Font size
WorksheetsChapter Three Practice Quiz - Info Sec
Total questions: 78
Worksheet time: 42mins
What are the two main concepts involved in deciding whether to allow party access to your resources?
Authentication and Encryption
Authorization and Access Control
Identification and Verification
Encryption and Decryption
What is the process of determining exactly what an authenticated party can do?
Authentication
Encryption
Authorization
Verification
What are the tools and systems you use to deny or allow access?
Encryption keys
Access controls
Passwords
Firewalls
Which of the following is NOT a form of physical access control?
Keys
RFID tags
Passwords
Badges
What are the four basic tasks you can use access controls to carry out?
Allowing access, denying access, limiting access, and revoking access
Allowing access, encrypting data, limiting access, and revoking access
Allowing access, denying access, encrypting data, and decrypting data
Allowing access, denying access, verifying identity, and encrypting data
What is the opposite of granting access?
Allowing access
Denying access
Limiting access
Implementing access
What is the default setting for many access control systems?
Allow access
Deny access
Limit access
Grant access
What is one way to limit access by running sensitive applications?
Using firewalls
Using antivirus software
Using sandboxes
Using encryption
What is an example of a sandbox used to run programs written in the Java programming language?
JavaScript Engine
Java Virtual Machine (JVM)
Java Development Kit (JDK)
Java Runtime Environment (JRE)
What are the two main methods of implementing access controls?
Access control lists and capabilities
Firewalls and antivirus software
Encryption and decryption
Passwords and biometrics
What does ACL stand for in the context of access control?
Access Control Language
Access Control List
Access Control Level
Access Control Logic
What are the three types of permissions in most file systems' ACLs?
Read, Write, Execute
Read, Write, Delete
Read, Modify, Execute
Read, Delete, Execute
In UNIX-like operating systems, what command can be used to view the three sets of permissions?
ls -la
chmod -R
chown -R
ps -ef
What does the first character in the file permissions (e.g., |rw|r|r) generally represent?
The file type
The user permissions
The group permissions
The other permissions
In the file permissions |rw|r|r, what does the second segment represent?
The file type
The user permissions
The group permissions
The other permissions
In Linux, to whom do the group permissions apply?
A single user only
The entire developer group
Any authenticated user
A specific individual user
What do Network ACLs typically filter access based on?
Usernames
Internet Protocol (IP) addresses
File types
Operating systems
What is one of the simplest forms of network-oriented ACLs?
User-based filtering
Media Access Control address filtering
File type filtering
Operating system filtering
Why is using IP addresses as a unique identifier for devices on a network considered a shaky prospect?
IP addresses are too long
IP addresses are not unique to a network interface
IP addresses are too expensive
IP addresses are difficult to configure
What is the primary reason for using multiple identifiers to filter traffic in network ACLs?
To increase network speed
To ensure more accurate filtering
To reduce the cost of network management
To simplify network configuration
What is a common use of large-scale filtering by organizations exposed to the internet?
To increase bandwidth
To block out known attacks, spammers, and other undesirable traffic
To improve user experience
To reduce server load
What is the practice called when traffic sent to filtered destinations appears to have vanished into a black hole?
Blackholing
Whitelisting
Port forwarding
Traffic shaping
Which port is used by FTP to transfer files?
22
20 and 21
143
80
What is the numerical designation for one side of a connection between two devices called?
IP address
Network port
MAC address
Socket
Which port does Secure Shell (SSH) use to manage remote connections to systems?
20
21
22
143
What is a common combination used to create a more secure technique for filtering traffic?
IP address and port
IP address and MAC address
Port and socket
MAC address and socket
What is the problem called when software with access to a resource has a greater level of permission than the software controlling it?
Blackholing
Confused deputy problem
Port forwarding
Traffic shaping
What is the main goal of attacks that take advantage of the confused deputy problem?
To steal user credentials
To trick the user into taking some action when they think they are doing something else
To install malware on the user's computer
To delete files from the user's computer
Which of the following is an example of an attack that exploits the confused deputy problem?
Phishing
Man-in-the-middle attack
Cross-site request forgery (CSRF)
Denial of service (DoS)
What does CSRF stand for?
Cross-Site Resource Forgery
Client-Side Request Forgery
Cross-Site Request Forgery
Client-Side Resource Forgery
In a clickjacking attack, what does the attacker typically do to trick the user?
Embeds a malicious link in an email
Places an invisible layer over something the client would normally click
Sends a phishing email
Installs a keylogger on the user's computer
What is the role of the 'confused deputy' in the example involving BankCo?
The user's computer
The attacker's offshore account
The bank server
The user's web browser
What is another term for clickjacking?
User interface redressing
Cross-site scripting
SQL injection
Man-in-the-middle attack
What is a capability in the context of defining permissions?
A physical object that grants access
A set of permissions based on a user's token or key
A file that contains all permissions
A type of malware
In a capability-based system, what determines the right to access a resource?
The identity of the person
The possession of a token
The time of day
The type of resource
Which access control model allows the owner of the resource to determine who gets access to it?
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Discretionary Access Control (DAC)
Attribute-Based Access Control (ABAC)
What is the principle of least privilege?
Giving a party the maximum level of access
Giving a party no access at all
Giving a party the bare minimum level of access
Giving a party access based on their role
Which access control model is often implemented in government organizations?
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
What type of attack could be prevented by using capabilities instead of ACLs to manage permissions?
Phishing
SQL Injection
Confused Deputy Attack
Man-in-the-Middle Attack
What is the principle of least privilege?
Allowing users to have administrative access to all systems.
Granting users only the permissions they need to perform their job.
Providing all users with access to the organization's internal human resources system.
Allowing users to carry out any task that the operating system allows.
What is a common issue with the implementation of the principle of least privilege in Microsoft operating systems?
Users are given too many permissions.
Users are not given enough permissions.
Users are unable to create documents.
Users cannot exchange emails.
What is Rule-Based Access Control (RBAC)?
Access control based on the role of the individual.
Access control based on a set of rules defined by the system administrator.
Access control based on the specific attributes of a person.
Access control that allows all users administrative access.
What does the Role-Based Access Control (RBAC) model allow?
Access based on the specific attributes of a person.
Access based on the role of the individual being granted access.
Access based on a set of rules defined by the system administrator.
Access to all users regardless of their role.
What is Attribute-Based Access Control (ABAC)?
Access control based on the role of the individual.
Access control based on a set of rules defined by the system administrator.
Access control based on the specific attributes of a person, resource, or environment.
Access control that allows all users administrative access.
What is the primary purpose of a CAPTCHA?
To control access based on height
To prove that the user is human
To control access based on time limits
To control access based on environmental conditions
What is the main concern of the Bell-LaPadula model?
Availability of resources
Integrity of data
Confidentiality of the resource
Usability of the system
Which type of access control combines discretionary and mandatory access controls?
Role-based access control
Attribute-based access control
Multilevel access control
Time-based access control
What is an example of a subject attribute used in access control?
Height
Time limits
Environmental conditions
Specific software or protocols
What is the purpose of using environmental attributes in access control?
To control access based on the user's height
To control access based on the user's age
To control access based on environmental conditions
To control access based on the user's role
What is the main concern of the Biba model?
Confidentiality of data
Integrity of data
Availability of data
Accessibility of data
According to the Bell-LaPadula model, what is the rule for reading classified information?
No read up
No read down
No write up
No write down
In the Bell-LaPadula model, what is the rule for writing classified information?
No read up
No read down
No write up
No write down
What does the Simple Security Property in the Bell-LaPadula model state?
An individual can read any resource regardless of classification
An individual cannot read a resource classified at a higher level
An individual can write to any resource regardless of classification
An individual cannot write to a resource classified at a lower level
What does the Simple Integrity Axiom in the Biba model state?
Access to one level does not grant access to lower levels
Access to one level grants access to higher levels
Access to one level grants access to all levels
Access to one level does not grant access to higher levels
What is the main difference between the Bell-LaPadula model and the Biba model?
Bell-LaPadula focuses on integrity, Biba focuses on confidentiality
Bell-LaPadula focuses on availability, Biba focuses on integrity
Bell-LaPadula focuses on confidentiality, Biba focuses on integrity
Bell-LaPadula focuses on accessibility, Biba focuses on availability
What does the * (Star) Property in the Bell-LaPadula model state?
No read up
No read down
No write up
No write down
What does the * (Star Integrity Axiom) in the Biba model state?
No read up
No read down
No write up
No write down
What is the primary purpose of the Brewer and Nash model?
To manage financial transactions
To prevent conflicts of interest
To enhance data encryption
To improve network speed
Which industries commonly use the Brewer and Nash model?
Retail and hospitality
Financial, medical, or legal
Manufacturing and agriculture
Entertainment and sports
What are the three main resource classes considered in the Brewer and Nash model?
Files, databases, and networks
Objects, company groups, and conflict classes
Users, roles, and permissions
Hardware, software, and firmware
What is a common security issue related to physical access controls?
Phishing
Tailgating
Malware
DDoS attacks
What do door control systems that use badges frequently use in their software?
Firewalls
ACLs
VPNs
IDS
What happens in the Brewer and Nash model when a lawyer views Client A's case materials?
The lawyer can access all client information
The lawyer can access information pertaining to Client B
The lawyer can no longer access information pertaining to Client B
The lawyer can access information from competing firms
What is one method mentioned for solving tailgating in a physical access control system?
Implementing a policy that forbids it
Allowing multiple people to pass through at a time
Removing all physical barriers
Ignoring the issue
What event led to increased security measures at airports in the United States?
The terrorist attacks of September 11, 2001
The financial crisis of 2008
The introduction of new technology
The increase in air traffic
What is a Jersey barrier used for in physical access control?
To allow vehicles to pass through easily
To block unauthorized vehicle access
To provide a resting place for pedestrians
To enhance the aesthetic appeal of the area
What is the key step in the process of allowing parties to access resources?
Identification
Authentication
Authorization
All of the above
What are the two methods typically used to implement authorization in access control?
Passwords and PINs
Access control lists and capabilities
Biometric scans and security questions
Firewalls and antivirus software
Discuss the difference between authorization and access control.
Authorization determines who is allowed to access resources, while access control enforces the rules.
Access control determines who is allowed to access resources, while authorization enforces the rules.
Authorization and access control are the same.
Authorization is a type of access control.
What does the Brewer and Nash model protect against?
Unauthorized data modification
Conflicts of interest
Data loss
Network intrusions
Why does access control based on the Media Access Control address of the systems on our network not represent strong security?
MAC addresses can be easily spoofed.
MAC addresses are too long to manage.
MAC addresses are not unique.
MAC addresses change frequently.
Which should take place first, authorization or authentication?
Authorization
Authentication
Both should occur simultaneously
Neither is necessary
What are the differences between the MAC and DAC models of access control?
MAC is more flexible than DAC.
DAC is more secure than MAC.
MAC is based on user discretion, while DAC is based on a central authority.
MAC is based on a central authority, while DAC is based on user discretion.
The Bell-LaPadula and Biba multilevel access control models both have a primary security focus. Can these two models be used together?
Yes, they complement each other.
No, they are mutually exclusive.
Yes, but only in specific environments.
No, they address the same security concerns.
If you have a file containing sensitive data on a Linux operating system, would setting the permissions to rw-rw-rw- cause a potential security issue? If so, which portions of the CIA triad might be affected?
No, it would not cause a security issue.
Yes, it would affect confidentiality.
Yes, it would affect integrity.
Yes, it would affect availability.
Which access control model could you use to prevent users from logging into their accounts after business hours?
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)
Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)
Explain how the confused deputy problem could allow users to carry out activities for which they are not authorized.
By exploiting a flaw in the access control list.
By tricking a higher-privileged entity into performing actions on their behalf.
By using stolen credentials.
By bypassing authentication mechanisms.
What are some of the differences between access control lists and capabilities?
