Font size
WorksheetsSEC+ Mod1 Part 3
Total questions: 82
Worksheet time: 41mins
What is the purpose of defining permissions at a granular level?
To provide fine-grained control over access to specific resources or actions.
To allow users to access all resources without restrictions.
To simplify the permission assignment process.
To ensure all users have the same level of access.
Why are regular access reviews important?
To maintain the accuracy of permissions and reduce the risk of stale access.
To increase the number of users with high-level access.
To eliminate the need for compliance requirements.
To avoid the need for user training and awareness.
What is the role of audit trails and monitoring in permission management?
To track user access and changes to permissions.
To grant all users administrative access.
To simplify the permission assignment process.
To eliminate the need for compliance requirements.
What can result from compliance violations in permission assignments?
Consequences, fines, and damage to an organization's reputation.
Increased user access to all resources.
Simplified permission management.
Elimination of the need for audit trails.
Why is user training and awareness important in permission management?
To educate users about the importance of proper permission management and the risks of over-privileged access.
To grant all users the same level of access.
To eliminate the need for regular access reviews.
To simplify the permission assignment process.
Which of the following access control mechanisms emphasizes the creation of specific access rules or policies for individual users or resources?
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Rule-Based Access Control (RBAC)
Rule-Based Access Control (RAC)
In which access control model do resource owners have the discretion over granting or revoking access to files and folders they own?
Rule-Based Access Control (RBAC)
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)
Which access control mechanism is often used in scenarios where fine-grained control over access is required?
Rule-Based Access Control (RAC)
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Which access control model is considered centralized and often used in financial institutions to manage access to sensitive financial data?
Discretionary Access Control (DAC)
Rule-Based Access Control (RAC)
Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)
Which access control model is often used in personal computing environments and file-sharing systems, where resource owners control access to their files and folders?
Mandatory Access Control (MAC)
Role-based Access Control (RBAC)
Attribute-based Access Control (ABAC)
Discretionary Access Control (DAC)
Which access control model enforces access controls based on security labels and a predefined security policy, typically governed by a central authority?
Discretionary Access Control (DAC)
Role-based Access Control (RBAC)
Attribute-based Access Control (ABAC)
Mandatory Access Control (MAC)
Which access control model focuses on defining roles or job functions within an organization and associating permissions with these roles?
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Attribute-based Access Control (ABAC)
Role-based Access Control (RBAC)
Which access control model is designed to provide fine-grained and context-aware access control by considering various attributes and conditions when making access decisions?
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-based Access Control (RBAC)
Attribute-based Access Control (ABAC)
In ABAC, policies are typically expressed in the form of what type of statements?
"If-then" statements
"When-then" statements
"Where-then" statements
"How-then" statements
What does the rule "IF current_time >= 8:00 AM AND current_time <= 5:00 PM THEN allow_access" imply?
Access is denied during these hours.
Access is allowed during these hours.
Access is allowed only on weekends.
Access is denied only on weekends.
What is the purpose of time-based conditions in ABAC?
To allow access based on user roles.
To enforce access restrictions based on specific timeframes.
To deny access based on user location.
To allow access based on user preferences.
Which of the following is NOT a common action in ABAC rule evaluation?
Allow_access
Deny_access
Grant_permission
Restrict_access
Why is time-based access control particularly useful in ABAC?
It allows unrestricted access at all times.
It ensures access aligns with business needs, security requirements, and compliance mandates.
It provides access based on user preferences.
It allows access only during weekends.
Which of the following is NOT involved in implementing ABAC?
Defining attribute-based policies.
Integrating attribute sources.
Deploying an ABAC system or policy enforcement point.
Granting access based on user preferences.
What does Privileged Access Management (PAM) refer to?
Using policies, procedures, and technical controls to secure and manage privileged accounts
Managing user accounts with standard access rights
Providing unlimited access to all users
Storing and managing public keys
What is the purpose of Just-in-Time Permissions (JIT) in PAM?
To provide permanent access to privileged accounts
To grant temporary, time-limited access to privileged accounts when needed
To store and manage passwords securely
To generate long-lived access credentials
What are Ephemeral Credentials in the context of PAM?
Long-lived passwords that never expire
Short-lived, dynamically generated access credentials
Permanent access tokens for all users
Static passwords stored in a vault
Which of the following is NOT a feature of PAM tools?
Just-in-Time Permissions (JIT)
Ephemeral Credentials
Unlimited access to all users
Password vaulting
What is password vaulting?
A feature that securely stores, manages, and rotates privileged account passwords.
A method of encrypting data for secure transmission.
A process of creating complex passwords.
A technique for monitoring network traffic.
Which of the following is NOT a key element of identity proofing?
Document verification
Biometric verification
Behavioral analysis
Password complexity
What is the primary purpose of authentication in cybersecurity?
To encrypt data during transmission.
To confirm the identity of an individual, system, or entity.
To monitor network traffic.
To create complex passwords.
Which principle do PAM tools enforce to reduce the attack surface?
Principle of least privilege
Principle of maximum security
Principle of data encryption
Principle of user monitoring
What is the process of confirming that an individual's claimed identity is accurate and reliable called?
Authentication
Encryption
Identity proofing
Data validation
Which of the following methods involves examining government-issued identification documents to verify authenticity?
Biometric Verification
Behavioral Analysis
Document Verification
Location Verification
What does biometric verification use to verify identity?
Government-issued documents
Physical or behavioral characteristics
Location-based data
Continuous monitoring
Which identity proofing method involves analyzing typing patterns and mouse movements?
Document Verification
Biometric Verification
Behavioral Analysis
Location Verification
What does location verification check to detect unauthorized access?
Typing patterns
Physical location using GPS or IP geolocation
Government-issued documents
Biometric data
In which industries might there be legal or regulatory requirements for specific identity-proofing processes?
Education and Retail
Finance and Healthcare
Entertainment and Sports
Agriculture and Construction
What is the purpose of continuous authentication in identity proofing?
To verify government-issued documents
To monitor user behavior and detect anomalies during an active session
To check physical location using GPS
To use biometric data for initial verification
What is the recommended minimum length for a secure password?
6 to 8 characters
8 to 10 characters
10 to 12 characters
12 to 16 characters
Which of the following is NOT a recommended guideline for creating and managing passwords?
Use long passwords
Use a mix of character types
Use easily guessable information
Avoid dictionary words
What is the purpose of password management?
To simplify the login process
To provide defense against unauthorized access to accounts and systems
To store passwords in a single location
To share passwords easily
Which of the following is a good example of a strong passphrase?
"password123"
"123456"
"PurpleTiger$Dances@Moon"
"qwerty"
Why should whole words found in dictionaries be avoided in passwords?
They are too long
They are susceptible to dictionary attacks
They are hard to remember
They are not unique
What should be included in each account to ensure password management?
Secure recovery options
Regularly updated passwords
Education and awareness
All of the above
What is the purpose of enforcing a password history policy?
To allow users to reuse their previous passwords
To prevent the recycling of old, potentially compromised passwords
To make it easier for users to remember their passwords
To encourage users to use simple passwords
What is the function of account lockout policies?
To allow unlimited login attempts
To lock an account temporarily after a specific number of unsuccessful login attempts
To permanently lock an account after one failed login attempt
To allow users to bypass login attempts
Why should users consider using a password manager?
To write down passwords on physical paper
To store passwords in easily accessible digital files
To securely store, manage, and generate intricate passwords for various online accounts
To share passwords with others easily
Which of the following is NOT a feature of password managers?
Password Storage
Password Generation
Auto-Fill and Auto-Login
Password Sharing with others
What is the benefit of using password managers for password generation?
They generate simple passwords
They generate robust, intricate, and distinct passwords for each account
They generate the same password for all accounts
They generate passwords that are easy to guess
What is the purpose of secure data storage in password managers?
To store passwords in plain text
To store passwords in a secure vault protected by a master password or biometric authentication
To store passwords on physical paper
To store passwords in easily accessible digital files
Why is it important to regularly update passwords?
To reduce the risk associated with long-term use
To make passwords easier to remember
To use the same password for all accounts
To avoid using complex passwords
What is the primary goal of passwordless authentication?
To eliminate the need for passwords
To create stronger passwords
To reuse passwords among users
To store passwords securely
Which of the following is NOT a common passwordless authentication method?
Biometric verification
Token-Based Authentication
One-Time Passwords (OTPs)
Password storage
What does biometric authentication rely on to verify a user's identity?
Passwords
Physical or behavioral traits
Security questions
Email verification
Which of the following is an example of a biometric authentication method?
Security questions
Fingerprint recognition
Password hints
Email verification
What is a key benefit of passwordless authentication methods?
They are more secure than password-based methods
They require frequent password changes
They simplify password storage
They allow password reuse
What is required for token-based authentication?
A physical or virtual token
A strong password
A security question
An email address
Which of the following is a benefit of passwordless authentication?
Reduces the risk of password-related attacks
Increases the complexity of passwords
Requires frequent password updates
Stores passwords securely
What are One-Time Passwords (OTPs)?
Permanent, reusable codes
Temporary, single-use codes
Codes generated by a smart card
Biometric authentication methods
How do push notifications work in the context of authentication?
By sending a code via email
By sending a notification to a registered mobile device
By using a physical smart card
By using biometric data
What is required for Smart Card Authentication?
A biometric scan
A temporary password
A smart card with embedded microchips
A push notification
What does Device Authentication rely on?
The unique characteristics and identifiers of a user's device
A temporary password
A physical smart card
A push notification
Why is the adoption of passwordless authentication becoming increasingly common?
To reduce the cost of authentication
To enhance security and simplify the login process
To eliminate the need for any form of authentication
To make passwords more complex
What is an authentication factor?
A method used to create passwords
A category of information or method used to verify identity
A type of encryption algorithm
A method to store passwords securely
What does Multi-factor Authentication (MFA) require users to provide?
One authentication factor
Two or more authentication factors
Only a password
Only a biometric scan
Which of the following is considered a "soft" authentication method?
Biometric authentication
Hardware tokens
Passwords
Secure key fobs
Which of the following is NOT a category of MFA factors?
Something you know
Something you have
Something you are
Something you see
Which of the following is an example of a "hard" authentication method?
Passwords
One-time password apps
Security questions
Biometric authentication
What is an example of a "knowledge-based" factor in MFA?
Biometric scan
Hardware token
Password
Secure key fob
Which of the following is an example of a possession-based factor for authentication?
Fingerprint Recognition
Facial Recognition
Mobile Devices
Voice Recognition
What is a characteristic of hardware tokens used for authentication?
They analyze and compare facial features.
They generate one-time passwords (OTPs) or other codes.
They scan and match the unique patterns in the iris of the eye.
They analyze unique behavior patterns, such as typing speed.
Which of the following is NOT a biometric factor for authentication?
Fingerprint Recognition
Smart Cards
Iris Scanning
Voice Recognition
What is the primary function of security keys in authentication?
Scanning and matching the patterns of ridges and valleys on a person's fingerprint.
Generating a unique cryptographic signature to prove the user's identity.
Analyzing and comparing vocal patterns, including pitch, tone, and speech patterns.
Scanning and matching the distinct patterns of blood vessels located on the back wall of the eye.
Which of the following is an example of a software token?
YubiKey
Google Titan Security Key
Feitian MultiPass FIDO Security Key
Mobile apps that generate OTPs
Which of the following is NOT a method used in location-based factors for authentication?
GPS Coordinates
IP Geolocation
Network Authentication
Password Authentication
What is the primary goal of IAM attestation?
To ensure access rights align with security policies, compliance requirements, and business needs
To provide users with easy access to all systems
To reduce the number of authentication factors
To eliminate the need for passwords
Which of the following is NOT included in the IAM attestation process?
Periodic review
Access permissions confirmation
Identification of anomalies
User training sessions
Multi-factor authentication (MFA) combines factors from at least how many different categories?
One
Two
Three
Four
Which of the following is an example of something a user possesses in multi-factor authentication?
Password
Personal mobile device
Security question answer
Username
What does IAM attestation involve during a periodic review?
Reviewing and validating access rights and entitlements granted to users and entities.
Confirming user roles and group memberships.
Identifying anomalies in access rights.
Generating comprehensive reports.
What is the purpose of Access Permissions Confirmation in IAM attestation?
To revoke unnecessary access.
To confirm whether access permissions assigned to users and entities are accurate and still relevant.
To generate comprehensive reports.
To meet regulatory compliance requirements.
What does IAM attestation aim to identify during the Identification of Anomalies?
Unauthorized access, overprivileged accounts, dormant accounts, or access rights that are no longer needed.
User roles and group memberships.
Regulatory compliance requirements.
Findings of the review and actions taken.
What actions are taken during Remediation Actions in IAM attestation?
Confirming user roles and group memberships.
Generating comprehensive reports.
Rectifying discrepancies or issues identified during the attestation process.
Meeting regulatory compliance requirements.
Why is Reporting and Documentation important in IAM attestation?
To confirm user roles and group memberships.
To meet regulatory compliance requirements.
To document the findings of the review, actions taken, and the status of access rights.
To identify anomalies in access rights.
What is the role of Compliance and Audit Requirements in IAM attestation?
To confirm user roles and group memberships.
To meet regulatory compliance requirements and demonstrate active management of access rights.
To identify anomalies in access rights.
To generate comprehensive reports.
Who are involved in IAM attestation?
Only administrators.
Only business unit managers.
Only system owners.
Various stakeholders including administrators, business unit managers, system owners, and auditors.
