password (HOTP) is an example of which type of authentication method?

In which type of access control model would your access to data be determined by your job title?

If we were to implement SESAME instead of KERBEROS, what would it uses instead of tickets?

An attacker has gained access to our hashed passwords. We haven't started used salting or nonces yet. Why is that a problem?

After we have implemented biometrics in our organization, we are having issues with a too-high rejection rate of authorized employees. Which of these is the false rejection rate?

Type 2 authentication includes all these, EXCEPT which?

We have, after a long project, implemented biometrics in our organization.

What do we want for our biometrics?

When we are using knowledge-based factors in our authentication process, we would use all of these, EXCEPT which?

When we are using our username and password online for authentication, what else can we use for multifactor authentication?

Which of these would NOT be part of a good identity and access provisioning lifecycle?

Brute force can, in theory, break any password, even one-time pads. Is that a problem we should consider if we use proper security measures around our one-time pads?

When we are implementing new access control mechanisms, looking at the IAAA model, what could we use for identification?

Jane has a project to looking at possible Federated Identity Management (FIDM) implementations at our organization. Which of these would she NOT consider?

In our access management, we would NEVER want to use group user accounts. Why is that?

Jane is suggesting we use LDAP for our authentication protocol. What is the LDAP protocol?

When we add salting to our hashed password, what would that possibly protect us against?

If we are using magnetic stripe ID cards and we are wanting to add additional security measures, which of these could we implement for visual inspection and have it be the MOST secure?

Looking at the authentication methods we use, which type is expected to be something you memorize?

In which type of access control does subjects have clearance and object labels?

PINs, passwords, and passphrases are all which type of authentication?

In a security audit, we are looking at the authentication protocols we use. Which of these uses a key-distribution center?

We are using one-time passwords that are pushed every 30 seconds to an application on our technical staff's phones. Which type of tokens are we using?

Which type of access control could we use to limit access outside of regular work hours?

We are using Kerberos. What does the client send to the Authentication Server (AS)?

We are adding random data to our password hashes, to prevent attackers from successfully using rainbow table and dictionary attacks. What are we adding to the hash function?

We are implementing Active Directory (AD) to use for managing our access control. Which of these OS families have AD natively included in their processes and services?

Storing passwords in plaintext on a server is obviously a big security vulnerability. Why would an organization choose to do that?

What is Mandatory Access Control (MAC) based on?

A disgruntled employee in our organization is trying to break administrator passwords using dictionary attacks. How would he do that?

Which of these is NOT a downside to enforcing software tokens on phones for multifactor authentication?

An attacker has stolen some of our hashed passwords. Which of these countermeasures, if already implemented, could prevent the attacker from finding the plaintext passwords with rainbow tables?

We have been using Kerberos for some years. Bob is explaining the traffic flow to a new colleague. What does the client send to the TGS?

When we look at using type 3 authentication, we would talk about all these terms EXCEPT which?

Diameter was designed to replace Radius, but the change never happened. Where is Diameter COMMONLY used now?

In our authentication process we are wanting to add a pseudo random number to ensure old data is not replayed. Which of these would we add?

We are implementing new access control in our organization. If we look at the IAAA model, what could we use for authentication?

A disgruntled former employee of our organization is trying to break the passwords of one of our administrator accounts. He is using a keylogger; how does he do that?

We have had a security breach. We have already reissued Type 1 and 2 authentications to our users. How would we reissue a new type 3 authentication to them?

In our best practice password policy, which of these would be allowed?

We are already using usernames and passwords online. Which of these could be something else we would add to get multifactor authentication?

We often allow users to use "secret questions and answers" to unlock their accounts because it makes our administrators' workload lighter. Can they also be used as an attack vector?

Which of these protocols provides mutual authentication?

Which of these is the WEAKEST form of authentication we can implement?

Bob has been tasked with adding content-based access control, in addition to our existing security controls. Which of these could be part of what he implements?

In which type of access control system would access to data be determined by a subject’s clearance?

Which type of authentication is the WORST to have compromised, because we are unable to reissue it?

An attacker is using brute force on a user accounts password to gain access to our systems. We have not implemented clipping levels yet. Which of these other countermeasures could help mitigate brute force attacks?

Jane chose Security Assertion Markup Language (SAML) for our federated identity management (FIdM). Which type of Single Sign-On (SSO) is that?

Which of these protocols is the MOST commonly used for remote management of routers and switches?

When we use single-use passwords and one-time pads, we are using which type of authentication?

Which kind of type 3 authentication errors are the WORST?

In our access control implementations, we are wanting to ensure the accountability of our users. Which of these could be something we could use for that?

Your bank sends you a test message with a number to enter along with your username and password. What is this an example of?

What can we do we do when a type 1 authentication is compromised?

We have found some older systems on our network using the Password Authentication Protocol (PAP) protocol. What would be a reason we would want to migrate away from using it?

We are using AD (Active Directory) in our organization. We have just bought out a competitor. They are also using AD, but we are not sure on their security posture yet.

Which of these are common types of AD trust domains?

(Select all that apply).

Which of these countermeasures would be the LEAST effective against brute force attacks?

Why would we choose a centralized access control system over a decentralized one?

Jane is looking at the Kerberos implementation we have in place and is working on the Key Distribution Center (KDC).

Which of these is part of the KDC?

Jane is looking at the Kerberos implementation we have in place and is working on the Key Distribution Center (KDC).

Which of these is part of the KDC?

What can we implement that could help DECREASE identity theft online?

Which of these is NOT a problem when we are talking about our biometrics?

The TACACS+ protocol as default uses which TCP port?

We are using some of the best practice rules on our password's requirements. Which of these would NOT be part of that?

As part of our authentication process, we have issued our staff TOTP tokens. How do they work?

We have an employee who is moving from IT to HR. If we are using Role Based Access Control (RBAC) access control, what would we do to his access?

If we wanted to implement the CHEAPEST and the WEAKEST type of authentication, what would we implement?

In which access control model can the data owner add and remove rights to or from a user?

Which of these could be a countermeasure we can use to detect a software keylogger?

In which of these authentication methods is NOT something physical?

When we have our users hold their employee ID cards close to a reader, we are using which technology?

Jane has been tasked with finding multifactor authentication solutions for our organization.

Which of these is TRUE multifactor authentication?

For our new startup, we are looking at different types of identity and access management.

Which of these are COMMON types of that? (Select all that apply).

Bob is implementing SSO for our internal applications, he is adding a fingerprint reader to each workstation for users to authenticate with.

What is Bob implementing?

In implementing type 1 authentication, we could implement which of these?

(Select all that apply).

Which of these security issues could be a reason we would NOT want to implement Kerberos?

When we have our employees insert a card into a reader, it is using which type of technology?

Without using anything to trick our systems, an unauthorized individual is allowed access using our biometric authentication.

This is an example of what?

For our authentication, we are looking at knowledge factors.

Which is the MOST common knowledge factor in use today?

Which of these options could be something that can help an attacker circumvent clipping levels?

Which of these describes Type 1 authentication?

If we are using Active Directory (AD) for our Role Based Access Control (RBAC) authentication, we would innately use which authentication protocol?

We are using RBAC access control in our organization. What is that based on?

What is a WEAKNESS of the Challenge Handshake Authentication Protocol (CHAP)?

When someone is using a fake ID, it is an attack on which type of authentication?

What could be one of the NEGATIVE consequences of implementing Single Sign On (SSO) in our organization?

When we talk about auditing in the IAAA model, what does that mean?

Bob is working on designing new access controls across our organization. Which documentation should he reference to know how and what to implement?

Which type of authentication can also be used for identification?

Implementing our access control model, you are asked, "In which type of access management would you use access lists?" What do you answer?

In our access control implementations, keeping the IAAA model in mind, which of these could we use for authorization?

When we are storing our passwords, which of these would be the MOST secure way to do so?

Which type of authentication will ask the user for something they have?

Jane is manually reviewing our logs. As the organization has grown, there are simply too many logs to review manually in a timely fashion.

Which of these could help her?

We have implemented contactless ID cards in our organization. Which type of technology do they use?

If we set too high sensitivity on our biometrics readers, it can often cause too many what?

An attacker has been listening to our network traffic and has captured some passwords and session IDs. She is planning to use them in an attack in 2 days. What would the attack be using?

When we have a system requiring users to reauthenticate every hour, what is that system using?

Which of these, if used right, is the MOST secure form of "something you have" authentication?

Looking at how we authenticate our employees, which of the authentication methods is something you are?

We can use smart cards, tokens, passports, and IDs for which type of authentication?

We want to protect against rainbow tables by implementing salting. What are rainbow tables made up of?

We have found some older systems on our network using Challenge-Handshake Authentication Protocol (CHAP).

What could be a reason we would want to migrate away from using CHAP?

An administrator notices a user's account is being used from across the world and at 0300 in the morning. They know the employee is not out of the country.

What is the FIRST thing they should do?

What is LDAP COMMONLY used for?

John is not allowed to access the organization's network from anywhere but his home and at his desk at work.

He just went on vacation and tried to log in. His access request was denied.

This is a type of what?

In which type of access management would we use labels for objects?

Which type of access control model would we use if confidentiality was the MOST important factor to us?

Active Directory (AD) uses trust domains; one domain establishes a trust relationship with another domain.

Which of these is NOT an AD trust domain?

Bob is working on adding context-based access control in addition to our existing security controls.

What could be something he would implement?

Jane is tasked with looking at federated identity management (FIdM).

Which of these would she NOT consider?

After our CEO has had issues getting her finger printer reader to recognize her fingerprint, she is wanting us to lower the sensitivity on the readers.

What could be a NEGATIVE side effect of doing what she is asking us to do?

In identity and access provisioning, your identities would correspond to what?

What is the PRIMARY reason we would implement clipping levels?

We have realized our current use of magnetic stripe ID cards is not matching the security profile senior management wants.

What could we use on the cards in addition to the magnetic stripe to make them smart cards?

When we swipe an access card, it is using which technology?

Your bank sends you an email with a number to enter along with your username and password.

After having done this for the first time, you may not have to do it again why is that?

We are using our username and password online.

What can we add to that to get multifactor authentication?

We have discovered we may have hardware keyloggers on some of our workstations.

\How could we detect a hardware keylogger?

Jane is implementing active directory throughout our organization. She wants all the domains to trust each other, which type of trust domain should she implement?

Which security issue in Kerberos was addressed in SESAME with Public Key Infrastructure (PKI)?